Mapping of user Id's

user_11636172 0
Viewed 3006

I'm evaluating podman in rootless mode and faceing an issue with the User ID Mapping.

I run podman with "myuser" who has the ID 1000.

cat /etc/subuid
myuser:100000:65536

When running a pod, where the pod user is root, the created files on the mounted volume belongs to "myuser" from host perspective, I can access them and so everything is fine.

When running a pod, where the pod user is not root, for example UID 2002, the created files on the mounted volume belongs to UID "102002" from host perspective which results in the situation, that I can not access that files on the host.

As expected, podman unshare looks like following

podman unshare cat /proc/self/uid_map
0       1000          1
1     100000      65536

Is there any chance, that I can get access to this files by correct configuration of the podman run or config files?

Thanks Joerg

podman
2 Answers

Yes, you can remap UIDs by using the command-line option --uidmap.

It looks like the container UID you are using is

102002-100000+1=2003

The digit 1 is there because the normal UID on the host is mapped to root in the container by default.

This example demonstrates such a calculation (1002002-100000+1=2003)

$ id  -un
testuser
$ grep testuser /etc/subuid
testuser:100000:65536
$ grep testuser /etc/subgid
testuser:100000:65536
$ mkdir dir1
$ chmod 777 dir1
$ podman run --rm -v ./dir1:/dir1:Z \
             --user 2003:2003 \
             docker.io/library/ubuntu touch /dir1/a
$ ls -l dir1/a
-rw-r--r--. 1 102002 102002 0 Jan 19 19:35 dir1/a
$

Let's define some variables so that this Stackoverflow answer can be more reusable for others.

uid=2003
subuidStart=100000
subuidSize=65536

You could try passing these three options at the same time to podman run

  • --uidmap $uid:0:1
  • --uidmap 0:1:$uid
  • --uidmap $(($uid+1)):$(($uid+1)):$(($subuidSize-$uid))

Note $(( expression )) is Bash syntax so you need to use a bash shell.

--uidmap $uid:0:1

Map the UID $uid in the container to your normal UID on the host.

host UID intermediate UID container UID
normal host UID 0 $uid

--uidmap 0:1:$uid

Map the UIDs between 0 and $uid - 1 in the container to the lower part of the subuids (subordinate UIDs) (from $subuidStart to $subuidStart+$uid-1).

host UID intermediate UID container UID
$subuidStart 1 0
$subuidStart + 1 2 1
... ... ...
$subuidStart + $uid - 1 $uid $uid - 1

--uidmap $(($uid+1)):$(($uid+1)):$(($subuidSize-$uid))

Map the UIDs between $uid+1 and $subuidSize in the container to the remaining subuids.

host UID intermediate UID container UID
$subuidStart + $uid $uid + 1 $uid + 1
$subuidStart + $uid + 1 $uid + 2 $uid + 2
... ... ...
$subuidStart + $subuidSize - 1 $subuidSize $subuidSize

Note that the mapping between host UIDs and the intermediate UIDs can't be modified by the user. The normal host UID is always mapped to the intermediate UID 0.

Note that in the general case there might be more than one range of subuids.

There is a similar command-line option --gidmap for GIDs.

Update 2022-02-14

I wrote a troubleshooting tip about this in the Podman documentation.

user_7577770
user_11062940
Related