podman in podman and superuser pass through

[udovenkoav1981]

Hello i need to solve three points in same time:

1. run container in podman and pass root from host to make privileged like "mknod, mount loop device, etc..."
2. pass current user from host - to mount volumes and have possibility to create/modify files in container and files on host will be owned by user started container
3. run podman in podman

based on this https://stackoverflow.com/questions/64509618/podman-in-podman-similar-to-docker-in-docker
i start from

podman run -it --rm --privileged  --user podman quay.io/podman/stable:v4.6.2 bash
podman ps

looks ok

after i try to run podman with sudo for root in container will equal root on host
current user have UID:GID = 1004:1004

sudo podman run -it --rm --privileged  --user podman  --uidmap 0:0:1 --gidmap 0:0:1 --uidmap 1000:1004:1 --gidmap 1000:1004:1 quay.io/podman/stable:v4.6.2 bash
podman ps

i got error:

ERRO[0000] running `/usr/bin/newuidmap 26 0 1000 1 1 1 999 1000 1001 64535`: newuidmap: write to uid_map failed: Operation not permitted
Error: cannot set up namespace using "/usr/bin/newuidmap": exit status 1

why ?

and as i understand --uidmap 0:0:1 --gidmap 0:0:1 not works, need to use --uidmap 0:0:2 --gidmap 0:0:2 why ?

[rhatdan]

@giuseppe PTAL

[giuseppe]

it still creates a user namespace, no matter what ID is mapped to. Some actions, like mknod can be used only from the initial user namespace.

[udovenkoav1981]

may be, but in docker run --privileged all works fine, i try to repeat same in podman

[rhatdan]

Docker is probably running as root and podman as rootless? If yes then attempt podman as rootful.

[udovenkoav1981]

i run podman with sudo sudo podman run -it --rm --privileged , but problem a complex

1. superuser mapping inside podman works only if use --uidmap 0:0:2 --gidmap 0:0:2 why need to set amount 2 ? if set 1 i got:

#inside podman
sudo ls
sudo: PERM_SUDOERS: setresuid(-1, 1, -1): Invalid argument
sudo: no valid sudoers sources found, quitting
sudo: error initializing audit plugin sudoers_audit

2. if use

#host
sudo  podman run -it --rm --privileged  --user podman  --uidmap 0:0:2 --gidmap 0:0:2 --uidmap 1000:1004:1 --gidmap 1000:1004:1 quay.io/podman/stable:v4.6.2 bash

if i try to run podman in podman i got error:

#inside podman
[podman@fa2650838407 /]$ podman ps
ERRO[0000] running `/usr/bin/newuidmap 25 0 1000 1 1 1 999 1000 1001 64535`: newuidmap: write to uid_map failed: Operation not permitted
Error: cannot set up namespace using "/usr/bin/newuidmap": exit status 1

but if i try to run podman in podman with sudo - it works

#inside podman
[root@4e104b89dd2d /]# podman ps
CONTAINER ID  IMAGE       COMMAND     CREATED     STATUS      PORTS       NAMES