Is rootless container nested in rootless container possible?

[jpalus]

Actually not even nested container, but just podman import and podman push inside rootless container. Every podman command invoked inside container results in:

Error: cannot setup namespace using newuidmap: exit status 1

If strace is to be believed that's likely because of:

capset({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, {effective=1<<CAP_SETUID, permitted=1<<CAP_SETUID, inheritable=0}) = -1 EPERM (Operation not permitted)

newuidmap has proper file capabilities.

Tried also with seccomp=unconfined but still same result. Anything I might be missing?

[mheon]

Another Podman in Podman, @rhatdan

…

On Thu, Jun 17, 2021 at 07:36 Jan Palus ***@***.***> wrote: Actually not even nested container, but just podman import and podman push inside rootless container. Every podman command invoked inside container results in: Error: cannot setup namespace using newuidmap: exit status 1 If strace is to be believed that's likely because of: capset({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, {effective=1<<CAP_SETUID, permitted=1<<CAP_SETUID, inheritable=0}) = -1 EPERM (Operation not permitted) newuidmap has proper file capabilities. Tried also with seccomp=unconfined but still same result. Anything I might be missing? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#10705>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AB3AOCHIL3AE7TRXCJJUSR3TTHM3RANCNFSM463PN4GA> .

[rhatdan]

Try using quay.io/podman/stable image.

$ podman run --security-opt label=disable --user podman quay.io/podman/stable podman run ubi8-micro echo hi
Resolved "ubi8-micro" as an alias (/etc/containers/registries.conf.d/000-shortnames.conf)
Trying to pull registry.access.redhat.com/ubi8-micro:latest...
Getting image source signatures
Copying blob sha256:4f4fb700ef54461cfa02571ae0db9a0dc1e0cdb5577484a6d75e68dc38e8acc1
Copying blob sha256:c07a48b26be2472936706395deb5616e1e6b78f54ed6a8e0d19f1533dcbcd12b
Copying config sha256:f390b26f6a00561dbacfc5991a39a6845ff7968f8d18a319b68cc9c0f97dea73
Writing manifest to image destination
Storing signatures
hi

[jpalus]

@rhatdan indeed if initial container is started like this then it works fine. newuidmap is not spawned then. However it does not seem to work if first container is started with full systemd inside. podman import doesn't work neither when invoked over ssh nor when run through podman exec into initial container. Should it work fine when run with systemd as well?

[rhatdan]

Could you give me a reproducer?

[jpalus]

I'm on ARM machine right now hence base image is ARM, but swapping image to your architecture should do:

$ cat Containerfile
FROM docker.io/arm64v8/fedora
RUN yum -y install systemd podman openssh-server passwd
# fix caps
RUN yum -y reinstall shadow-utils
RUN useradd -m test
RUN echo -e 'password\npassword' | passwd test

$ podman build -t fedora-systemd .
...

$ podman run -d --name=systemd-container -p 2222:22 fedora-systemd /sbin/init
...

$ podman exec -u test systemd-container podman info
time="2021-06-19T10:29:37Z" level=warning msg="The cgroupv2 manager is set to systemd but there is no systemd user session available"
time="2021-06-19T10:29:37Z" level=warning msg="For using systemd, you may need to login using an user session"
time="2021-06-19T10:29:37Z" level=warning msg="Alternatively, you can enable lingering with: `loginctl enable-linger 1000` (possibly as root)"
time="2021-06-19T10:29:37Z" level=warning msg="Falling back to --cgroup-manager=cgroupfs"
Error: cannot setup namespace using newuidmap: exit status 1

$ ssh -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null test@localhost podman info
Warning: Permanently added '[localhost]:2222' (ED25519) to the list of known hosts.
test@localhost's password: 
Error: cannot setup namespace using newuidmap: exit status 1

[rhatdan]

We have just published

https://www.redhat.com/sysadmin/podman-inside-container
And
https://www.redhat.com/sysadmin/podman-inside-kubernetes

Please read these and see if they help solve your problem. Reopen if you need more information.