Container volume write permission denied when not root uid inside container

[erharb]

Bug description

Coming from Docker Desktop and Rancher Desktop, I'm used to having scripts run the container as the same uid/gid as the OS user (-u $(id -u):$(id -g)) when there is a need to attach volumes for writing files to persist outside the container runtime, and for those files written out to be owned by the OS user uid/gid.

However, with Podman Desktop and using the default podman machine it creates out of the box, running these same scripts fail with permission denied errors unless I run the container as the root uid/gid.

Operating system

macOS Ventura 13.4.1 (Arm)

Installation Method

Brew (macOS)

Version

1.1.0

Steps to reproduce

Installed Podman Desktop on macOS using brew: brew install --cask podman-desktop

Example fails to create file test as my uid/gid in container:

podman run --rm -it -v $(pwd):/work -w /work -u $(id -u):$(id -g) alpine touch /work/test
touch: /work/test: Permission denied

ls -l test
ls: test: No such file or directory

id -u
501
id -g
20

Example creates file test as root uid/gid in container:

podman run --rm -it -v $(pwd):/work -w /work -u 0:0 alpine touch /work/test

ls -l test
-rw-r--r--@ 1 myuser  mygroup  0 Jun 29 14:45 test

Relevant log output

No response

Additional context

No response

[benoitf]

I'm transferring the issue to podman repository as podman machine, mounts, etc are managed in this repository.

[erharb]

Here's the relevant podman version info too:

podman version
Client:       Podman Engine
Version:      4.5.1
API Version:  4.5.1
Go Version:   go1.20.4
Git Commit:   9eef30051c83f62816a1772a743e5f1271b196d7
Built:        Fri May 26 11:10:12 2023
OS/Arch:      darwin/arm64

Server:       Podman Engine
Version:      4.5.1
API Version:  4.5.1
Go Version:   go1.20.4
Built:        Fri May 26 13:58:19 2023
OS/Arch:      linux/arm64

[rhatdan]

podman run --rm -it -v $(pwd):/work -w /work -u $(id -u):$(id -g) alpine touch /work/test

You are running rootless containers, which will run as root inside of a user namespace. Docker does not do this since it runs as root.

Could you try

podman run --userns=keep-id --rm -it -v $(pwd):/work -w /work -u $(id -u):$(id -g) alpine touch /work/test

[erharb]

Yes that does work thanks for the insight!

podman run --userns=keep-id --rm -it -v $(pwd):/work -w /work -u $(id -u):$(id -g) alpine touch /work/test

ls -l test
-rw-r--r--@ 1 myuser  mygroup  0 Jun 30 10:30 test

However, this means all of our scripts and documentation would need to have a separate condition just for podman to add the additional parameter (or omit the -u param), where otherwise usually podman works identically to the docker way.

Would it be possible to consider some change for rootless podman running in a user namespace be able to properly handle this when the user running in the container as the same uid/gid as the user namespace in which it's running?

[xakraz]

This does not work for me 😞

OS: macOS 14.2.1 23C71 arm64
Host: Mac14,9
Kernel: 23.2.0
CPU: Apple M2 Pro
GPU: Apple M2 Pro