After mount a host directory can't write there. #podman #wordpress #mariadb #podman-unshare #16053
Replies: 9 comments 2 replies
-
|
I dont't know what is the problem or if it is only the first time but after remove the pod and reset the UID/GID of |
Beta Was this translation helpful? Give feedback.
-
|
could you also specify |
Beta Was this translation helpful? Give feedback.
-
|
In the container the UID/GID of |
Beta Was this translation helpful? Give feedback.
-
|
Suddenly while working from the host in the wordpress directory mounted |
Beta Was this translation helpful? Give feedback.
-
|
The user |
Beta Was this translation helpful? Give feedback.
-
|
It is not supposed that with |
Beta Was this translation helpful? Give feedback.
-
|
How can we use the user |
Beta Was this translation helpful? Give feedback.
-
|
I think it's possible to have the containers only store files on the host with ownership of the regular user. If you run the containers without using a pod, it's possible to map UID 999 in the mariadb container and UID 33 in the wordpress container to the same UID on the host. Here I try it out by mapping them to the regular user on the host. Alternative solution: Unix socket#!/bin/bash
set -o errexit
set -o nounset
mkdir -p var-lib-mysql
mkdir -p var-www-html
mkdir -p run-mysqld
subuidSize=$(( $(podman info --format "{{ range .Host.IDMappings.UIDMap }}+{{.Size }}{{end }}" ) - 1 ))
subgidSize=$(( $(podman info --format "{{ range .Host.IDMappings.GIDMap }}+{{.Size }}{{end }}" ) - 1 ))
uid=999
gid=999
podman run --rm \
-d \
--name mariadb \
--replace \
--security-opt label=disable \
-e MARIADB_USER=chris \
-e MARIADB_PASSWORD=maGazine1! \
-e MARIADB_DATABASE=gondolrack \
-e MARIADB_ROOT_PASSWORD=maGazine1! \
--uidmap $uid:0:1 \
--uidmap 0:1:$uid \
--uidmap $(($uid+1)):$(($uid+1)):$(($subuidSize-$uid)) \
--gidmap $gid:0:1 \
--gidmap 0:1:$gid \
--gidmap $(($gid+1)):$(($gid+1)):$(($subgidSize-$gid)) \
--volume ./var-lib-mysql:/var/lib/mysql:Z \
--volume ./run-mysqld:/run/mysqld:z \
docker.io/library/mariadb
uid=33
gid=33
podman run --rm \
--name wordpress \
-p 8080:80 \
-d \
--replace \
-e WORDPRESS_DB_HOST=localhost:/run/mysqld/mysqld.sock \
-e WORDPRESS_DB_USER=chris \
-e WORDPRESS_DB_PASSWORD=maGazine1! \
-e WORDPRESS_DB_NAME=gondolrack \
--uidmap $uid:0:1 \
--uidmap 0:1:$uid \
--uidmap $(($uid+1)):$(($uid+1)):$(($subuidSize-$uid)) \
--gidmap $gid:0:1 \
--gidmap 0:1:$gid \
--gidmap $(($gid+1)):$(($gid+1)):$(($subgidSize-$gid)) \
--volume ./var-www-html:/var/www/html:Z \
--volume ./run-mysqld:/run/mysqld:z \
docker.io/library/wordpressAdding a 5 second sleep so that mariadb has time to start Checking file ownership. No files are owned by subordinate UIDs. I think the --uidmap and --gidmap options could be replaced with The new keep-id options uid and gid is functionality that is yet to be released in a stable Podman version To clean up after this experiment run Alternative solution: TCP--- wordpress_unix_socket.sh 2022-10-09 10:11:15.823126990 +0200
+++ wordpress_network.sh 2022-10-09 10:20:24.529739229 +0200
@@ -4,9 +4,11 @@
set -o errexit
set -o nounset
+# create network if it does not exist
+podman network exists net1 || podman network create net1
+
mkdir -p var-lib-mysql
mkdir -p var-www-html
-mkdir -p run-mysqld
subuidSize=$(( $(podman info --format "{{ range .Host.IDMappings.UIDMap }}+{{.Size }}{{end }}" ) - 1 ))
subgidSize=$(( $(podman info --format "{{ range .Host.IDMappings.GIDMap }}+{{.Size }}{{end }}" ) - 1 ))
@@ -14,10 +16,10 @@
uid=999
gid=999
podman run --rm \
+ --network net1 \
-d \
--name mariadb \
--replace \
-e MARIADB_USER=chris \
-e MARIADB_PASSWORD=maGazine1! \
-e MARIADB_DATABASE=gondolrack \
@@ -29,18 +31,17 @@
--gidmap 0:1:$gid \
--gidmap $(($gid+1)):$(($gid+1)):$(($subgidSize-$gid)) \
--volume ./var-lib-mysql:/var/lib/mysql:Z \
- --volume ./run-mysqld:/run/mysqld:z \
docker.io/library/mariadb
uid=33
gid=33
podman run --rm \
+ --network net1 \
--name wordpress \
-p 8080:80 \
-d \
--replace \
- -e WORDPRESS_DB_HOST=localhost:/run/mysqld/mysqld.sock \
+ -e WORDPRESS_DB_HOST=mariadb \
-e WORDPRESS_DB_USER=chris \
-e WORDPRESS_DB_PASSWORD=maGazine1! \
-e WORDPRESS_DB_NAME=gondolrack \
@@ -51,5 +52,4 @@
--gidmap 0:1:$gid \
--gidmap $(($gid+1)):$(($gid+1)):$(($subgidSize-$gid)) \
--volume ./var-www-html:/var/www/html:Z \
- --volume ./run-mysqld:/run/mysqld:z \
docker.io/library/wordpressTo clean up after this experiment run |
Beta Was this translation helpful? Give feedback.
-
|
@giuseppe I thought we added a flag to set this mapping. IE To map the users UID to the UID of the containers primary UID? |
Beta Was this translation helpful? Give feedback.
-
|
yes, as mentioned in the original post, you can override the UID and the GID used by keep-id with |
Beta Was this translation helpful? Give feedback.
-
|
It is the Containerfile used to build How to use the Containerfile |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
**Is this a BUG REPORT **
/kind bug
Description
After create the pod with a wordrpess and mariadb containers there using the scripts bellow, with configurations that allow me to read/write the wordpress volume mounted there, I can't read write there. I know that the user of the directory
/var/www/htmlinside the wordpress container is www-data 33 and that don't need to usepodman unshareagainst that directory.Steps to reproduce the issue:
podman unsharewith the database volume, this way the container can edit those files inside that directory. The wordpress volume or directory doesn't need it because I have to have control over those files.After run the script, list the directory and realize that the UID/GID was changed from
1000(chris)to100032, I understand that33(www-data)is mapped to100032, It is not supposed that100032is me.Describe the results you received:
The wordpress volume changes the UID/GID to
100032:10032and can't edit the files inside it. I have to change the UID/GID with sudo to my userchris 1000that allow me edit files from host.Describe the results you expected:
That can edit those files inside the
var-www-htmldirectory, but can't and the UID/GID of the directory was change to100032.Additional information you deem important (e.g. issue happens only occasionally):
Output of
podman version:Output of
podman info:Package info (e.g. output of
rpm -q podmanorapt list podmanorbrew info podman):Have you tested with the latest version of Podman and have you checked the Podman Troubleshooting Guide? (https://github.com/containers/podman/blob/main/troubleshooting.md)
No
Additional environment details (AWS, VirtualBox, physical, etc.):
Beta Was this translation helpful? Give feedback.
All reactions