python3-podman: can't utilize rootless podman

[TomasTomecek]

Is this a BUG REPORT or FEATURE REQUEST?:

[//]: # kind bug

Description

I really like the python interface you have built. Unfortunately it's not possible to be used with rootless podman due to the varlink limitation. Is there a way to solve it? (have two sockets maybe?)

srw-------. 1 root root 0 Nov  1 14:45 io.podman
srw-------. 1 root root 0 Nov  1 14:45 podman/io.podman

$ id
uid=1000(tt) gid=1000(tt)
context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

$ ipython3
Python 3.7.1 (default, Oct 23 2018, 18:19:07)
Type 'copyright', 'credits' or 'license' for more information
IPython 6.4.0 -- An enhanced Interactive Python. Type '?' for help.

In [1]: import podman

In [2]: with podman.Client() as client:
   ...:   list(map(print, client.images.list()))
   ...:
---------------------------------------------------------------------------
PermissionError                           Traceback (most recent call last)
...

/usr/lib/python3.7/site-packages/varlink/client.py in open_unix()
    459                 s = socket.socket(socket.AF_UNIX)
    460                 s.setblocking(True)
--> 461                 s.connect(address)
    462                 return s
    463

PermissionError: [Errno 13] Permission denied

$ podman images
REPOSITORY                                   TAG                       IMAGE ID       CREATED             SIZE
localhost/this-is-my-image                   latest                    d49960b9dbcd   29 minutes ago      83.2MB
<none>                                       <none>                    d3b925049e8d   29 minutes ago      83.2MB
localhost/this-is-my-image-20181701-161756   latest                    2a566e4de41f   29 minutes ago      83.2MB
docker.io/library/python                     3-alpine                  408808fb1a9e   7 days ago          82MB
registry.fedoraproject.org/fedora            29                        a5cc8ccd230a   2 weeks ago         306MB

[mheon]

Can we set up a socket for rootless in the systemd user instance? That would probably do everything we need for rootless.

Would still need to update the bindings to optionally connect to the separate rootless socket.

[TomasTomecek]

Can we set up a socket for rootless in the systemd user instance?

I think that would need to be baked directly in podman, since afaik you can't control user instance from the root environment.

Or maybe just provide docs and mention this in the error message when raising permission denied.

[rhatdan]

I actually think we should raise an issue for this. libpodman could launch a podman version locally when running as non root. and then communicate with the podman listening at a socket in the users homedir.

[owtaylor]

For systems using systemd user sessions (e.g. Fedora for quite some time), the system setup with socket activation could be directly duplicated.

[JayjeetAtGithub]

I am facing the same issue. Can someone please help?

[rhatdan]

We have support for in podman varlink for autostart now, no reason to listen on a socket.

podman remote does this now.

@jwhonce @baude Could you guys get python-podman to do this by default rather then looking for the socket?

[JayjeetAtGithub]

@rhatdan Thanks a lot !

[JayjeetAtGithub]

@rhatdan Can you tell me how to do it now with python podman now? I can also send the fix if you would tell me a bit? Thanks.

[bregman-arie]

I get the same error. Is there a workaround?

[jwhonce]

@bregman-arie I'm working on a bug in the API first. Once that works, I can document this.

[JayjeetAtGithub]

@jwhonce I need to use python-podman for rootless podman very soon. Can you please tell me any workaround to bypass this bug ? Thanks.

[JacobCallahan]

@jwhonce can you link to where you documented this? Thanks

[jonathanunderwood]

This still appears to be broken.