Podman Mounts Symlinks as Root

[fogti]

Maintainers Note: The originally title and post contents are below. This has been modified since the current issue is related, but different, as described here.

When using Podman, if we have a symlink to our bind mount, we a permissions error, saying it cannot access the data within the volume. This only happens with paths we do not canonicalize. Here, we create an example with symlinks for our CARGO_HOME and XARGO_HOME. This probably also occurs for other bind mounts.

$ mkdir registry
$ export CARGO_HOME=$(realpath registry)/.cargo
$ export XARGO_HOME=$(realpath registry)/.xargo
$ ln -s ~/.cargo "${CARGO_HOME}"
$ ln -s ~/.xargo "${XARGO_HOME}"
$ git clone https://github.com/cross-rs/rust-cpp-hello-word
$ cd rust-cpp-hello-word
$ cargo build                                           # works
$  cross build --target aarch64-unknown-linux-gnu       # also just works

If we run in Podman, these directories are owned by root, not by the current user.

$ ls -la / | grep argo
drwxrwxr-x.   1 root   root     164 Jul  3 22:57 cargo
drwxrwxr-x.   1 root   root       6 Jun  2 03:36 xargo

Meanwhile, in Docker, they're mounted as the current user, and cross works fine:

ls -la / | grep argo
drwxrwxr-x.   1 1000 1000  164 Jul  3 22:57 cargo
drwxrwxr-x.   1 1000 1000    6 Jun  2 03:36 xargo

---

cross fails with "failed to create directory - file exists"

Steps to reproduce:

mkdir -p /tmp/.cargo
rm -rf ~/.cargo
ln -sT /tmp/.cargo ~/.cargo
git clone https://github.com/zserik/crulz-rs.git
cd crulz-rs
git checkout 754196bbbc4d99ed6634e83b8e3d2b7571ce7209
cross check --target armv7-unknown-linux-musleabihf

(working directory (should be rather irrelevant) is equivalent to: https://github.com/zserik/crulz-rs/tree/754196bbbc4d99ed6634e83b8e3d2b7571ce7209)

It happens when either $CARGO_HOME, $CARGO_HOME/registry, $CARGO_HOME/registry/cache or $CARGO_HOME/registry/index (or multiple of them) are symlinks.

I tried to run (with the same target):

• cross check
• cross clippy
• cross build
• cross build --release

I got the following error:

error: failed to create directory `/cargo/registry/cache/github.com-1ecc6299db9ec823`
error: failed to create directory `/cargo/registry/index/github.com-1ecc6299db9ec823`

Caused by:
  File exists (os error 17)

[fogti]

e.g. there should be an option to specify additional path mappings/mounts for docker.

[Alexhuszagh]

You can now use [build.env] or [target.(...).env] to specify additional bind mounts for the Docker container, as documented here. You can also use DOCKER_OPTS if absolutely needed to provide raw arguments to Docker, in case the configurations above (which uses the --volume keyword) isn't above. I'll see if I can find a workaround for mounting a cargo install that is a symlink. We might be able to canonicalize it prior to mounting to avoid these issues as well.

[Alexhuszagh]

This doesn't reproduce anymore, but there are other issues: if there isn't various different binaries available, then it will fail. A simple example that works is:

$ mkdir registry
$ export CARGO_HOME=$(realpath registry)/.cargo
$ export XARGO_HOME=$(realpath registry)/.xargo
$ ln -s ~/.cargo "${CARGO_HOME}"
$ ln -s ~/.xargo "${XARGO_HOME}"
$ git clone https://github.com/cross-rs/rust-cpp-hello-word
$ cd rust-cpp-hello-word
$ cargo build                                           # works
$  cross build --target aarch64-unknown-linux-gnu       # also just works

There is, however, an unrelated issue with podman, which has permissions errors. Entering the container using the build command, we can see that they're mounted with root permissions.

$ ls -la / | grep argo
drwxrwxr-x.   1 root   root     164 Jul  3 22:57 cargo
drwxrwxr-x.   1 root   root       6 Jun  2 03:36 xargo

Meanwhile, in Docker, they're mounted as the current user:

ls -la / | grep argo
drwxrwxr-x.   1 1000 1000  164 Jul  3 22:57 cargo
drwxrwxr-x.   1 1000 1000    6 Jun  2 03:36 xargo