- Podman - Podman List Archives

podman stop -t -1 container-id issue
by Manvendra Bhangui 25 Feb '24

25 Feb '24

Hi, I have a container where I have my own program as init replacement. It takes the responsibility of shutting down all my services properly (one of them being MySQL). Sometimes some services need more than the default 10 seconds that podman stop command has before it resorts to SIGKILL. So while playing with various timeout, I get a strange result with I use -1 (supposed to be for infinite wait). Giving -1 results in immediate SIGKILL $ podman stop -t -1 indimail-mta WARN[0000] StopSignal SIGTERM failed to stop container indimail-mta in 18446744073709551615 seconds, resorting to SIGKILL indimail-mta Looks like unsigned 64 bit integer has been used for something which can have negative value -- Regards Manvendra - http://www.indimail.org GPG Pub Key http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC7CBC760014D250C

2 4

Podman on OpenWrt: Required dependency package kernel is not available in any repository.
by Nayla Nikolic 24 Feb '24

24 Feb '24

Hi I try to install podman on OpenWrt. Sadly there is no guide in official docs. Please update the docs. # Error Executing package manager Installing podman (4.8.0-1) to root... Downloading https://downloads.openwrt.org/releases/23.05.0/packages/aarch64_generic/pac… Errors Collected errors: * pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.134-1-a61b316e83bc33130e55f5c8b8b65f74) for kmod-veth * pkg_hash_fetch_best_installation_candidate: Packages for kmod-veth found, but incompatible with the architectures configured * satisfy_dependencies_for: Cannot satisfy the following dependencies for podman: * kernel (= 5.15.134-1-a61b316e83bc33130e55f5c8b8b65f74) * opkg_install_cmd: Cannot install package podman. # Infos about my system: Model FriendlyElec NanoPi R4S Architecture ARMv8 Processor rev 4 Target Platform rockchip/armv8 Firmware Version OpenWrt 23.05.0 r23497-6637af95aa / LuCI openwrt-23.05 branch git-23.236.53405-fc638c8 Kernel Version 5.15.134 best regards Nayla

1 0

buildah push xxxxx docker-daemon:image:tag error
by Михаил Иванов 21 Feb '24

21 Feb '24

Hallo, When I try to push an image, created with buildah directly to docker, it aborts with following error: Error: pushing image "5d0da3dc9764" to "docker-daemon:test:2.0.0": writing blob: io: read/write on closed pipe No errors are logged by dockerdaemon. When I check what happens with strace, I see that it aborts on epoll_ctl error: epoll_ctl(4, EPOLL_CTL_ADD, 7, {events=EPOLLIN|EPOLLOUT|EPOLLRDHUP|EPOLLET, data={u32=4150263831, u64=9210128152865538071}}) = -1 EPERM 7 is file descriptor which refers to some file under /var/lib/containers (/var/lib/containers/storage/overlay-images/5d0da3dc976460b72c77d94c8a1ad043720b0416bfc16c52c45d4847e53fadb6/manifest) Is this supposed to work or do I misunderstand sthing? Best regards, -- Michael Ivanov

3 3

GPU devices in rootless
by lejeczek 20 Feb '24

20 Feb '24

Hi guys I have _rootless_ container with PyTorch from ROCm -> $ { export _NAME="pytorch_rocm"; export _PATH=${HOME}/containers/FLATfiles/${_NAME}; echo; mkdir -p ${_PATH}/{,root,dockerx}; }; podman run -dt --device=/dev/kfd --device=/dev/dri --group-add video --shm-size 8G --security-opt seccomp=unconfined --volume ${_PATH}/root:/root:z --volume ${_PATH}/dockerx:/dockerx:z -w /dockerx --name ${_NAME/\//_} rocm/pytorch:latest which fails to: root@4bc3c2ec2ab3:/dockerx# python3 -c 'import torch; print(torch.cuda.is_available())' False Such _rootful_ container seems a okey but rootless "suffers" such failures due to SELinux denials I think: ... SELinux is preventing /opt/conda/envs/py_3.9/bin/python3.9 from 'read, write' accesses on the chr_file kfd. For complete SELinux messages run: sealert -l 6b3db344-2ffc-4ecd-aa2c-2c1a2bfe23e4 SELinux is preventing /opt/conda/envs/py_3.9/bin/python3.9 from 'read, write' accesses on the chr_file kfd. Would you know if this can be fixed, possibly without building extra SE module(s)? many thanks, L.

3 3

ran out of storage - data lingers behind?
by lejeczek 20 Feb '24

20 Feb '24

Hi guys. Deploying a container I ran of local storage space & process failed - I see no new images nor container - yet disk space resulted being more occupied. I see _/var/lib/containers/storage/overlay_ being 21G large with, with my only freeIPA container makes little sense - there I looked first. How to clean such "unfortunate" case? many thanks, L.

3 2

Podman Community Cabal Mtg Tomorrow, Feb 20, 2024, at 11:00 a.m. EST (UTC-5)
by Tom Sweeney 19 Feb '24

19 Feb '24

Hi All, The next Podman Community Cabal meeting is happening tomorrow, Feb 20, 2024, at 11:00am EST (UTC-5). We will be talking about podman compose, image/container volumes, and Podman kube to handle VMs. Agenda with video link: https://hackmd.io/gQCfskDuRLm7iOsWgH2yrg?both Hope to see you there! t

1 0

Podman v4.9.2 Released
by Ashley Cui 02 Feb '24

02 Feb '24

Hi all, Podman 4.9.2 has been released! This release is a security fix and addresses several CVE's including but not limited to: CVE-2024-23651 <https://github.com/advisories/GHSA-m3r6-h7wv-7xxv>, CVE-2024-23652 <https://github.com/advisories/GHSA-4v98-7qmw-rqr8>, and CVE-2024-23653 <https://github.com/advisories/GHSA-wr6v-9f75-vh2g>. Thanks! -- Ashley Cui

1 0

Podman v4.9.1 Released
by Ashley Cui 01 Feb '24

01 Feb '24

We’re excited to announce that Podman v4.9.1 has been released! This release includes several AppleHV bugfixes, and includes an important update to the QEMU version in the Mac pkginstaller. Here's what's new: Bugfixes - Fixed a bug where the --rootful option to podman machine set would not set the machine to use the root connection (#21195 <https://github.com/containers/podman/issues/21195>). - Fixed a bug where podman would crash when running in a containerized environment with euid != 0 and capabilities set (#20766 <https://github.com/containers/podman/issues/20766>). - Fixed a bug where the podman info command would crash on if called multiple times when podman was running as euid=0 without CAP_SYS_ADMIN ( #20908 <https://github.com/containers/podman/issues/20908>). - Fixed a bug where podman machine commands were not relayed to the correct machine on AppleHV (#21115 <https://github.com/containers/podman/issues/21115>). - Fixed a bug where the podman machine list and podman machine inspect commands would not show the correct Last Up time on AppleHV (#21244 <https://github.com/containers/podman/issues/21244>). Misc - Updated the Mac pkginstaller QEMU to v8.2.1 - Updated Buildah to v1.33.4 - Updated the containers/image library to v5.29.2 - Updated the containers/common library to v0.57.3 Try it out and let us know what you think! -- Ashley Cui

2 1

Podman Community Meeting next Tuesday Feb 6, 2024, 11:00 am EST (UTC-4)
by Tom Sweeney 30 Jan '24

30 Jan '24

Hey All, The next Podman Community Meeting is happening in just over one week from now at 11:00am EST (UTC-4) Tue Feb 6, 2024. We'll be talking about Podman at Home, and more! Agenda with video conference url: https://hackmd.io/fc1zraYdS0-klJ2KJcfC7w?both t

1 0

Re: [Vulnerability Report] ctr-cnt: Host containers count info leak
by wanglei (M) 26 Jan '24

26 Jan '24

Dear Akihiro Suda, Mrunal Patel: Thank you for your reply and I respect your opinion. For Docker, Containerd, Podman, and other runtimes, shall we add refcnt to maskedpath when setting spec? From: Mrunal Patel [mailto:mpatel@redhat.com] Send: 2024年1月26日 5:38 To: Akihiro Suda <suda.kyoto(a)gmail.com> CC: wanglei (M) <wanglei249(a)huawei.com>; Security@Docker <security(a)docker.com>; security(a)containerd.io; podman(a)lists.podman.io; cncf-crio-security(a)lists.cncf.io; security(a)opencontainers.org; Heyuandong <heyuandong(a)huawei.com> Subject: Re: [Vulnerability Report] ctr-cnt: Host containers count info leak I agree that this isn't a vulnerability. On Thu, Jan 25, 2024 at 1:29 PM Akihiro Suda <suda.kyoto(a)gmail.com<mailto:suda.kyoto@gmail.com>> wrote: I don't think this is a vuln. Containers have been leaking loadavg, memory usage, disk usage, and other resource counters too. 2024年1月25日(木) 18:09 'wanglei (M)' via OCI Security <security(a)opencontainers.org<mailto:security@opencontainers.org>>: Dear Container Security Teams: I hope this message finds you well. My name is LEI WANG, a container security newb. I am writing to report a security vulnerability about host containers count info leakage. ________________________________ 1. Information Item Details Note Project docker<https://github.com/moby/moby> containerd<https://https/github.com/containerd/containerd> podman<https://github.com/containers/podman> crio runc<https://github.com/opencontainers/runc> Due to the widespread impact, we have also copied runc … If other container software is affected, please forward the email. Affect Version all CVSS 4.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N Author LEI WANG Github-ID: ssst0n3<http://github.com/ssst0n3> 2. Original Features Container runtimes manage the file system using graph drivers such as overlay and devicemapper, which are loaded as modules into the kernel. The container runtime shares the host’s sysfs, where /sys/module/<MODULE_NAME>/refcnt represents the reference count of the corresponding module. The reference count of these modules typically matches the number of mounted file systems on the host, thereby leaking the number of running containers on the host. 3. Vulnerability 3.1 Description Files such as /sys/module/overlay/refcnt reveal the number of containers running on the host because the sysfs of the host is shared when the container is running. 3.2 Impact All versions of the all runtime are affected * docker * containerd * cri-o * podman * … Given the breadth of the impact on the runtime, it may be necessary to copy runc. Disclosure of the number of containers running on a host can provide several potential advantages to an attacker: 1. Target value assessment: If an attacker knows that a system is running a large number of containers, the system may host multiple services or applications, indicating that the target is a high-value target. 2. Resource utilization and load information: The number of containers can give attackers some clues about system resource utilization and load. For example, a host running a large number of containers may have high resource usage, which may allow attackers to use this information to launch denial-of-service (DoS) or distributed denial-of-service (DDoS) attacks. 3. Attack vector identification: Knowing the number of containers may also help attackers infer potential attack vectors. For example, if many containers are running, attackers may assume that some of these containers may not have proper security configuration or timely software updates. 4. Penetration policy planning: Attackers may plan multi-phase attacks or select the most likely unhardened container intrusion based on the number of containers and their speculation about the system architecture. 3.3 CVSS 4.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N<https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/…> vector score reason Attack Vector Local Attack Complexity Low Privileges Required None User Interaction None Scope Changed Confidentiality Low Integrity None Availability None 4. PoC $ docker ps |wc -l 7 $ docker run -ti ubuntu cat /sys/module/overlay/refcnt 7 $ docker run -tid ubuntu bash 78f902370c4bc18b787b95bca5079c052b8b7acd3e43cb7ccff01d8c4c740094 $ docker run -ti ubuntu cat /sys/module/overlay/refcnt 8 5. Fixing Suggestion Add refcnt to maskedpath by referring to the method of setting maskedpath in Docker. https://github.com/moby/moby/blob/25.0/oci/defaults.go#L105-L116 MaskedPaths: []string{ "/proc/asound", "/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/latency_stats", "/proc/timer_list", "/proc/timer_stats", "/proc/sched_debug", "/proc/scsi", "/sys/firmware", "/sys/devices/virtual/powercap", }, 6. Others Should this issue be confirmed as a vulnerability, I kindly request assistance in obtaining a CVE-ID. I would appreciate it if the credit for this discovery could be assigned to my GitHub ID: ssst0n3. If you require any further assistance, please feel free to contact me at your convenience. ________________________________ Thank you for your time and attention to this matter. We look forward to your response and guidance on the next steps. Best regards, LEI WANG -- To unsubscribe from this group and stop receiving emails from it, send an email to security+unsubscribe(a)opencontainers.org<mailto:security+unsubscribe@opencontainers.org>. -- To unsubscribe from this group and stop receiving emails from it, send an email to security+unsubscribe(a)opencontainers.org<mailto:security+unsubscribe@opencontainers.org>.

2 1