"/" is not a shared mount

[somehowchris]

I just installed podman on ubuntu 20.04 and ran podman --storage-driver="fuse-overlayfs" info, got the following warning.

WARN[0000] "/" is not a shared mount, this could cause issues or missing mounts with rootless containers

Well using non sudo commands results in podman not being able to resolve pids but using sudo commands it downloads the base image and then let's me know the following.

[1/2] STEP 3/5: RUN apk add --no-cache gcc musl-dev autoconf automake openssl-dev libtool
error running container: error from /usr/bin/crun creating container for [/bin/sh -c apk add --no-cache gcc musl-dev autoconf automake openssl-dev libtool]: set propagation for `/`: Operation not permitted
: exit status 1

I assume they have the same origin since I am new to podman help would be appriciated, what does it mean? is there a known solution?

Some additional ressources:
podman info

host:
  arch: amd64
  buildahVersion: 1.23.1
  cgroupControllers:
  - cpuset
  - cpu
  - cpuacct
  - blkio
  - memory
  - devices
  - freezer
  - net_cls
  - perf_event
  - net_prio
  - hugetlb
  - pids
  - rdma
  cgroupManager: cgroupfs
  cgroupVersion: v1
  conmon:
    package: 'conmon: /usr/libexec/podman/conmon'
    path: /usr/libexec/podman/conmon
    version: 'conmon version 2.0.30, commit: '
  cpus: 16
  distribution:
    codename: focal
    distribution: ubuntu
    version: "20.04"
  eventLogger: file
  hostname: ws-38f93c03-780e-4904-a870-430f53cb69c6
  idMappings:
    gidmap: null
    uidmap: null
  kernel: 5.13.0-1007-gcp
  linkmode: dynamic
  logDriver: k8s-file
  memFree: 1597566976
  memTotal: 67437076480
  ociRuntime:
    name: crun
    package: 'crun: /usr/bin/crun'
    path: /usr/bin/crun
    version: |-
      crun version UNKNOWN
      commit: ea1fe3938eefa14eb707f1d22adff4db670645d6
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL
  os: linux
  remoteSocket:
    path: /run/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: false
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: 'slirp4netns: /usr/bin/slirp4netns'
    version: |-
      slirp4netns version 1.1.8
      commit: unknown
      libslirp: 4.3.1-git
      SLIRP_CONFIG_VERSION_MAX: 3
      libseccomp: 2.4.3
  swapFree: 0
  swapTotal: 0
  uptime: 36h 5m 40.04s (Approximately 1.50 days)
plugins:
  log:
  - k8s-file
  - none
  - journald
  network:
  - bridge
  - macvlan
  volume:
  - local
registries:
  search:
  - docker.io
  - quay.io
store:
  configFile: /etc/containers/storage.conf
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: overlay
  graphOptions:
    overlay.mount_program:
      Executable: /usr/bin/fuse-overlayfs
      Package: 'fuse-overlayfs: /usr/bin/fuse-overlayfs'
      Version: |-
        fusermount3 version: 3.9.0
        fuse-overlayfs: version 1.5
        FUSE library version 3.9.0
        using FUSE kernel interface version 7.31
    overlay.mountopt: nodev,metacopy=on
  graphRoot: /var/lib/containers/storage
  graphStatus:
    Backing Filesystem: <unknown>
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Using metacopy: "false"
  imageStore:
    number: 2
  runRoot: /run/containers/storage
  volumePath: /var/lib/containers/storage/volumes
version:
  APIVersion: 3.4.2
  Built: 0
  BuiltTime: Thu Jan  1 00:00:00 1970
  GitCommit: ""
  GoVersion: go1.16.6
  OsArch: linux/amd64
  Version: 3.4.2

[mheon]

@giuseppe PTAL

[mheon]

I'll also tag @rhatdan

[giuseppe]

this is a check that Podman performs to avoid weird errors like missing mount points when running as rootless.

If / is not shared, then some of the mount points available on the host, won't be usable from the rootless mount namespace.

Can you show the output of findmnt -o TARGET,PROPAGATION -R /?

[somehowchris]

Thanks a lot for the effort.

Here we go..

/workspace/cf-env $ sudo findmnt -o TARGET,PROPAGATION -R /
TARGET                                PROPAGATION
/                                     private
├─/dev                                private
│ ├─/dev/pts                          private
│ ├─/dev/mqueue                       private
│ ├─/dev/termination-log              private
│ └─/dev/shm                          private
├─/sys                                private
│ ├─/sys/fs/cgroup                    private
│ │ ├─/sys/fs/cgroup/systemd          private,slave
│ │ ├─/sys/fs/cgroup/pids             private,slave
│ │ ├─/sys/fs/cgroup/net_cls,net_prio private,slave
│ │ ├─/sys/fs/cgroup/perf_event       private,slave
│ │ ├─/sys/fs/cgroup/rdma             private,slave
│ │ ├─/sys/fs/cgroup/freezer          private,slave
│ │ ├─/sys/fs/cgroup/cpuset           private,slave
│ │ ├─/sys/fs/cgroup/hugetlb          private,slave
│ │ ├─/sys/fs/cgroup/blkio            private,slave
│ │ ├─/sys/fs/cgroup/cpu,cpuacct      private,slave
│ │ ├─/sys/fs/cgroup/devices          private,slave
│ │ └─/sys/fs/cgroup/memory           private,slave
│ └─/sys/firmware                     private
├─/workspace                          private,slave
│ └─/workspace                        private,slave
├─/etc/hosts                          private
├─/etc/hostname                       private
├─/tmp                                private
├─/.supervisor/slirp4netns.sock       private,slave
└─/proc                               private
  ├─/proc/acpi                        private
  ├─/proc/kcore                       private
  ├─/proc/keys                        private
  ├─/proc/timer_list                  private
  ├─/proc/scsi                        private
  ├─/proc/bus                         private
  ├─/proc/fs                          private
  ├─/proc/irq                         private
  ├─/proc/sys                         private

[somehowchris]

If you hate remote debugging like I do, this might help. hit this link which opens up a gitpod instance (free cause open source stuff) to one of my projects which has podman and buildah installed from here

[rhatdan]

It looks like systemd has been making this shared since 2012.

https://cgit.freedesktop.org/systemd/systemd/commit/?id=b3ac5f8cb98757416d8660023d6564a7c411f0a0

So something on your box is changing the default, I would bet.