add option to bind mount (pod managed) /etc/* files to nonstandard locations

[LStandman]

Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)

/kind feature

Description

There are programs that allow some daemons to run chrooted for some added security within the program. (e.g., Postfix.)
Within a pod /etc/hosts is managed by the pod and automatically bind mounted to guest:/etc/hosts.

Perhaps podman run should expose an option to bind mount that pod-managed hosts file into alternative/additional locations within the guest. E.g., podman run --hostsfile-targets=/var/run/foo bar

Best regards,
LS

[rhatdan]

Not sure what the issue you are attempting to fix. Do you want to have a chroot within a container which would see the hosts file created within the pod?
BTW Not sure how much security a chroot within a container adds. A container is already a super secure chroot.

[LStandman]

Not sure what the issue you are attempting to fix. Do you want to have a chroot within a container which would see the hosts file created within the pod?

Exactly

BTW Not sure how much security a chroot within a container adds. A container is already a super secure chroot.

I believe that a container separates an abstract service (e.g., an SMTP server) from the host that runs the server.
A within-container chroot would create a layer of separation between the processes that comprise that abstract service (assuming you cannot neatly containerize these processes).

[rhatdan]

In this case you would want the hosts file mounted twice. What about the resolv.conf and other files created by Podman to be mounted into the container.

[LStandman]

Then I suppose we should generalize the issue. :)
Maybe the command line option should be used point to all "etc/" directories, and then podman will mount all those specially-treated files more than once. E.g., podman run --etc-targets=/etc,/var/run/foo,/var/run/bar

[rhatdan]

Are you mounting these in the same location under the chroot IE would
--rootfstargets=/, /var/run/foo

And you end up with /var/run/foo/etc/hosts?

[LStandman]

I hope I am understanding you correctly.
Yes, there is always a corresponding etc/ folder under the chroot
Just like in your example.

[rhatdan]

I just don't want to be specific to etc. Not that we currently generate other files, I believe but keep out options open.
I think keeping it
--altrootfs=/var/run/foo and still mounting in / would be a better alternative.

[LStandman]

Indeed, yours is the better alternative. :)

[rhatdan]

@vrothberg @giuseppe Thoughts?

[vrothberg]

I am OK with it.

[rhatdan]

@LStandman interested in opening a PR for this?

[LStandman]

@LStandman interested in opening a PR for this?

Sure why not

[github-actions]

A friendly reminder that this issue had no activity for 30 days.

[rhatdan]

@LStandman did you ever make any progress?

[LStandman]

@LStandman did you ever make any progress?

Hi, yes I'm about done with it.
I expect to PR in a couple of weeks

[github-actions]

A friendly reminder that this issue had no activity for 30 days.