How to map uid/gid in rootfull pod?

[ne20002]

I need some help with mapping a host user's uid/gid with one user in a container.

Setup:
I created a rootfull pod including a container running nginx.

podman pod create --name reverse-proxy --hostname reverse-proxy --replace \
    -p 80:8080/tcp \
    -p 443:8443/tcp \
    -p 443:8443/udp

podman run -d --name nginx \
    --pod reverse-proxy \
    --replace \
    --read-only \
    --restart=unless-stopped \
    --tz=local \
    --mount type=bind,src=/mnt/pods/reverse-proxy/etc/nginx/nginx.conf,dst=/etc/nginx/nginx.conf,ro=true \
    --mount type=bind,src=/mnt/pods/reverse-proxy/etc/nginx/conf.d,dst=/etc/nginx/conf.d,ro=true \
    --mount type=bind,src=/mnt/pods/reverse-proxy/etc/nginx/sites-available,dst=/etc/nginx/sites-available,ro=true \
    --mount type=bind,src=/mnt/pods/reverse-proxy/etc/nginx/sites-enabled,dst=/etc/nginx/sites-enabled,ro=true \
    --mount type=bind,src=/mnt/pods/reverse-proxy/var/www,dst=/var/www,ro=true \
    --mount type=bind,src=/etc/ssl/certs/ffdhe4096.pem,dst=/etc/ssl/certs/ffdhe4096.pem,ro=true \
    --mount type=bind,src=/etc/letsencrypt,dst=/etc/letsencrypt,ro=true \
    --mount type=bind,src=/var/log/nginx,dst=/var/log/nginx \
    --tmpfs=/run --tmpfs=/tmp --tmpfs=/var/tmp \
    --tmpfs=/var/cache/nginx \
    --env TZ=Europe/Zurich \
    nginx:latest

I now want to replace the nginx:latest image with nginxinc/nginx-unpriviliged:latest where the Nginx is then not run as root but as limited user in the container. The user nginx in the container has uid:gid 101:101. The user nginx on the host has 114:117.

How can I map the container's user nginx to the uid:gid of the host's user so that the logfiles show up as owned by user nginx on the host?

[eriksjolund]

Does it work if you use these options?

        --uidmap 0:0:65000 \
        --uidmap +101:114:1  \
        --gidmap 0:0:65000  \
        --gidmap +101:117:1  \

I did a test

1. Become root

   sudo -i
   

2. Create group

   groupadd -g 117 testnginx
   

3. Create user

   useradd -g 117  -u 114 testnginx
   

   The command prints the output

   useradd warning: testnginx's uid 114 outside of the UID_MIN 1000 and UID_MAX 60000 range.
   useradd: failed to reset the lastlog entry of UID 114: No such file or directory
   

4. Pull the image

   podman pull docker.io/nginxinc/nginx-unprivileged
   

5. Create a directory that will be used for the volume bind-mount

   mkdir /root/data
   

6. Change ownership

   chown 114:117 /root/data
   

7. Change permissions

   chmod 700 /root/data
   

8. Run the container with --uidmap and --gidmap and create a testfile inside the bind-mount

    podman run \
        --rm  \
        -v /root/data:/data:Z  \
        --uidmap 0:0:65000 \
        --uidmap +101:114:1  \
        --gidmap 0:0:65000 \
        --gidmap +101:117:1  \
        docker.io/nginxinc/nginx-unprivileged /usr/bin/touch /data/testfile
   

9. Check ownership of the file on the host

   $ ls -l /root/data
   

   The command prints the output

   total 0
   -rw-r--r--. 1 testnginx testnginx 0 Apr 19 18:22 testfile
   

10. Check ownership of the file on the host (but show numeric UID and GID)

    $ ls -ln /root/data
    

    The command prints the output

    total 0
    -rw-r--r--. 1 114 117 0 Apr 19 18:22 testfile
    

About the system

Fedora CoreOS 40.20240416.1.1

$ podman --version
podman version 5.0.1

[ne20002]

I tried this by adding

--uidmap 0:0:65000 \
--uidmap +101:114:1  \
--gidmap 0:0:65000  \
--gidmap +101:117:1  \

to the podman pod create and got:
Error: initializing ID mappings: UID setting is malformed expected ["uint32:uint32:uint32"]: ["0:0:65000" "+101:114:1"]

I can't use --uidmap and --gidmap on the container, it then complains that those args can't be used together with --pod argument.

Replaying what you wrote I got until here:

root@dmz0:~# podman run \
     --rm  \
     -v /root/data:/data:Z  \
     --uidmap 0:0:65000 \
     --uidmap +101:114:1  \
     --gidmap 0:0:65000 \
     --gidmap +101:117:1  \
     docker.io/nginxinc/nginx-unprivileged /usr/bin/touch /data/testfile
Error: initializing ID mappings: UID setting is malformed expected ["uint32:uint32:uint32"]: ["0:0:65000" "+101:114:1"]

System:
Debian bookworm
podman version 4.3.1

[eriksjolund]

The new syntax with a + (plus character) got introduced in podman 4.7.0 (git commit
91b8bc7)

It's possible to use the old syntax instead.

Does it work if you use

         --uidmap 0:0:101 \
         --uidmap 101:114:1 \
         --uidmap 114:101:1 \
         --uidmap 102:102:12 \
         --uidmap 115:115:64885 \
         --gidmap 0:0:101 \
         --gidmap 101:117:1 \
         --gidmap 117:101:1 \
         --gidmap 102:102:15 \
         --gidmap 118:118:64882 \

Demo

This demo translates the plus syntax of --uidmap to traditional syntax.

The files /proc/self/uid_map and /proc/self/gid_map show the current mappings.

1. Become root

   sudo -i
   

2. Check the UID mapping

   podman run 
         --rm  \
         -v /root/data:/data:Z  \
         --uidmap 0:0:65000 \
         --uidmap +101:114:1 \
         --gidmap 0:0:65000 \
         --gidmap +101:117:1  \
                   docker.io/nginxinc/nginx-unprivileged cat /proc/self/uid_map
   

   The command prints the output

            0          0        101
          101        114          1
          102        102         12
          115        115      64885
   

3. A small improvement: add --uidmap +114:101:1 so that container UID 114 is still mapped.

   podman run 
         --rm  \
         -v /root/data:/data:Z  \
         --uidmap 0:0:65000 \
         --uidmap +101:114:1 \
         --uidmap +114:101:1 \   
         --gidmap 0:0:65000 \
         --gidmap +101:117:1  \
                   docker.io/nginxinc/nginx-unprivileged cat /proc/self/uid_map
   

   The command prints the output

            0          0        101
          101        114          1
          102        102         12
          114        101          1
          115        115      64885
   

4. Run the command from step 3 but use traditional --uidmap syntax

   Check the UID mapping

   podman run 
         --rm  \
         -v /root/data:/data:Z  \
         --uidmap 0:0:101 \
         --uidmap 101:114:1 \
         --uidmap 114:101:1 \
         --uidmap 102:102:12 \
         --uidmap 115:115:64885 \
         --gidmap 0:0:65000 \
         --gidmap +101:117:1  \
                   docker.io/nginxinc/nginx-unprivileged cat /proc/self/uid_map
   

   The command prints the output

            0          0        101
          101        114          1
          102        102         12
          114        101          1
          115        115      64885
   

   result: the same output is printed as in step with 3

[eriksjolund]

I forgot to mention

podman pod create

also takes --uidmap and --gidmap options:
https://docs.podman.io/en/latest/markdown/podman-pod-create.1.html#uidmap-container-uid-from-uid-amount

One thing that is not possible is to run multiple containers in one pod where the different containers have different UID/GID mappings.