chown errors on container generated content

[steveoh]

When running a jekyll website e.g. https://github.com/agrc/gis.utah.gov, the site will build if there is no content written to the volume from the container. e.g. .jekyll-cache/ and _site/. This will be the case on a fresh checkout or when creating a new blog.

podman run -ti --rm --volume $PWD:/srv/jekyll --env JEKYLL_ROOTLESS=1 --publish 4000:4000 docker.io/jekyll/jekyll:4 jekyll serve --incremental --livereload

If you stop the container and run it again, every file in those two container generated folders reports the following error:

...
chown: .jekyll-cache: Operation not permitted

The permissions look normal to me. Below _site/ was generated by the container and about/ was cloned from github.

ls -al
drwxr-xr-x  380 me  staff    12K Mar 27 14:51 _site/
drwxr-xr-x@  17 me  staff   544B Mar 27 14:36 about/

This happens when using a brand new jekyll blog as well.

podman run -ti --rm -v $PWD:/srv/jekyll -e JEKYLL_ROOTLESS=1 docker.io/jekyll/jekyll:4 jekyll new .

It would be great if the permissions could be corrected or the files ignored. The website takes a minute to generate so having to delete this content every time i want to start the container is a paper cut. This seems to only affect folks running SELinux.

my machine info

 System:
  OS: macOS 13.2.1
  CPU: (16) x64 Intel(R) Core(TM) i9-9880H CPU @ 2.30GHz
  Memory: 16.86 MB / 32.00 GB
  Shell: 5.8.1 - /bin/zsh
Host:
  Arch: amd64
  CurrentMachine: podman-machine-default
  DefaultMachine: podman-machine-default
  EventsDir: /var/folders/zm/r4sqlmf95f1dmvcsd4mjck8c0000gn/T/podman-run--1/podman
  MachineConfigDir: /Users/steveoh/.config/containers/podman/machine/qemu
  MachineImageDir: /Users/steveoh/.local/share/containers/podman/machine/qemu
  MachineState: Running
  NumberOfMachines: 1
  OS: darwin
  VMType: qemu
Version:
  APIVersion: 4.4.2
  Built: 1677167961
  BuiltTime: Thu Feb 23 08:59:21 2023
  GitCommit: 74afe26887f814d1c39925a1624851ef3590e79c
  GoVersion: go1.20.1
  Os: darwin
  OsArch: darwin/amd64
  Version: 4.4.2
[core@localhost ~]$ sestatus
  SELinux status:                 enabled
  SELinuxfs mount:                /sys/fs/selinux
  SELinux root directory:         /etc/selinux
  Loaded policy name:             targeted
  Current mode:                   enforcing
  Mode from config file:          enforcing
  Policy MLS status:              enabled
  Policy deny_unknown status:     allowed
  Memory protection checking:     actual (secure)
  Max kernel policy version:      33

[Luap99]

Assuming you mount a directory from your mac this is not going to work. AFAIK the mac only allows you access to your uid so you cannot chown that to something different.

An easy way to make the user in the container match your user on the host is by using --userns keep-id.

[steveoh]

I'm not explicitly trying to chown anything. Those are errors podman throws when i try to restart the container.
But I will try that flag.

[steveoh]

trying to use that flag produces another error. Do I need to be rootful or rootless when using this flag?

$ podman run -ti --rm --volume $PWD:/srv/jekyll --userns keep-id --env JEKYLL_ROOTLESS=1 --publish 4000:4000 docker.io/jekyll/jekyll:4 jekyll serve --incremental --livereload

Error: statfs /Users/me/dev/gis.utah.gov: no such file or directory

[Luap99]

The option only works rootless. You could also try with --user 0:0 instead of the --userns.

If you use podman machine ssh can you see the files in /Users/me/dev/gis.utah.gov? What permissions does this dir have?

[steveoh]

--user 0:0 gives the same error.

If you use podman machine ssh can you see the files in /Users/me/dev/gis.utah.gov

When ssh'd to the machine the /Users folder was empty.

I restarted podman desktop and ssh'd into the machine again and now the Users folder mount is accurate!

Now the --user 0:0 command works. But running it twice does not.

So something is wrong with podman desktop when it starts up. It isn't mounting the volumes?

What permissions does this dir have?

from my terminal

drwxr-xr-x@ 63 me staff 2.0K Mar 29 10:15 gis.utah.gov/

from within the podman machine

drwxr-xr-x. 63 core games 2016 Mar 29 10:15 gis.utah.gov

Trying --userns keep-id gives a different error

usermod: /etc/passwd.2: Permission denied
usermod: cannot lock /etc/passwd; try again later.

[steveoh]

Any other thoughts?