How to mount a NAS shared folder via NFS or similar (the most basic use case) with rootless Podman Quadlets?

[Viable8237]

Hello,

I need to mount a network volume (network share on a Synology NAS) to one of my containers run via a rootless Podman Quadlet. To make things a bit more complicated, I'm also using UserNS=auto so that the id on the host is a subuid instead of the host user's uid. While NFS would be the most understandable for me since I've worked with it before, I am open to other solutions that Synology NASes support. Ideally I would like the network share to be mounted for the specific user only though and not for the whole system (if possible).

I found two possible solutions and neither of them works:

1. podman volume create --opt type=nfs --opt o=async --opt device=mynfsserver:/path/to/share (found here)

but that just gives me a mount.nfs: Operation not permitted error.

2. Creating a user systemd mount unit

I don't really like this solution because it requires a configuration outside of Podman but I tried it anyway and I got a mount.nfs: failed to apply fstab options error.

All the other solutions I found seemed overly complicated or hacky (e.g. turning off certain security features) or they seemed like trying to solve a niche use case while all I need is to simply use a directory located on a network storage as a volume. Literally all I need is to do something like Volume=/path/to/storage:/app/data with the /path/to/storage located on the NAS so it can't be that hard, can it?

Ideally I would prefer to find a "Podman native" solution like the first option I tried so that I can configure everything Podman-related in one place via podman commands and don't have to configure stuff on the side.

Is there any way to do this or am I out of luck?

Thank you and kind regards!

[Luap99]

You cannot mount an nfs filesytem as rootless user, the kernel will simply not allow that privilege wise.

You would have to mount the filesystem on the host as root and then use a normal bind mount and ensure you have it mounted with the right uid for the container, with userns=auto that is likely not possible as you cannot know the uid in advance.

[Viable8237]

Understood, what is better from a security standpoint though, please - removing UserNS=auto and running the container under the host user's uid and mounting the NFS share as root with the right (rootless user's) uid used or mounting the NFS share as root and making the share accessible for every user (which I don't know is even possible with NFS) so that it would work for the subuids as well?