Minikube: rootful podman without sudo (polkit ?)

[awoimbee]

Hello,
Using podman with minikube right now requires allowing passwordless sudo: kubernetes/minikube#18360.

issue: minikube must be ran as the local user but podman must be ran as root.
current solution: passwordless sudo podman, minikube runs sudo podman on behalf of the user.
issue with the current solution: it is as insecure as passwordless docker.

As a polkit newbie I tried adding a file named "podman" to my PATH:

#!/bin/env sh

pkexec podman "$@"

But it causes A LOT of login prompts !

I see a related discussion about podman-remote but I'm not sure it applies to this issue: #12903.

Does anyone have a solution ? Could we reconcile podman and minikube ?

---

EDIT:
I tried this but it still asks me for a password a billion times :(

$ sudo cat /etc/polkit-1/rules.d/80-minikube-polkit.rules                                        
polkit.addRule(function(action, subject) {
	if (
		subject.local
		&& subject.active
		&& action.id === "org.freedesktop.policykit.exec"
	) {
		const program = action.lookup("program");
		polkit.log("action=" + action);
		polkit.log("subject=" + subject);
		polkit.log("program=" + program);
		if (
			program === "/usr/bin/podman"
		) {
			polkit.log('saucisse !');
			return 'auth_admin_keep';
		}
	}
});

// vim: syntax=javascript

[afbjorklund]

Some people are experimenting with rootless podman: https://minikube.sigs.k8s.io/docs/drivers/podman/

Previously there were some issues with running crio-in-podman, not sure if those are better or worse now...

[awoimbee]

My experience is that it doesn't work well, and even if it did it makes some features impossible (eg "privileged" containers).

[afbjorklund]

Running podman with sudo was previously the recommended approach, over adding a "podman" group.

i.e. for docker it is using the "docker" group, rather than sudo docker (as recommended in e.g. RHEL 7)

[afbjorklund]

There was a related question on how to do it in Podman Desktop, that is how to do "sudo" from a GUI web app?

• Implement option to view rootful containers on Linux 🐧 podman-desktop/podman-desktop#2861

[afbjorklund]

The general recommendation is to try to use rootless podman, and for minikube it is to run it in a VM instead.

[awoimbee]

Rootless podman will never support all the features.
VMs are slow/heavy (hence kind doesn't support VMs). It's also way harder to do GPU passthrough (but kinda possible)...
:/

[afbjorklund]

Another option is to use Docker (Engine) instead . It would have the same access problem, but the group is already setup

https://docs.docker.com/engine/install/linux-postinstall/

[afbjorklund]

Also, you still need root ("libvirt" group) for libvirt VM with minikube... (it doesn't support user sessions, only system sessions)

But it (libvirt) might have better integration with PolKit? If going the VM route, there is also a "qemu" driver (with kvm). But off-topic