Map multiple users inside container

[ReinV]

Dear community,

My goal is the following:

• I want the host user that starts the container (me, 1007:1008) to be root inside the container
• I want another user (1003:1004) to be user 999:999 inside the container
• Eventually put this in podman-compose structure

Currently testing it out with a single container and not getting it to work. I have a volume mounted with files from 1007 user and 1003 user, where I am comparing the permissions from outside to inside the container.

With userns=keep-id I map myself to 999:999 but in that case I don't have root rights. I want to map another user to 999:999 while being root myself inside container.

I have tried some stuff with --uidmap and --gidmap but I have trouble understanding how to use it correctly.

I tried:

podman run -dt   -v /tmp/storage01:/tmp/storage01:z   --name test  --uidmap 0:1007:1   --uidmap 999:1003:1   --gidmap 0:1008:1 --gidmap 999:1004:1   test

But in that case, all files in the volume are belonging to nouser:nogroup.
Could anybody help me out how to do this? Thanks a lot.

Best,

Reinier

[rhatdan]

Is 999 listed as a UID defined in your /etc/subuid and /etc/subgid file?

[giuseppe]

did you run podman system migrate to recreate the user namespace?

[ReinV]

Yes.

For this example I leave out other users

(base) [reinier@roids ~]$ cat /etc/subuid
***:100000:65536
***:165536:65536
***:231072:65536
joe:296608:65536
***:362144:65536
***:427680:65536
***:493216:65536
reinier:558752:65536
joe:999:1

Migrate system
(base) [reinier@roids ~]$ podman system migrate

To be sure, show ids (also i have sudo rights)

(base) [reinier@roids ~]$ id reinier
uid=1007(reinier) gid=1008(reinier) groups=1008(reinier)
(base) [reinier@roids ~]$ id joe
uid=1003(joe) gid=1004(joe) groups=1004(joe)

Show permissions outside container:

base) [reinier@roids ~]$ ls -l /tmp/storage01/
total 0
-rw-r--r--. 1 joe   joe 0 Jul 17 09:58 testfile001
-rw-r--r--. 1 reinier reinier 0 Jul 15 11:33 testownership

Run container and check permissions:

(base) [reinier@roids ~]$ podman run -dt   -v /tmp/storage01:/tmp/storage01 --name test --uidmap 0:1007 --uidmap 999:1003 --gidmap 0:1008 -
-gidmap 999:1004 test
da78a3b3ff329bbfb3d4861cbf3a993a252da144178092b13878f56dd33907aa
(base) [reinier@roids ~]$ podman exec -it test /bin/bash
root@da78a3b3ff32:/# ls -l /tmp/storage01/
total 0
-rw-r--r--. 1 nobody nogroup 0 Jul 17 09:58 testfile001
-rw-r--r--. 1 nobody nogroup 0 Jul 15 11:33 testownership

Also show that userns works as expected: (user irods inside container is 999:999)

(base) [reinier@roids ~]$ podman run -dt -v /tmp/storage01:/tmp/storage01 --name test --userns=keep-id:uid=999,gid=999 test
cbe7e3e80e33d210578cd91f6a2973a44856b42689c4005f3b8f224626268a79
(base) [reinier@roids ~]$ podman exec -it test /bin/bash
irods@cbe7e3e80e33:/$ ls -l /tmp/storage01/
total 0
-rw-r--r--. 1 nobody nogroup 0 Jul 17 09:58 testfile001
-rw-r--r--. 1 irods  irods   0 Jul 15 11:33 testownership

[eriksjolund]

My goal is the following:

I want the host user that starts the container (me, > 1007:1008) to be root inside the container
I want another user (1003:1004) to be user > 999:999 inside the container
Eventually put this in podman-compose structure

@ReinV I think what you are trying to achieve is not possible with good security practice.

Anyway, this might work:

Replace the line

joe:999:1

with

reiner:1003:1

Of reiner's subuids, the one with the lowest number is 1003. The intermediate UID for host UID 1003 is thus 1.

Instead of
--uidmap 999:1003

probably you need
--uidmap 999:1

Discussion: 1003 is already used as the UID for a regular user on the host (joe). It's not good security practice to configure the system like this. (I'm not entirely sure it will work either).

[ReinV]

It didn't work but thanks for the suggestion. If the goal is not good security practice I probably want to stay away from it. The problem is that the user "irods" inside the container needs to interact with the data (move it from one location to another for example), but in those cases the permissions outside the container change and that's not desirable. I thought that mapping a specific user other than myself (a functional account) would be the solution.

[eriksjolund]

I forgot to mention how to modify the other --uidmap and --gidmap options. But looking for another solution is probably a better choice because adding the UID/GID of another regular user to your account's subuids/subgids is not good security practice, I think. (Please correct me if I'm wrong)

What other alternatives are there?
Some different sketchy ideas:

• Skip the goal to map the other regular user and instead give read/write access to files with setfacl or chmod. Possibly using group ownership for the access.
• Use "sudo podman run ..." (rootful podman) Then you could mount the volume with an idmapped mount (--mount=type=volume,idmap=......)
• Create an idmapped bind-mount of /mnt/storage01 beforehand and then use rootless podman.