How to mount volume to be writeable for any user inside container?

[abitrolly]

I am creating rootless container, then creating new user inside and switch to that user. However, new user can not write to the volume anymore.

How should I modify the command I use, so that any user inside container can write to the volume?

podman run -it --rm --security-opt label=disable -v "$PWD:/workdir" -w "/workdir" "$@"

[castedo]

Here is the approach that i take with the create-cnest script described on https://cnest.readthedocs.io.

create-cnest relies on a predictable arbitrary large user ID for the to-be-new user inside the container:
https://github.com/castedo/cnest/blob/6634f2effd10e88d8aa1126b1f5ab09f9cc403cb/bin/create-cnest#L39

Then when the container is created by create-cnest it will pass the --userns=... options:
https://github.com/castedo/cnest/blob/6634f2effd10e88d8aa1126b1f5ab09f9cc403cb/bin/create-cnest#L45
to map the non-root user outside the container to this arbitrary predictable user ID inside the container.

[castedo]

You have not said WHY you are trying to create a new user inside your container, but if your new user inside your container is conceptually you, the non-root regular user, you maybe just want to use --userns=keep-id and not bother with setting an arbitrary large user ID. If there is no collision with UID inside the container, you can just use the same UID for both you inside and outside the container.

I do the arbitrary large predictable UID trick to minimize the risk that my UID outside the container (1000) collides with a preset user inside the container (e.g. user ubuntu inside the standard Ubuntu container image).

[abitrolly]

Sometimes scripts complain that they can not be run under root, and I have to create the user to run them.

I don't think mapping UID to host user is going to work, because it will be only one user inside the container who is be able to write files. I also can not rely that the user that I create will have a certain UID. So a more generic solution is needed. Maybe mounting the volume with some other protocol.