December 2023 - Podman - Podman List Archives

# in environment ?
by lejeczek 09 Aug '25

09 Aug '25

Hi guys. Do you use # in your envs? I wonder if it's just me having issues with those. For a test, to reproduce the issue, 'ghost' web solution would be easy & quick: -> $ podman run -dt ...................... --env database__client=mysql --env database__connection__host=11.1.0.1 --env database__connection__user=ghostadm --env database__connection__password='xyz#admghost' --env database__connection__database=ghost_xyz --env url=https://ghost.xyz So far all I've tried with 'database__connection__password' failed, quoting &| escaping. I often use # - does anybody have a way to make it work? many thanks, L.

3 3

RunRoot & mistaken IDs
by lejeczek 03 Jul '25

03 Jul '25

Hi guys. I experience this: -> $ podman images WARN[0000] RunRoot is pointing to a path (/run/user/1007/containers) which is not writable. Most likely podman will fail. Error: creating events dirs: mkdir /run/user/1007: permission denied -> $ id uid=2001(podmania) gid=2001(podmania) groups=2001(podmania) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 I think it might have something to do with the fact that I changed UID for the user, but why would this be? How troubleshoot & fix it, ideally without system reboot? many thanks, L.

4 11

shouldn't the current directory be the default context for "podman build"?
by Robert P. J. Day 13 Dec '24

13 Dec '24

"man podman-build" suggests that the context argument is optional: SYNOPSIS podman build [options] [context] podman image build [options] [context] ... If no context directory is specified, then Podman will assume the current working directory as the build context, which should contain the Containerfile. but if i have a directory with nothing but a Containerfile, i get: $ podman build Error: no context directory specified, and no containerfile specified $ OTOH, specifying context of current directory: $ podman build . STEP 1: FROM alpine:latest ... etc etc ... thoughts? rday

4 5

podman image for ngninx
by Matthias Apitz 02 Jan '24

02 Jan '24

Hello, I'm trying to build a podman image as described here: https://docs.podman.io/en/latest/Introduction.html with the command: podman build -t nginx https://git.io/Jf8ol on SuSE LINUX SLES 15 SP5. This fails with the attached nohup log. It fails mostly due to this: ... Adding system user `nginx' (UID 101) ... Adding new user `nginx' (UID 101) with group `nginx' ... Not creating home directory `/nonexistent'. + apt-get update Err:1 http://deb.debian.org/debian buster InRelease Connection failed [IP: 146.75.118.132 80] Err:2 http://deb.debian.org/debian-security buster/updates InRelease Connection failed [IP: 146.75.118.132 80] Err:3 http://deb.debian.org/debian buster-updates InRelease Connection failed [IP: 146.75.118.132 80] Reading package lists... W: Failed to fetch http://deb.debian.org/debian/dists/buster/InRelease Connection failed [IP: 146.75.118.132 80] ... What can I do? Thanks matthias -- Matthias Apitz, ✉ guru(a)unixarea.de, http://www.unixarea.de/ +49-176-38902045 Public GnuPG key: http://www.unixarea.de/key.pub

3 5

ro sysfs doesn't affect spc_t?
by Peter Hunt 22 Dec '23

22 Dec '23

Hey team, I've got some odd behavior on a podman in Openshift use case I am trying to figure out. I am trying to run podman in openshift without privilege, extra capabilities and ideally a custom SELinux label that isn't `spc_t`. I have managed to adapt the `container_engine_t` type to get past any denials, but now I'm hitting an issue where the sysfs of the container is read only: I am running with this yaml: ``` apiVersion: v1 kind: Pod metadata: name: no-priv annotations: io.kubernetes.cri-o.Devices: "/dev/fuse" spec: containers: - name: no-priv-rootful image: quay.io/podman/stable args: - sleep - "1000000" securityContext: runAsUser: 1000 seLinuxOptions: type: "container_engine_t" ``` and using a container-selinux based on https://github.com/haircommander/container-selinux/tree/engine_t-improvemen… when I run this container, and then run podman inside, I get this error: ``` $ oc exec -ti pod/no-priv-rootful -- bash [podman@no-priv-rootful /]$ podman run ubi8 ls WARN[0005] Path "/run/secrets/etc-pki-entitlement" from "/etc/containers/mounts.conf" doesn't exist, skipping Error: crun: set propagation for `sys`: Permission denied: OCI permission denied ``` What I find odd, and what is the subject of this email, is that when I adapt the selinux label to be "spc_t": ``` type: "spc_t" ``` the container runs fine. There are no denials in AVC when I run `container_engine_t`, but clearly something is different. Can anyone help me identify what is happening? Thanks Peter -- Peter Hunt, RHCE They/Them or He/Him Senior Software Engineer, Openshift Red Hat <https://www.redhat.com> <https://www.redhat.com>

2 3

lsetxattr with GlusterFS ?
by lejeczek 19 Dec '23

19 Dec '23

Hi guys I'm trying to run a container with some vols on a GlusterFS volume: -> $ { export _NAME="ko.xyz"; export _PATH=/00-APKI//${_NAME}; echo; mkdir -p ${_PATH}/{,root,media,files,apps,themes,images,settings,data,public}; }; podman run -dt --restart=always --volume ${_PATH}/config.production.json:/var/lib/ghost/config.production.json --volume ${_PATH}/root:/root:z Error: lsetxattr /00-APKI/ko.xyz/media: operation not supported .. GF vol is: Volume Name: APKI Type: Replicate Volume ID: b90bc19a-9636-44f7-9b72-453ca9713b6a Status: Started Snapshot Count: 0 Number of Bricks: 1 x (2 + 1) = 3 Transport-type: tcp Bricks: Brick1: 10.1.1.100:/devs/00.GLUSTERs/APKI Brick2: 10.1.1.101:/devs/00.GLUSTERs/APKI Brick3: 10.1.1.99:/devs/00.GLUSTERs/APKI-arbiter (arbiter) Options Reconfigured: performance.client-io-threads: off transport.address-family: inet storage.fips-mode-rchecksum: on cluster.granular-entry-heal: on storage.owner-uid: 2002 storage.owner-gid: 2002 cluster.shd-max-threads: 3 features.cache-invalidation-timeout: 900 performance.cache-invalidation: on performance.nl-cache: on performance.nl-cache-timeout: 600 performance.parallel-readdir: on performance.readdir-ahead: on performance.stat-prefetch: on cluster.self-heal-daemon: enable _autofs_ makes the moutpoing with: /00-APKI -fstype=glusterfs,capability,kernel-writeback-cache=1,acl,log-file=/var/log/glusterfs/mount.APKI.log 10.1.1.100,10.1.1.99,10.1.1.101:/APKI I fiddled with both autofs & gluster but cannot figure it out - would somebody know what's wrong/missing here? I suspect it's due to SE labeling - which would be great to have, naturally. many thanks, L.

2 1

subuids in sync across ?
by lejeczek 16 Dec '23

16 Dec '23

Hi guys. I thought this must be trivial & common yet I failed to find here on the list & the net, any info on: how to keep subuid & subgid in sync across different PCssystems? Would it be simply a matter of keeping all relevant /etc bits in sync - naturally I'm thinking all the bits which are important to _podman_ many thanks, L.

2 1

Podman Community Cabal Meeting Tuesday, Dec 12, 2023, at 11:00 a.m. EST (UTC-5)
by Tom Sweeney 12 Dec '23

12 Dec '23

Hi All, There's a Podman Community Cabal Meeting tomorrow, Tues Dec 12, 2023, at 11:00 am EST (UTC-5). We'll be talking about Confidential Containers and Backporting without a Release branch. Agenda with video link: https://hackmd.io/gQCfskDuRLm7iOsWgH2yrg?both Hope to see you there! t

1 0

New Podman bugfix release: v4.8.2
by Lokesh Mandvekar 11 Dec '23

11 Dec '23

Podman v4.8.2 is now out with a couple of bugfixes to unblock the upcoming Podman-Desktop release, along with a Quadlet fix for Kube image build failures when starting service with missing image. Check out the release page for the list of fixes and release artifacts https://github.com/containers/podman/releases/tag/v4.8.2 Enjoy -- Lokesh Libera, GitLab, GitHub, Fedora: lsm5 Matrix: @lsm5:lsm5.ems.host GPG: 9E33DD8704CC03E2DEB84D9A1C1EDD7CC7C3A0DD https://keybase.io/lsm5

1 0

docker registry token authentication and podman
by Михаил Иванов 07 Dec '23

07 Dec '23

Hallo, not sure if this is the right place for such question, but still. I'm trying to set up a token authentication for docker registry and using podman login to test it. As per description podman should receive '401 Unauthorized' error and headers in the reply should contain 'Www-Authenticate:' entry. As far as I understand, podman should then automatically try to access url, specified in this entry to get the token. But it just terminates with 401 error. I verified registry access with curl and I see, that Www-Authenticate is present. Should podman actually request the token automatically or do I misunderstand this? Best regards, -- Michael Ivanov

3 4