Skip to content

Commit 9788289

Browse files
Merge pull request #10194 from rhatdan/docs
[CI:DOCS] Fix troubleshooting documentation on handling supplemental groups.
2 parents af8943a + 65b62cc commit 9788289

File tree

1 file changed

+6
-6
lines changed

1 file changed

+6
-6
lines changed

troubleshooting.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -495,10 +495,10 @@ $ podman unshare cat /proc/self/uid_map
495495

496496
Reference [subuid](http://man7.org/linux/man-pages/man5/subuid.5.html) and [subgid](http://man7.org/linux/man-pages/man5/subgid.5.html) man pages for more detail.
497497

498-
### 20) Passed-in device can't be accessed in rootless container
498+
### 20) Passed-in devices or files can't be accessed in rootless container
499499

500-
As a non-root user you have group access rights to a device that you want to
501-
pass into a rootless container with `--device=...`.
500+
As a non-root user you have group access rights to a device or files that you
501+
want to pass into a rootless container with `--device=...` or `--volume=...`
502502

503503
#### Symptom
504504

@@ -507,9 +507,9 @@ Any access inside the container is rejected with "Permission denied".
507507
#### Solution
508508

509509
The runtime uses `setgroups(2)` hence the process looses all additional groups
510-
the non-root user has. If you use the `crun` runtime, 0.10.4 or newer,
511-
then you can enable a workaround by adding `--annotation io.crun.keep_original_groups=1`
512-
to the `podman` command line.
510+
the non-root user has. Use the `--group-add keep-groups` flag to pass the
511+
user's supplementary group access into the container. Currently only available
512+
with the `crun` OCI runtime.
513513

514514
### 21) A rootless container running in detached mode is closed at logout
515515

0 commit comments

Comments
 (0)