How to write network volume driver?

[abitrolly]

I want to fetch volume contents from the network using custom protocol. Where should I start and what do I need to add that ability to podman?

[mheon]

Podman supports the volume plugin protocol described here. Writing a plugin to this specification should do what you want.

[abitrolly]

Not quite what I was looking for.

it must provide the Docker Daemon with writeable paths on the host filesystem. The Docker daemon provides these paths to containers to consume. The Docker daemon makes the volumes available by bind-mounting the provided paths into the containers.

Does that mean there will be the same problems with SELinux as with :z :Z options? Do I need to care about potential inability to read filesystem if unprivileged container runs with its own USER?

[rhatdan]

That would totally be up to the volume driver. If the file system supports XAttrs then :z and :Z would probably work, as well as :U.

[abitrolly]

If I add OS FS layer to the cake, I will have to deal with various SELinux problems, and my users won't be able to write to volumes if their container is unprivileged and uses different USER than their own - #16258

I need another solution that doesn't touch OS FS.