External mount binds?

[francoism90]

I want to keep my docker-compose.yml as follows:

$ cd /path/to/podman-project && cat docker-compose.yml
    volumes:
      - ./src:/src:ro,z
      - ./data:/data:ro,z

In Docker this works for me (incl. SELinux), and the container is able to access /data:

$ sudo mount --bind /mnt/storage/media /path/to/podman-project/data -o x-gvfs-hide
$ docker-compose up

I think this is because Docker runs as root and now I'm Podman in rootless mode. This results in permission denied inside the container (system_u:object_r:unlabeled_t vs system_u:object_r:container_file_t).

Any workarounds? I would prefer not to change the path in the volumes path, as this will be pushed to git.

Thanks!

[rhatdan]

All of the content in /mnt/storage/media would need to be owned/writable by the user_namespace of the user account running the podman.service.

You could remove the :z and just do.
$ sudo mount --bind /mnt/storage/media /path/to/podman-project/data -o x-gvfs-hide
$ sudo chcon -t container_file_t /mnt/storage/media /path/to/podman-project/data
$ docker-compose up

[rhatdan]

Are you getting permission denied when trying to read content?

[francoism90]

@rhatdan No, just an empty folder.

I was trying different things with uid/gid mappings, and it eventually was browsable, but under the user nobody, instead of the own user.

If I map it directly, it works fine, maybe it doesn't translate a bind inside a bind? Weird, as this works fine in Docker and also without the uid/gid mappings.

[rhatdan]

I have no idea why the mount point would be empty unless the source is empty. I don't see how the UID/GID mapping would effect this. If you sudo the the source of the mount point is that empty?

@giuseppe Any ideas?

[francoism90]

@rhatdan The source is not empty, as it does work when not using uid/gid mapping or directly map it as volume instead. Maybe some permission to correctly mount a bind is missing inside the container?

I haven't tested with --userns keep-id:uid=1000,gid=1000, as I'm using podman-compose, resulting it cannot combine with --pod error. I also didn't without rootless yet.

[rhatdan]

Could you get a repeater without using podman-compose? This could very well be a podman-compose error.