Failing to launch containers all of a sudden

[poperigby]

I just recently updated my Fedora IoT machine to 40.20240515.0, and Podman containers have stopped working. When I run them, I get this error:

Pods stopped:
Pods removed:
Secrets removed:
Volumes removed:
Error: image for service container: building local pause image: building at STEP "COPY /usr/libexec/podman/catatonit /catatonit": storing "/usr/libexec/podman/catatonit": error during bulk transfer for copier.request{Request:"PUT", Root:"/", preservedRoot:"/home/cassidy/.local/share/containers/storage/overlay/1b80ba4eefabfa46c8b6ec8725723cce7670ae94f12d9855d08c1eef726d460b/merged", rootPrefix:"/home/cassidy/.local/share/containers/storage/overlay/1b80ba4eefabfa46c8b6ec8725723cce7670ae94f12d9855d08c1eef726d460b/merged", Directory:"/", preservedDirectory:"/home/cassidy/.local/share/containers/storage/overlay/1b80ba4eefabfa46c8b6ec8725723cce7670ae94f12d9855d08c1eef726d460b/merged", Globs:[]string{}, preservedGlobs:[]string{}, StatOptions:copier.StatOptions{CheckForArchives:false, Excludes:[]string(nil)}, GetOptions:copier.GetOptions{UIDMap:[]idtools.IDMap(nil), GIDMap:[]idtools.IDMap(nil), Excludes:[]string(nil), ExpandArchives:false, ChownDirs:(*idtools.IDPair)(nil), ChmodDirs:(*fs.FileMode)(nil), ChownFiles:(*idtools.IDPair)(nil), ChmodFiles:(*fs.FileMode)(nil), StripSetuidBit:false, StripSetgidBit:false, StripStickyBit:false, StripXattrs:false, KeepDirectoryNames:false, Rename:map[string]string(nil), NoDerefSymlinks:false, IgnoreUnreadable:false, NoCrossDevice:false}, PutOptions:copier.PutOptions{UIDMap:[]idtools.IDMap{}, GIDMap:[]idtools.IDMap{}, DefaultDirOwner:(*idtools.IDPair)(0xc000015c50), DefaultDirMode:(*fs.FileMode)(nil), ChownDirs:(*idtools.IDPair)(nil), ChmodDirs:(*fs.FileMode)(nil), ChownFiles:(*idtools.IDPair)(nil), ChmodFiles:(*fs.FileMode)(nil), StripSetuidBit:false, StripSetgidBit:false, StripStickyBit:false, StripXattrs:false, IgnoreXattrErrors:false, IgnoreDevices:true, NoOverwriteDirNonDir:false, NoOverwriteNonDirDir:false, Rename:map[string]string(nil)}, MkdirOptions:copier.MkdirOptions{UIDMap:[]idtools.IDMap(nil), GIDMap:[]idtools.IDMap(nil), ChownNew:(*idtools.IDPair)(nil), ChmodNew:(*fs.FileMode)(nil)}, RemoveOptions:copier.RemoveOptions{All:false}}: copier: put: error setting extended attributes on "/catatonit": setting value of extended attribute "security.ima" on "/catatonit": operation not permitted

This is the command I'm using:

/usr/bin/podman kube play --replace --service-container=true --network=systemd-reverse-proxy /var/home/cassidy/.config/containers/systemd/services/caddy/service.yaml

This is my service.yaml:

---
apiVersion: v1
kind: Pod
metadata:
  labels:
    app: caddy-pod
    io.containers.autoupdate: registry
    io.containers.sdnotify: conmon
  name: caddy-pod
spec:
  securityContext:
    seLinuxOptions:
      type: spc_t
  containers:
    - name: caddy
      image: ghcr.io/poperigby/caddy:latest
      env:
        - name: SMTP_PASSWORD
          value: |-
            REDACTED
        - name: PERSONAL_EMAIL
          value: REDACTED
        - name: CLOUDFLARE_API_TOKEN
          value: REDACTED
        - name: CROWDSEC_BOUNCER_API_KEY
          value: REDACTED
      ports:
        - containerPort: 80
          hostPort: 80
        - containerPort: 443
          hostPort: 443
      volumeMounts:
        - name: caddyfile-mount
          mountPath: /etc/caddy/Caddyfile
        - name: caddy-data
          mountPath: /data
        - name: caddy-config
          mountPath: /config
        - name: caddy-log
          mountPath: /var/log/caddy
    - name: crowdsec
      image: ghcr.io/crowdsecurity/crowdsec:v1.6.0
      env:
        - name: COLLECTIONS
          value: crowdsecurity/caddy
      volumeMounts:
        - name: crowdsec-data
          mountPath: /var/lib/crowdsec/data
        - name: crowdsec-config
          mountPath: /etc/crowdsec
        - name: crowdsec-acquis
          mountPath: /etc/crowdsec/acquis.d
        - name: caddy-log
          mountPath: /var/log/caddy
          readOnly: true
  volumes:
    # Caddy
    - name: caddyfile-mount
      hostPath:
        path: /home/cassidy/.config/containers/systemd/services/caddy/Caddyfile
        type: File
    - name: caddy-data
      persistentVolumeClaim:
        claimName: caddy-data
    - name: caddy-config
      persistentVolumeClaim:
        claimName: caddy-config
    - name: caddy-config
      persistentVolumeClaim:
        claimName: caddy-config
    - name: caddy-log
      persistentVolumeClaim:
        claimName: caddy-log
    # CrowdSec
    - name: crowdsec-data
      persistentVolumeClaim:
        claimName: crowdsec-data
    - name: crowdsec-config
      persistentVolumeClaim:
        claimName: crowdsec-config
    - name: crowdsec-acquis
      hostPath:
        path:
          /home/cassidy/.config/containers/systemd/services/caddy/crowdsec-acquis
        type: Directory

Podman version: 5.0.2

[Luap99]

see #22762