Regression in 'create': fails to start on Silverblue because it tries to bind-mount /usr from the host as read-write

[Zlopez]

Hi,

I recently updated to Fedora 31 Silverblue beta and I'm not able to enter toolbox anymore. I tried to delete the F30 toolbox and created a new one with F31.

When trying toolbox -v enter I ended up with:

toolbox: resolved absolute path for /usr/bin/toolbox to /usr/bin/toolbox
toolbox: checking if /etc/subgid and /etc/subuid have entries for user zlopez
toolbox: TOOLBOX_PATH is /usr/bin/toolbox
toolbox: checking if 'podman system migrate' exists
toolbox: migration not needed: 1.5.1 is unchanged
toolbox: Fedora generational core is f31
toolbox: base image is fedora-toolbox:31
toolbox: container is fedora-toolbox-31
toolbox: checking if container fedora-toolbox-31 exists
toolbox: calling org.freedesktop.Flatpak.SessionHelper.RequestSession
toolbox: starting container fedora-toolbox-31
toolbox: /etc/profile.d/toolbox.sh already mounted in container fedora-toolbox-31
Error: unable to start container "fedora-toolbox-31": error reading container (probably exited) json message: EOF
toolbox: failed to start container fedora-toolbox-31

[rajveermalviya]

Experiencing the same error on my Silverblue 31 beta machine.

[juhp]

Sadly toolbox is not working with current F31 podman.
Best bet in my opinion for SB31 is to try podman-1.6.0-0.2.rc2.git9181c65.fc31 from koji, but even that tends to surface problems, like this:

$ toolbox -v enter -r 31
:
:
Error: unable to start container "fedora-toolbox-31": remount '/var/home/petersen/.local/share/containers/storage/overlay/b0a3ed174ba2143628674a8dffa1859017ef8726d10465fea23345c1f710e825/merged/run/host/usr': Operation not permitted: OCI runtime permission denied error

I am not sure if this can be fixed in Toolbox or Podman..
Though with recent podman-1.6-dev it works fine in Fedora 31 Workstation.

[debarshiray]

Yes, this was a regression in the create command introduced by https://github.com/debarshiray/toolbox/pull/264.

This should be fixed by https://github.com/debarshiray/toolbox/pull/276 but since the bug was in create, you will have to recreate the container.

(There's a more detailed discussion of this in containers/podman#4061)