Disk quota limitation of podman volumes in rootless mode

[Serebana]

Hello,
I try to set a size limit for the podman volume and after mount it to the container in rootless mode. Could you please help me with it?

Steps to reproduce the issue:

• Create xfs file system and mount it with pqouta option to use it as podman storage directory (found this requrement https://docs.podman.io/en/latest/markdown/podman-volume-create.1.html)

### $ mount | grep /podman_volumes
/podman_volumes on /home/true/.local/share/containers type xfs (rw,relatime,attr2,inode64,logbufs=8,logbsize=32k,prjquota)
$ df -Th .local/share/containers/
Filesystem     Type  Size  Used Avail Use% Mounted on
/dev/loop20    xfs  1014M   46M  969M   5% /home/true/.local/share/containers

• Create a volume with size option

### $ podman volume create --opt o=type=xfs,size=100M vol1
vol1
$ podman volume inspect vol1 
        "Name": "vol1",
        "Driver": "local",
        "Mountpoint": "/home/true/.local/share/containers/storage/volumes/vol1/_data",
        "CreatedAt": "2022-05-05T17:28:14.928578601+03:00",
        "Labels": {},
        "Scope": "local",
        "Options": {
            "o": "type=xfs,size=100M"
        }

• Run Alpine container and mount this volume

### $ podman run -it --net "none" -v vol1:/home --name vol_test docker.io/library/alpine:latest 
Error: error mounting volume vol1 for container db3227796c657d8a66527acf486f81ca4cf4ff19f007ead555e0ef6b78e782d7: cannot mount volumes without root privileges: operation requires root privileges 

Describe the results you received:
Error: error mounting volume vol1 for container db3227796c657d8a66527acf486f81ca4cf4ff19f007ead555e0ef6b78e782d7: cannot mount volumes without root privileges: operation requires root privileges

### $ podman inspect vol_test 
[
    {
        "Id": "082b3e282c8e42fcab3e53acad0e8579e5fa3be6881d5d294f1b65c106b5e08b",
        "Created": "2022-05-05T17:34:20.148909257+03:00",
        "Path": "/bin/sh",
        "Args": [
            "/bin/sh"
        ],
        "State": {
            "OciVersion": "1.0.2-dev",
            "Status": "configured",
            "Running": false,
            "Paused": false,
            "Restarting": false,
            "OOMKilled": false,
            "Dead": false,
            "Pid": 0,
            "ExitCode": 0,
            "Error": "",
            "StartedAt": "0001-01-01T00:00:00Z",
            "FinishedAt": "0001-01-01T00:00:00Z",
            "Healthcheck": {
                "Status": "",
                "FailingStreak": 0,
                "Log": null
            }
        },
        "Image": "0ac33e5f5afa79e084075e8698a22d574816eea8d7b7d480586835657c3e1c8b",
        "ImageName": "docker.io/library/alpine:latest",
        "Rootfs": "",
        "Pod": "",
        "ResolvConfPath": "",
        "HostnamePath": "",
        "HostsPath": "",
        "StaticDir": "/home/true/.local/share/containers/storage/overlay-containers/082b3e282c8e42fcab3e53acad0e8579e5fa3be6881d5d294f1b65c106b5e08b/userdata",
        "OCIRuntime": "runc",
        "ConmonPidFile": "/run/user/1000/containers/overlay-containers/082b3e282c8e42fcab3e53acad0e8579e5fa3be6881d5d294f1b65c106b5e08b/userdata/conmon.pid",
        "PidFile": "/run/user/1000/containers/overlay-containers/082b3e282c8e42fcab3e53acad0e8579e5fa3be6881d5d294f1b65c106b5e08b/userdata/pidfile",
        "Name": "vol_test",
        "RestartCount": 0,
        "Driver": "overlay",
        "MountLabel": "",
        "ProcessLabel": "",
        "AppArmorProfile": "",
        "EffectiveCaps": [
            "CAP_CHOWN",
            "CAP_DAC_OVERRIDE",
            "CAP_FOWNER",
            "CAP_FSETID",
            "CAP_KILL",
            "CAP_NET_BIND_SERVICE",
            "CAP_SETFCAP",
            "CAP_SETGID",
            "CAP_SETPCAP",
            "CAP_SETUID",
            "CAP_SYS_CHROOT"
        ],
        "BoundingCaps": [
            "CAP_CHOWN",
            "CAP_DAC_OVERRIDE",
            "CAP_FOWNER",
            "CAP_FSETID",
            "CAP_KILL",
            "CAP_NET_BIND_SERVICE",
            "CAP_SETFCAP",
            "CAP_SETGID",
            "CAP_SETPCAP",
            "CAP_SETUID",
            "CAP_SYS_CHROOT"
        ],
        "ExecIDs": [],
        "GraphDriver": {
            "Name": "overlay",
            "Data": {
                "LowerDir": "/home/true/.local/share/containers/storage/overlay/4fc242d58285699eca05db3cc7c7122a2b8e014d9481f323bd9277baacfa0628/diff",
                "UpperDir": "/home/true/.local/share/containers/storage/overlay/3ae561558f951d2217afb9f058d3080dc9220ddd49dff8ba9781b71214ddc40c/diff",
                "WorkDir": "/home/true/.local/share/containers/storage/overlay/3ae561558f951d2217afb9f058d3080dc9220ddd49dff8ba9781b71214ddc40c/work"
            }
        },
        "Mounts": [
            {
                "Type": "volume",
                "Name": "vol1",
                "Source": "/home/true/.local/share/containers/storage/volumes/vol1/_data",
                "Destination": "/home",
                "Driver": "local",
                "Mode": "",
                "Options": [
                    "nosuid",
                    "nodev",
                    "rbind"
                ],
                "RW": true,
                "Propagation": "rprivate"
            }
        ],
        "Dependencies": [],
        "NetworkSettings": {
            "EndpointID": "",
            "Gateway": "",
            "IPAddress": "",
            "IPPrefixLen": 0,
            "IPv6Gateway": "",
            "GlobalIPv6Address": "",
            "GlobalIPv6PrefixLen": 0,
            "MacAddress": "",
            "Bridge": "",
            "SandboxID": "",
            "HairpinMode": false,
            "LinkLocalIPv6Address": "",
            "LinkLocalIPv6PrefixLen": 0,
            "Ports": {},
            "SandboxKey": ""
        },
        "ExitCommand": [
            "/usr/bin/podman",
            "--root",
            "/home/true/.local/share/containers/storage",
            "--runroot",
            "/run/user/1000/containers",
            "--log-level",
            "warning",
            "--cgroup-manager",
            "systemd",
            "--tmpdir",
            "/run/user/1000/libpod/tmp",
            "--runtime",
            "runc",
            "--storage-driver",
            "overlay",
            "--storage-opt",
            "overlay.mountopt=nodev",
            "--events-backend",
            "journald",
            "container",
            "cleanup",
            "082b3e282c8e42fcab3e53acad0e8579e5fa3be6881d5d294f1b65c106b5e08b"
        ],
        "Namespace": "",
        "IsInfra": false,
        "Config": {
            "Hostname": "082b3e282c8e",
            "Domainname": "",
            "User": "",
            "AttachStdin": false,
            "AttachStdout": false,
            "AttachStderr": false,
            "Tty": true,
            "OpenStdin": true,
            "StdinOnce": false,
            "Env": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "TERM=xterm",
                "container=podman"
            ],
            "Cmd": [
                "/bin/sh"
            ],
            "Image": "docker.io/library/alpine:latest",
            "Volumes": null,
            "WorkingDir": "/",
            "Entrypoint": "",
            "OnBuild": null,
            "Labels": null,
            "Annotations": {
                "io.kubernetes.cri-o.TTY": "true",
                "io.podman.annotations.autoremove": "FALSE",
                "io.podman.annotations.init": "FALSE",
                "io.podman.annotations.privileged": "FALSE",
                "io.podman.annotations.publish-all": "FALSE"
            },
            "StopSignal": 15,
            "CreateCommand": [
                "podman",
                "run",
                "-it",
                "--net",
                "none",
                "-v",
                "vol1:/home",
                "--name",
                "vol_test",
                "docker.io/library/alpine:latest"
            ],
            "Umask": "0022",
            "Timeout": 0,
            "StopTimeout": 10
        },
        "HostConfig": {
            "Binds": [
                "vol1:/home:rw,rprivate,nosuid,nodev,rbind"
            ],
            "CgroupManager": "systemd",
            "CgroupMode": "private",
            "ContainerIDFile": "",
            "LogConfig": {
                "Type": "k8s-file",
                "Config": null,
                "Path": "/home/true/.local/share/containers/storage/overlay-containers/082b3e282c8e42fcab3e53acad0e8579e5fa3be6881d5d294f1b65c106b5e08b/userdata/ctr.log",
                "Tag": "",
                "Size": "0B"
            },
            "NetworkMode": "none",
            "PortBindings": {},
            "RestartPolicy": {
                "Name": "",
                "MaximumRetryCount": 0
            },
            "AutoRemove": false,
            "VolumeDriver": "",
            "VolumesFrom": null,
            "CapAdd": [],
            "CapDrop": [
                "CAP_AUDIT_WRITE",
                "CAP_MKNOD",
                "CAP_NET_RAW"
            ],
            "Dns": [],
            "DnsOptions": [],
            "DnsSearch": [],
            "ExtraHosts": [],
            "GroupAdd": [],
            "IpcMode": "private",
            "Cgroup": "",
            "Cgroups": "default",
            "Links": null,
            "OomScoreAdj": 0,
            "PidMode": "private",
            "Privileged": false,
            "PublishAllPorts": false,
            "ReadonlyRootfs": false,
            "SecurityOpt": [],
            "Tmpfs": {},
            "UTSMode": "private",
            "UsernsMode": "",
            "ShmSize": 65536000,
            "Runtime": "oci",
            "ConsoleSize": [
                0,
                0
            ],
            "Isolation": "",
            "CpuShares": 0,
            "Memory": 0,
            "NanoCpus": 0,
            "CgroupParent": "user.slice",
            "BlkioWeight": 0,
            "BlkioWeightDevice": null,
            "BlkioDeviceReadBps": null,
            "BlkioDeviceWriteBps": null,
            "BlkioDeviceReadIOps": null,
            "BlkioDeviceWriteIOps": null,
            "CpuPeriod": 0,
            "CpuQuota": 0,
            "CpuRealtimePeriod": 0,
            "CpuRealtimeRuntime": 0,
            "CpusetCpus": "",
            "CpusetMems": "",
            "Devices": [],
            "DiskQuota": 0,
            "KernelMemory": 0,
            "MemoryReservation": 0,
            "MemorySwap": 0,
            "MemorySwappiness": 0,
            "OomKillDisable": false,
            "PidsLimit": 2048,
            "Ulimits": [],
            "CpuCount": 0,
            "CpuPercent": 0,
            "IOMaximumIOps": 0,
            "IOMaximumBandwidth": 0,
            "CgroupConf": null
        }
    }
]

Describe the results you expected:
Running container and the mounted volume with size limit

Output of podman version:

### $ podman version 
Version:      3.2.1
API Version:  3.2.1
Go Version:   go1.16.7
Built:        Thu Jan  1 03:00:00 1970
OS/Arch:      linux/amd64

Output of podman info --debug:

### $  podman info --debug
host:
  arch: amd64
  buildahVersion: 1.21.3
  cgroupControllers: []
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: 'conmon: /usr/bin/conmon'
    path: /usr/bin/conmon
    version: 'conmon version 2.0.25, commit: unknown'
  cpus: 12
  distribution:
    distribution: ubuntu
    version: "21.10"
  eventLogger: journald
  hostname: "false"
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
  kernel: 5.13.0-40-generic
  linkmode: dynamic
  memFree: 6791671808
  memTotal: 16553766912
  ociRuntime:
    name: runc
    package: 'runc: /usr/sbin/runc'
    path: /usr/sbin/runc
    version: |-
      runc version 1.1.0-0ubuntu1~21.10.1
      spec: 1.0.2-dev
      go: go1.17
      libseccomp: 2.5.1
  os: linux
  remoteSocket:
    exists: true
    path: /run/user/1000/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: 'slirp4netns: /usr/bin/slirp4netns'
    version: |-
      slirp4netns version 1.0.1
      commit: 6a7b16babc95b6a3056b33fb45b74a6f62262dd4
      libslirp: 4.4.0
  swapFree: 2147479552
  swapTotal: 2147479552
  uptime: 23h 49m 44.51s (Approximately 0.96 days)
registries: {}
store:
  configFile: /home/true/.config/containers/storage.conf
  containerStore:
    number: 2
    paused: 0
    running: 0
    stopped: 2
  graphDriverName: overlay
  graphOptions:
    overlay.mountopt: nodev
  graphRoot: /home/true/.local/share/containers/storage
  graphStatus:
    Backing Filesystem: xfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Using metacopy: "false"
  imageStore:
    number: 1
  runRoot: /run/user/1000/containers
  volumePath: /home/true/.local/share/containers/storage/volumes
version:
  APIVersion: 3.2.1
  Built: 0
  BuiltTime: Thu Jan  1 03:00:00 1970
  GitCommit: ""
  GoVersion: go1.16.7
  OsArch: linux/amd64
  Version: 3.2.1

[mheon]

You need a significantly more recent (AFAIK 4.0+) Podman to use volumes that require options as a non-root user. I don't know for certain this will work with a newer Podman (never had to use quotas as rootless - there could be permissions issues), though.

[Serebana]

Thanks, I will try with the newer podman version. For me most important is that I move in the correct way and my goal could be possible to achieve.

[rhatdan]

The disk has to be XFS and it has to be setup with pquota.

[Serebana]

As you can see I create a LV type xfs and mount it to the storage directory

### $ mount | grep /podman_volumes
/podman_volumes on /home/true/.local/share/containers type xfs (rw,relatime,attr2,inode64,logbufs=8,logbsize=32k,prjquota)
$ df -Th .local/share/containers/
Filesystem     Type  Size  Used Avail Use% Mounted on
/dev/loop20    xfs  1014M   46M  969M   5% /home/true/.local/share/containers