Writable directories with rootless Podman

user_900545 0
Viewed 468

I'm trying to run rootless Podman containers with

podman container create --name postgres --expose 5432 --memory 512M --hostname postgres --volume /home/user/some/path/postgres:/var/lib/postgresql/data:Z,U --userns keep-id --env POSTGRES_USER=admin --env POSTGRES_PASSWORD=secret docker.io/postgres:14

but I'm getting the error message

Error: error stat'ing file `/home/user/some/path/postgres`: Permission denied: OCI permission denied

The destination path /home/user/some/path is within a gocryptfs mount. Mapping the volume outside the path works flawlessly.

So far I thought that --userns keep-id should avoid permission issues for rootless containers but if I'm removing the option I'm getting the error message

chown: changing ownership of '/var/lib/postgresql/data': Operation not permitted

As far as I understood, providing the options --uidmap and --gidmap could help as well but I'm not sure how I can provide the proper values for it.

Under the hood I'm using Ansible to configure the containers.

EDIT: Now I also created a Podman issue.

rootless podman ansible
2 Answers

Make sure that you had done with /etc/subuid and /etc/subgid configuration, as it described here:

https://github.com/containers/podman/blob/main/docs/tutorials/rootless_tutorial.md

Rootless Podman requires the user running it to have a range of UIDs listed in the files /etc/subuid and /etc/subgid.

...

The format of this file is USERNAME:UID:RANGE

  • username as listed in /etc/passwd or in the output of getpwent.
  • The initial UID allocated for the user.
  • The size of the range of UIDs allocated for the user.

Example:

# cat /etc/subuid
johndoe:100000:65536
test:165536:65536
user_119470550
user_9005450
Related