Grant user permissions in rootless container

[dmenneck]

I try to run Rootless Podman as non-root user and get permission denied errors when starting a postgres container. The following commands and files are used:

podman build -t postgres -f containerfiles/Containerfile.postgres

./containerfiles/Containerfile.postgres

FROM docker.io/library/postgres:15.3

ENV POSTGRES_USER postgres
ENV POSTGRES_PASSWORD postgres
ENV POSTGRES_DB mapsolution_xq

COPY init.sql /docker-entrypoint-initdb.d/init.sql

EXPOSE 5432

When starting the container, I made sure to pass the -u flag to run the container as non-root:

podman run -u sync -d --name postgres postgres

The output of podman logs postgres is:

podman logs postgres
WARN[0000] Error validating CNI config file /home/ipuser/.config/cni/net.d/ipsysconnetwork.conflist: [plugin bridge does not support config version "1.0.0" plugin portmap does not support config version "1.0.0" plugin firewall does not support config version "1.0.0" plugin tuning does not support config version "1.0.0"]
chmod: changing permissions of '/var/lib/postgresql/data': Operation not permitted
chmod: changing permissions of '/var/run/postgresql': Operation not permitted
The files belonging to this database system will be owned by user "sync".
This user must also own the server process.

The database cluster will be initialized with locale "en_US.utf8".
The default database encoding has accordingly been set to "UTF8".
The default text search configuration will be set to "english".

Data page checksums are disabled.

fixing permissions on existing directory /var/lib/postgresql/data ... initdb: error: could not change permissions of directory "/var/lib/postgresql/data": Operation not permitted

I'm running podman on WSL. Is there anything i can change to fix the permission errors?

[rhatdan]

@n1hility PTAL

[eriksjolund]

I tried it out on macOS. There it works. I had to remove :Z.

$ podman machine start mymachine
$ podman system connection list | grep mymachine
mymachine                    ssh://core@127.0.0.1:60852/run/user/501/podman/podman.sock  /Users/myuser/.ssh/mymachine               false
mymachine-root               ssh://root@127.0.0.1:60852/run/podman/podman.sock           /Users/myuser/.ssh/mymachine               false
$

Note that I add -c mymachine to the podman commands below:

$ cd $HOME
$ mkdir data2
$ chmod 0700 data2
$ podman -c mymachine run --name test --rm -d -e POSTGRES_PASSWORD=insecurepassword -v ./data2:/var/lib/postgresql/data --userns=keep-id:uid=999,gid=999 docker.io/library/postgres  
5c5ec5a85e1b1e714309fb70cf936488f6bd657123ffa4193e448f7805a2e0d5
$ podman -c mymachine logs test 2>&1 | tail -1
2023-11-16 11:27:04.876 UTC [1] LOG:  database system is ready to accept connections
$

postgres has created files and directories in the bind-mounted directory:

$ ls -l data2 | head -4
total 120
-rw-------   1 myuser mygroup     3 Nov 16 12:26 PG_VERSION
drwx------   5 myuser mygroup   160 Nov 16 12:27 base
drwx------  65 myuser mygroup   2080 Nov 16 12:29 global

[dmenneck]

Is it possible that it does not work under Windows and in the WSL?

[eriksjolund]

I have never tried WSL so I don't know. Maybe someone else knows?

Is there any directory that can be accessed from both the host and from the VM?
If there is, create the data2 directory there.

[eriksjolund]

I realised that by adding --user 0:0 to the podman run command:

mkdir data2
chmod 0700 data2
podman run --user 0:0 --name test --rm -d -e POSTGRES_PASSWORD=insecurepassword -v ./data2:/var/lib/postgresql/data:Z --userns=keep-id:uid=999,gid=999 docker.io/library/postgres

the commands work on both rootless and rootful system connections.

[godefroi]

@eriksjolund It does not work for me on Windows+WSL:

podman run --user 0:0 --userns=keep-id:uid=999,gid=999 --interactive --rm -e "POSTGRES_PASSWORD=password" -v ./_postgres_data/:/var/lib/postgresql/data docker.io/library/postgres:17.6

Results in this:

The files belonging to this database system will be owned by user "postgres".
This user must also own the server process.

The database cluster will be initialized with locale "en_US.utf8".
The default database encoding has accordingly been set to "UTF8".
The default text search configuration will be set to "english".

Data page checksums are disabled.

fixing permissions on existing directory /var/lib/postgresql/data ... ok
creating subdirectories ... ok
selecting dynamic shared memory implementation ... posix
selecting default "max_connections" ... 25
selecting default "shared_buffers" ... 400kB
selecting default time zone ... Etc/UTC
creating configuration files ... ok
running bootstrap script ... 2026-02-05 20:28:19.068 UTC [77] FATAL:  data directory "/var/lib/postgresql/data" has invalid permissions
2026-02-05 20:28:19.068 UTC [77] DETAIL:  Permissions should be u=rwx (0700) or u=rwx,g=rx (0750).
child process exited with exit code 1
initdb: removing contents of data directory "/var/lib/postgresql/data"

Copilot suggests that uid, gid, and mode can be specified for the bind mount, but Podman complains if I attempt that. Copilot also suggests that enabling "wsl metadata" will solve the problem, but I have not (yet) tried that.

[dmenneck]

@dmenneck is this on the wsl default ubuntu distro? Are you in the current working directory on a windows drive? (e.g. when you type wsl it puts you in the CWD of your windows prompt by default). If on the WSL prompt you run cd to move into your linux home directory on WSL (on ext4), and then you run the podman command does it work?

Yes! It works.
However, the volume folder is not reflected outside wsl.

[n1hility]

@dmenneck so provided the files are accessible to the wsl host user, for example using --userns=keep-id --user=1000, then you could access them from windows using \\wsl$. For example: \wsl$\podman-machine-default\home\user\postgres-data . Although what use-case are you thinking of with that? Backups? The reason I ask is that Postgres expects exclusive access to these.

[dmenneck]

We'd like to store all the data outside the container.