sudo podman run + --userns=auto + server app in Rust language that wants to write file on mounted volume -> Permission denied (os error 13)

[Folaht]

[I have been advised to use the --userns=auto option when running an app in a rootfull container that 'mounts a volume' for better security.

I still consider the '--mount' option to be like file sharing. I'm not sure if the two are the same.
But anyway, I'm sharing a folder and due to the --userns=auto option, this folder is now owned by nobody instead of root.
This however caused the application that's run by root to no longer have the permission to write to the configuration file inside that folder.

The run command

sudo podman run \ 
--name root_node \
--publish 192.168.178.26:12000-12015:12000-12015/udp \
--env CON_IP=10.88.0.2 \
--env CON_PORT=12000 \
--env PUB_IP=my.ip.v.4 \
--env PUB_PORT=12000 \
--env VERBOSE=-vv \
--ip 10.88.0.2 \
--userns=auto --mount type=bind,source=/home/folaht/.local/share/safe/cli/,destination=/root/.safe/cli/ \
-d ghcr.io/safenetwork-community/rf-rootnode-ipv4:latest

This is the error I'm getting:

Error:
   0: Unable to create config at '/root/.safe/cli/config.json'
   1: Unable to write config settings to '/root/.safe/cli/config.json'
   2: Permission denied (os error 13)

Location:
   sn_cli/src/operations/config.rs:388

This seems to be a normal write action.
https://github.com/maidsafe/safe_network/blob/main/sn_cli/src/operations/config.rs#L167
https://github.com/maidsafe/safe_network/blob/main/sn_cli/src/operations/config.rs#L386

bash-5.1# ls -lha
total 24M
drwxr-xr-x    1 root     root        4.0K Apr  9 09:31 .
drwx------    1 root     root        4.0K Apr  9 09:48 ..
drwxr-xr-x    1 root     root        4.0K Apr  9 05:48 bin
drwxr-xr-x    3 nobody   nobody      4.0K Mar 27 11:53 cli
drwxr-xr-x    1 root     root        4.0K Apr  9 09:31 node
drwxr-xr-x    2 root     root        4.0K Apr  9 09:31 prefix_maps
-rwxr-xr-x    1 root     root       24.0M Apr  1 06:16 safe

bash-5.1# ls -lha
total 20K
drwxr-xr-x    3 nobody   nobody      4.0K Mar 27 11:53 .
drwxr-xr-x    1 root     root        4.0K Apr  9 09:31 ..
-rw-r--r--    1 nobody   nobody       118 Mar 29 10:31 config.json
drwxr-xr-x    2 nobody   nobody      4.0K Mar 27 11:53 networks

Uhmmm.... how is this even possible?
Is this a podman error or should I contact the makers of the app?

[Folaht]

I discovered that this is an Alpine Linux issue.
Apparently it's root user doesn't have permission over nobody.

[Folaht]

And furthermore I was using bind mounts instead of named volumes.
Problem solved by using named volumes.

[mheon]

You may find https://www.redhat.com/sysadmin/debug-rootless-podman-mounted-volumes helpful