storage: Document force_mask UID 0 mapping requirement

[ipilcher]

force_mask doesn't work in rootless mode when the container's UID 0 is mapped to something other than the host UID of the user running the container. This PR adds a note about this requirement to containers-storage.conf.5.md.

[TomSweeneyRedHat]

And more importantly, thanks for the PR @ipilcher !

[ipilcher]

I seem to have bollixed everything up by hitting GitHub's "Commit suggestion" button.

EDIT: I think I managed to fix it.

[mtrmac]

Thanks! This looks plausible but I’d prefer a LGTM from @giuseppe .

[mtrmac]

fuse-overlayfs is a filesystem implementation, not a “storage driver” in the c/storage sense (overlay/vfs/btrfs). Maybe “filesystem”? “process”? Or revert to the previous version, which can be ambiguous about what exactly the thing is?

[giuseppe]

The fuse-overlayfs process doesn't run inside the nested user namespace.

What error are you seeing?

[ipilcher]

The fuse-overlayfs process doesn't run inside the nested user namespace.

What error are you seeing?

I see an error if I map UID 0 to a subuid.

$ podman run --rm -it \
        \
        --uidmap 0:@500100 \
        --uidmap 42:@500101 \
        --uidmap 499:@500102 \
        \
        --gidmap 0:@500100 \
        --gidmap 4:@500101 \
        --gidmap 5:@500102 \
        --gidmap 8:@500103 \
        --gidmap 42:@500104 \
        --gidmap 43:@500105 \
        --gidmap 50:@500106 \
        --gidmap 499:@500107 \
        \
        docker.io/library/debian:bookworm-slim \
        /bin/sh
Error: crun: open `/var/tmp/intermediate-mountpoint-1000.0/etc/hosts`: No such file or directory: OCI runtime attempted to invoke a command that was not found

If I map UID 0 to the UID of the user running podman, it works.

$ podman run --rm -it \
        \
        --uidmap 0:@1000 \
        --uidmap 42:@500101 \
        --uidmap 499:@500102 \
        \
        --gidmap 0:@500100 \
        --gidmap 4:@500101 \
        --gidmap 5:@500102 \
        --gidmap 8:@500103 \
        --gidmap 42:@500104 \
        --gidmap 43:@500105 \
        --gidmap 50:@500106 \
        --gidmap 499:@500107 \
        \
        docker.io/library/debian:bookworm-slim \
        /bin/sh
# whoami
root

[giuseppe]

Is it enough that the user is mapped into the user namespace (any id, not necessarily root)?

[ipilcher]

Is it enough that the user is mapped into the user namespace (any id, not necessarily root)?

It doesn't appear to be.

$ podman run --rm -it \
        \
        --uidmap 0:@500100 \
        --uidmap 42:@500101 \
        --uidmap 499:@1000 \
        \
        --gidmap 0:@500100 \
        --gidmap 4:@500101 \
        --gidmap 5:@500102 \
        --gidmap 8:@500103 \
        --gidmap 42:@500104 \
        --gidmap 43:@500105 \
        --gidmap 50:@500106 \
        --gidmap 499:@500107 \
        \
        docker.io/library/debian:bookworm-slim \
        /bin/sh
Error: crun: open `/var/tmp/intermediate-mountpoint-1000.0/etc/hosts`: No such file or directory: OCI runtime attempted to invoke a command that was not found

[giuseppe]

what podman version are you using?

Your command works on my Fedora Rawhide:

 cat ~/.config/containers/storage.conf  | grep -E -v '^(#|$)'
[storage]
driver = "overlay"
[storage.options]
additionalimagestores = [
]
[storage.options.pull_options]
[storage.options.overlay]
mount_program = "/usr/bin/fuse-overlayfs"
mountopt = "nodev,metacopy=on"
force_mask = "000"

$ podman run --rm -it \
        \
        --uidmap 0:@100100 \
        --uidmap 42:@100101 \
        --uidmap 499:@100102 \
        \
        --gidmap 0:@100100 \
        --gidmap 4:@100101 \
        --gidmap 5:@100102 \
        --gidmap 8:@100103 \
        --gidmap 42:@100104 \
        --gidmap 43:@100105 \
        --gidmap 50:@100106 \
        --gidmap 499:@100107 \
        \
        docker.io/library/debian:bookworm-slim \
        /bin/sh
#

I think we should treat this as an issue, and figure out why it doesn't work for you instead of documenting it

[ipilcher]

what podman version are you using?

I am running podman-5.8.1-1.fc43.x86_64 on Fedora 43.

Your command works on my Fedora Rawhide:

Interesting!

I think we should treat this as an issue, and figure out why it doesn't work for you instead of documenting it

I have created #764.