Map rootless containers internal user/group to host machine user/group

[Vombato]

Hi,
I am running an application on a rootless container on a RHEL 8 machine and I mounted some directories in order to save logs and other files in the host machine. The container is run by the user vombato, but I need to access a log file with a different user (used by a Splunk agent to collect the logs, called for example tu-splunk).
Here is the current status:
- Host machine:

-rw-r-----. 1 vombato 100003    0 Oct  20 06:32 file.log

- Container:

-rw-r-----. 1 root adm     0 Oct  20 06:32 file.log

The file is rotated every day and therefore is re-created by the application.
Now my question: what is the best way to access it outside the container with the tu-splunk user without modifying it?
Is there a way to map a group to that GID or something like that?

[rhatdan]

Can you run your tool with podman unshare COMMAND

[Vombato]

From what I understand podman unshare COMMAND should be run by the user accessing the desired file, right? If that's so in my use case no, the log file is accessed by tu-splunk and the container is run by vombato. Sorry if I'm misunderstanding.

[rhatdan]

podman unshare COMMAND will put the COMMAND into the user namespace where it has root privs over the UIDs mapped into the user namespace. Basically allows the COMMAND to read/write/RM all files owned by UIDs mapped into the user namespace.

[Vombato]

Thank you very much, I think that's clear to me now! I should be able to solve my issue with that 😄