How to map specific uid and gid under MacOS?

[sanmai-NL]

I want to map uid 501 with primary gid 20 on MacOS (Podman Desktop) to 10001:10001 inside a container (rootful). It doesn't work, I get permission denied faults.

podman run --mount type=bind,source="$(pwd)",target=/builds:z --uidmap 10001:501:1 --gidmap 10001:20:1 --entrypoint=sh --rm -it myimage

Client:       Podman Engine
Version:      4.8.3
API Version:  4.8.3
Go Version:   go1.21.5
Git Commit:   85dc30df56566a654700722a4dd190e1b9680ee7
Built:        Wed Jan  3 12:18:44 2024
OS/Arch:      darwin/arm64

Server:       Podman Engine
Version:      4.7.2
API Version:  4.7.2
Go Version:   go1.21.1
Built:        Tue Oct 31 15:30:33 2023
OS/Arch:      linux/arm64

[sanmai-NL]

Neither does this work:

podman run --mount type=bind,source="$(pwd)",target=/builds,idmap='uids=501-10001-1;gids=20-10001-1' --security-opt label=disable --entrypoint=sh --rm -i

[sanmai-NL]

containers/crun#873 (comment)

[sanmai-NL]

@giuseppe I want to ask you for advice, I can't get this to work and the documentation makes no sense to me.

[eriksjolund]

It seems to work with rootless podman on macOS 14.3
(The issue #21195 prevented me from easily trying out rootful podman)

I did a test:

1. Check UID on the host

   % id -u
   501
   

2. Check GID on the host

   % id -g
   20
   

3. Create the file test.bash with the file contents

   #!/bin/bash
   
   CONTAINERS_MACHINE_PROVIDER=applehv podman run --rm \
       -v ~/testdir:/testdir \
       --security-opt label=disable \
       --userns keep-id:uid=10001,gid=10001 \
       docker.io/library/alpine "$@"
   

4. Create a directory on the host

   % mkdir ~/testdir
   

5. Check UID of container process

   % bash test.bash id
   uid=10001(10001) gid=10001(10001) groups=10001(10001)
   

6. Create a file in the bind-mounted directory

   % bash test.bash touch /testdir/file1
   

7. Verify that the file exists on the host

   
   % (cd ~/testdir && ls)
   file1
   

side-note: I created the machine with

% CONTAINERS_MACHINE_PROVIDER=applehv podman machine init

and started the machine with

% CONTAINERS_MACHINE_PROVIDER=applehv podman machine start

About the system:

Output podman info:

Click me

host:
  arch: arm64
  buildahVersion: 1.33.2
  cgroupControllers:
  - cpu
  - io
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-2.1.8-2.fc39.aarch64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.8, commit: '
  cpuUtilization:
    idlePercent: 99.92
    systemPercent: 0.05
    userPercent: 0.04
  cpus: 4
  databaseBackend: sqlite
  distribution:
    distribution: fedora
    variant: coreos
    version: "39"
  eventLogger: journald
  freeLocks: 2048
  hostname: localhost.localdomain
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 1000000
    uidmap:
    - container_id: 0
      host_id: 501
      size: 1
    - container_id: 1
      host_id: 100000
      size: 1000000
  kernel: 6.6.9-200.fc39.aarch64
  linkmode: dynamic
  logDriver: journald
  memFree: 1604018176
  memTotal: 1982877696
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: aardvark-dns-1.9.0-1.fc39.aarch64
      path: /usr/libexec/podman/aardvark-dns
      version: aardvark-dns 1.9.0
    package: netavark-1.9.0-1.fc39.aarch64
    path: /usr/libexec/podman/netavark
    version: netavark 1.9.0
  ociRuntime:
    name: crun
    package: crun-1.12-1.fc39.aarch64
    path: /usr/bin/crun
    version: |-
      crun version 1.12
      commit: ce429cb2e277d001c2179df1ac66a470f00802ae
      rundir: /run/user/501/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +WASM:wasmedge +YAJL
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt-0^20231204.gb86afe3-1.fc39.aarch64
    version: |
      pasta 0^20231204.gb86afe3-1.fc39.aarch64-pasta
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /run/user/501/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: true
  serviceIsRemote: true
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.2.2-1.fc39.aarch64
    version: |-
      slirp4netns version 1.2.2
      commit: 0ee2d87523e906518d34a6b423271e4826f71faf
      libslirp: 4.7.0
      SLIRP_CONFIG_VERSION_MAX: 4
      libseccomp: 2.5.3
  swapFree: 0
  swapTotal: 0
  uptime: 0h 33m 49.00s
  variant: v8
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - docker.io
store:
  configFile: /var/home/core/.config/containers/storage.conf
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /var/home/core/.local/share/containers/storage
  graphRootAllocated: 106769133568
  graphRootUsed: 2632105984
  graphStatus:
    Backing Filesystem: xfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Supports shifting: "false"
    Supports volatile: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 1
  runRoot: /run/user/501/containers
  transientStore: false
  volumePath: /var/home/core/.local/share/containers/storage/volumes
version:
  APIVersion: 4.8.3
  Built: 1704291040
  BuiltTime: Wed Jan  3 15:10:40 2024
  GitCommit: ""
  GoVersion: go1.21.5
  Os: linux
  OsArch: linux/arm64
  Version: 4.8.3

Update 1

I did a test

1. Log in to a Fedora 39 computer with SSH

   ssh root@fedora-computer
   

2. Create directory

   mkdir /root/testdir
   

3. Create the file /root/test2.bash with the file contents

   #!/bin/bash
   uid=10001
   gid=10001
   size=64536
   
   podman run \
     --rm \
     --user $uid:$gid \
     --uidmap 0:1:$uid \
     --uidmap $uid:0:1 \
     --uidmap $(($uid+1)):$(($uid+1)):$(($size-$uid)) \
     --gidmap 0:1:$gid \
     --gidmap $gid:0:1 \
     --gidmap $(($gid+1)):$(($gid+1)):$(($size-$gid)) \
     -v /root/testdir:/testdir:Z \
    docker.io/library/alpine "$@"
   

4. Check the UID of the container process

   # bash test2.bash id
   uid=10001(10001) gid=10001(10001) groups=10001(10001)
   

5. Create a file in the bind-mounted directory

   # bash test2.bash touch /testdir/file1
   

6. Check that the file exists on the host

   # ls -l testdir
   total 0
   -rw-r--r--. 1 root root 0 Jan 23 19:34 file1
   

The next thing I would like to test is the following
on a macOS host that is connected to a rootful podman machine

1. Create the file test3.bash with the file contents

   #!/bin/bash
   uid=10001
   gid=10001
   size=64536
   
   podman run \
     --rm \
     --user $uid:$gid \
     --uidmap 0:1:$uid \
     --uidmap $uid:0:1 \
     --uidmap $(($uid+1)):$(($uid+1)):$(($size-$uid)) \
     --gidmap 0:1:$gid \
     --gidmap $gid:0:1 \
     --gidmap $(($gid+1)):$(($gid+1)):$(($size-$gid)) \
     -v ~/testdir:/testdir \
   --security-opt label=disable \
    docker.io/library/alpine "$@"
   

2. Run commands

   mkdir ~/testdir
   bash test3.bash touch /testdir/file1
   

[sanmai-NL]

Is applehv critical?

[eriksjolund]

No, I just used applehv because I have qemu 8.2.0 installed on the computer and I've read there is some problem with qemu 8.2.0.

[eriksjolund]

Maybe auto:uidmapping could be combined with an idmapped mount when using rootful podman together with --user $id:$id?
I did a test on a Fedora computer.

1. Make sure there is a containers entry in /etc/subuid and /etc/subgid

   root@localhost:~# grep containers /etc/subuid
   containers:3886432:655360
   root@localhost:~# grep containers /etc/subgid
   containers:3886432:655360
   

   Reference: https://docs.podman.io/en/latest/markdown/podman-run.1.html
   More specifically

   podman/docs/source/markdown/options/userns.container.md

   Line 33 in 97cd376

   * `rootful mode`: The `--userns=auto` flag requires that the user name __containers__ be specified in the /etc/subuid and /etc/subgid files, with an unused range of subordinate user IDs that Podman containers are allowed to allocate.

2. Create the file test.bash with the contents

   #!/bin/bash
   id=10001
   mapid=100002
   podman run --rm \
      --user $id:$id \
      --userns=auto:uidmapping=$id:$mapid:1,gidmapping=$id:$mapid:1 \
      -v "./dir:/dir:Z,idmap=uids=0-${mapid}-1;gids=0-${mapid}-1"  \
         docker.io/library/alpine "$@"
   

   (mapid is just a UID/GID that is not used for anything else)
3. Create dir

   root@localhost:~# mkdir dir
   

4. Check container process UID/GID

   root@localhost:~# bash test.bash id
   uid=10001(10001) gid=10001(10001) groups=10001(10001)
   

5. Create file in bind-mount

   root@localhost:~# bash test.bash touch /dir/file1
   

6. Check file ownership of file file1 on the host

   root@localhost:~# ls -l dir
   total 0
   -rw-r--r--. 1 root root 0 Jan 24 09:12 file1
   root@localhost:~# 
   

Result: It seems to work.

Maybe that approach would work too on macOS with rootful Podman? (I haven't tested)