How to to use "--rootfs ./dir:O" when dir is a squashfuse mount point? #12146
Unanswered
eriksjolund
asked this question in
Q&A
Replies: 4 comments 11 replies
-
|
I see no reason why this would not work. I don't think we should add a feature to Podman to support mounting squashfs, but --rootfs should work on any type of file system. SELinux could block certain accesses. And User Namespace might be a problem, depending on the ownership of files. |
Beta Was this translation helpful? Give feedback.
7 replies
-
|
I think this is happening because the underlying fs has wrong ownership and podman is unable to create To verify @eriksjolund could you try. But this patch cannot be merged into upstream. diff --git a/libpod/container_internal.go b/libpod/container_internal.go
index b9805faa3..8b699d25b 100644
--- a/libpod/container_internal.go
+++ b/libpod/container_internal.go
@@ -1545,7 +1545,7 @@ func (c *Container) mountStorage() (_ string, deferredErr error) {
}
//note: this should not be recursive, if using external rootfs users should be responsible on configuring ownership.
- if err := chown.ChangeHostPathOwnership(mountPoint, false, int(hostUID), int(hostGID)); err != nil {
+ if err := chown.ChangeHostPathOwnership(mountPoint, true, int(hostUID), int(hostGID)); err != nil {
return "", err
}
}But I am not entirely sure so I'll try reproducing this then i can verify. |
Beta Was this translation helpful? Give feedback.
-
|
looks like the wrong path. Shouldn't it be Is Does it make any difference if you specify the full path to rootfs?
|
Beta Was this translation helpful? Give feedback.
-
|
@flouthoc @giuseppe There seems to be no resolv.conf. Providing the full path to --rootfs also fails. (See Bash script example below). Here is a Bash script that can be run on a Fedora 34 computer to demonstrate the difference between using squashfuse (case 1) and not using squashfuse (case 2). The script provides the full path to --rootfs. Testing the two cases |
Beta Was this translation helpful? Give feedback.
-
|
@flouthoc after applying your patch I got the same result as before. I then reverted the patch and rebuilt podman from abbd6c1 (from the main branch). The user testuser was deleted and recreated Interestingly but not when using a mount from squashfuse Here is a new test script (test.bash): (adding the command-line flag -d enables debug output from squashfuse) Run the script test.bash: The script test.bash does not return, but it echoes a few commands that can be copy-pasted into another terminal window: Test with rootfs from a normal squahfs mount (result: success)Test with rootfs from a squashfuse mount (result: failure)In the first terminal window where the script test.bash is running there is now some debug output from squashfuse. An observation while repeating the test with the squashfuse mount is that the After that I tried out a few different command-line options for squashfuse :
Comparing the mount directoriesThe mount directories look similar |
Beta Was this translation helpful? Give feedback.
-
|
A new test. I verified that it works with another FUSE filesystem (bindfs). bindfs is a FUSE filesystem for mounting a directory to another location, similarly to mount --bind I installed bindfs with Run |
Beta Was this translation helpful? Give feedback.
-
|
First success! test.sh run I guess it would be better not to disable xattr and also not to force a single UID (by untarring as a non-privileged user) but at least this is a start. |
Beta Was this translation helpful? Give feedback.
3 replies
-
|
The script can be simplified by using the command sqfstar that converts tar to squashfs. test2.sh (I didn't have to add the command-line option To avoid the command-line options |
Beta Was this translation helpful? Give feedback.
-
|
Here is an experiment that adds the option branch: UIDs are mapped to the user's UID and the user's subordinate UIDs. The library libsubid is used to retrieve the subordinate IDs for the user. test-with-new-libfuse-option.sh Run The example shows two files that have different group ownership. |
Beta Was this translation helpful? Give feedback.
-
|
Thinking a bit more about it. Instead of a new option subid, what probably is needed are (Another thing: Oops I see that I hard-coded the username "testuser" in eriksjolund/libfuse@ddc949d) |
Beta Was this translation helpful? Give feedback.
-
|
Sure you should be able to untar inside of a user namespace and use multiple UIDs. podman unshare untar ... Xattrs will could effect setfcap |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
Once you get this done, it would probably make a good Blog. |
Beta Was this translation helpful? Give feedback.
1 reply
-
|
Yes, I thought about writing something about it. Another idea regarding this could be to try to run Singularity images Quote Probably there are some caveats but maybe it could work to some degree. |
Beta Was this translation helpful? Give feedback.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Do you think it should be possible to provide the rootfs directory from a squashfuse FUSE mountpoint when using
podman run --rootfs ./dir:O ...with rootless Podman?The idea is to first mount the squashfs archive with
squashfuseand then provide the mountpoint to--rootfs.Something like this:
I tried it out on a Fedora 34 computer with Podman built from the Git commit 85bad0c
but it failed
Running from the original directory
--rootfs ./alpinecontainer/:Oworked fine.When listing the files in the directories mntdir/ and alpinecontainer/ they look the same
Sidenote 1: I think the functionality to use rootfs with overlay (
podman run --rootfs ./dir:O ...) is not yet available in any Podman release (so you need to build Podman from the Git repository).Sidenote 2: Not related to this question regarding
--rootfs, but I managed to mount a squashfs archive from within a container when running rootless Podman:https://stackoverflow.com/questions/69786271/how-to-mount-a-squashfs-file-in-a-container-when-running-rootless-podman
Beta Was this translation helpful? Give feedback.
All reactions