Set container location to mounted partition

[universidadpty]

I have edited fstab file for auto mount other partition to manage disk space for specific files and applications. Entrusted works well using /home/$USER/.local/share/containers as default, but when I recursively moved referred directory to other partition, created soft link and assigned user:group as the original it fails to sanitize documents showing this message:

Converting /home/$USER/tor-browser_en-US/Browser/Downloads/DAAML Act of 2022.es.pdf
Running command: /usr/bin/podman inspect docker.io/uycyjnzgntrn/entrusted_container:0.2.6
Checking if container image exists
Running command: /usr/bin/podman run --rm --network none --cap-drop all --userns keep-id --security-opt no-new-privileges -v /home/$USER/tor-browser_en-US/Browser/Downloads/DAAML Act of 2022.es.pdf:/tmp/input_file:Z -v /tmp/entrusted/safe:/safezone:Z -e LOG_FORMAT=json -e ENTRUSTED_LANGID=en -e OCR_LANGUAGE=spa docker.io/uycyjnzgntrn/entrusted_container:0.2.6 /usr/local/bin/entrusted-container
Starting document processing

Do I have to give a specific permission to a particular folder?

[yveszoundi]

I don't think that podman expects that kind of use-case to save or manage disk space (.local/share/containers storage). I believe that not only it will often lead to permission issues, but also occasionally special reference paths to other user IDs...

Potential solutions

Adjusting specific folder permissions

Please let me know if the commands below address your issue (/home/entrusted, /safezone and /tmp in the container marked as read-write for all). If it does work, I don't know if you'll need to repeat it as you switch storage locations.

sudo find /home/$USER/.local/share/containers -type d -name "entrusted" -exec chmod -R a+rw {} \;
sudo find /home/$USER/.local/share/containers -type d -name "safezone"  -exec chmod -R a+rw {} \;
sudo find /home/$USER/.local/share/containers -type d -name "safezone"       -exec chmod -R a+rw {}/../tmp/ \;

Configuring additional image stores

I have never done this myself, but it appears that you can setup additional shared storage. If it really works as advertized, it might be more viable/flexible for you:

• Have select users with $HOME/.local/share/containers/storage.conf pointing to some global storage (/global_storage)
• Pulling initially Entrustedto global storage:
  • sudo chmod -R a +rw /global_storage
  • podman pull --root /global_storage docker.io/uycyjnzgntrn/entrusted_container:0.2.6, assuming that you're using Entrusted 0.2.6. That would make the image available to the select Entrusted users
  • Open Entrusted with one of Entrusted users to confirm that it works (possibly need to chmod specific folders as described in the previous potential solution)

Possibly related?

• https://www.redhat.com/sysadmin/image-stores-podman
• Copy/Move images between users containers/podman#2979
• https://stackoverflow.com/questions/66745670/how-can-i-use-sudo-podman-to-run-a-container-from-current-user-image-store
• Sharing images between rootless and root containers/podman#5608