- Podman - Podman List Archives

podman image for ngninx
by Matthias Apitz 02 Jan '24

02 Jan '24

Hello, I'm trying to build a podman image as described here: https://docs.podman.io/en/latest/Introduction.html with the command: podman build -t nginx https://git.io/Jf8ol on SuSE LINUX SLES 15 SP5. This fails with the attached nohup log. It fails mostly due to this: ... Adding system user `nginx' (UID 101) ... Adding new user `nginx' (UID 101) with group `nginx' ... Not creating home directory `/nonexistent'. + apt-get update Err:1 http://deb.debian.org/debian buster InRelease Connection failed [IP: 146.75.118.132 80] Err:2 http://deb.debian.org/debian-security buster/updates InRelease Connection failed [IP: 146.75.118.132 80] Err:3 http://deb.debian.org/debian buster-updates InRelease Connection failed [IP: 146.75.118.132 80] Reading package lists... W: Failed to fetch http://deb.debian.org/debian/dists/buster/InRelease Connection failed [IP: 146.75.118.132 80] ... What can I do? Thanks matthias -- Matthias Apitz, ✉ guru(a)unixarea.de, http://www.unixarea.de/ +49-176-38902045 Public GnuPG key: http://www.unixarea.de/key.pub

3 5

ro sysfs doesn't affect spc_t?
by Peter Hunt 21 Dec '23

21 Dec '23

Hey team, I've got some odd behavior on a podman in Openshift use case I am trying to figure out. I am trying to run podman in openshift without privilege, extra capabilities and ideally a custom SELinux label that isn't `spc_t`. I have managed to adapt the `container_engine_t` type to get past any denials, but now I'm hitting an issue where the sysfs of the container is read only: I am running with this yaml: ``` apiVersion: v1 kind: Pod metadata: name: no-priv annotations: io.kubernetes.cri-o.Devices: "/dev/fuse" spec: containers: - name: no-priv-rootful image: quay.io/podman/stable args: - sleep - "1000000" securityContext: runAsUser: 1000 seLinuxOptions: type: "container_engine_t" ``` and using a container-selinux based on https://github.com/haircommander/container-selinux/tree/engine_t-improvemen… when I run this container, and then run podman inside, I get this error: ``` $ oc exec -ti pod/no-priv-rootful -- bash [podman@no-priv-rootful /]$ podman run ubi8 ls WARN[0005] Path "/run/secrets/etc-pki-entitlement" from "/etc/containers/mounts.conf" doesn't exist, skipping Error: crun: set propagation for `sys`: Permission denied: OCI permission denied ``` What I find odd, and what is the subject of this email, is that when I adapt the selinux label to be "spc_t": ``` type: "spc_t" ``` the container runs fine. There are no denials in AVC when I run `container_engine_t`, but clearly something is different. Can anyone help me identify what is happening? Thanks Peter -- Peter Hunt, RHCE They/Them or He/Him Senior Software Engineer, Openshift Red Hat <https://www.redhat.com> <https://www.redhat.com>

2 3

lsetxattr with GlusterFS ?
by lejeczek 18 Dec '23

18 Dec '23

Hi guys I'm trying to run a container with some vols on a GlusterFS volume: -> $ { export _NAME="ko.xyz"; export _PATH=/00-APKI//${_NAME}; echo; mkdir -p ${_PATH}/{,root,media,files,apps,themes,images,settings,data,public}; }; podman run -dt --restart=always --volume ${_PATH}/config.production.json:/var/lib/ghost/config.production.json --volume ${_PATH}/root:/root:z Error: lsetxattr /00-APKI/ko.xyz/media: operation not supported .. GF vol is: Volume Name: APKI Type: Replicate Volume ID: b90bc19a-9636-44f7-9b72-453ca9713b6a Status: Started Snapshot Count: 0 Number of Bricks: 1 x (2 + 1) = 3 Transport-type: tcp Bricks: Brick1: 10.1.1.100:/devs/00.GLUSTERs/APKI Brick2: 10.1.1.101:/devs/00.GLUSTERs/APKI Brick3: 10.1.1.99:/devs/00.GLUSTERs/APKI-arbiter (arbiter) Options Reconfigured: performance.client-io-threads: off transport.address-family: inet storage.fips-mode-rchecksum: on cluster.granular-entry-heal: on storage.owner-uid: 2002 storage.owner-gid: 2002 cluster.shd-max-threads: 3 features.cache-invalidation-timeout: 900 performance.cache-invalidation: on performance.nl-cache: on performance.nl-cache-timeout: 600 performance.parallel-readdir: on performance.readdir-ahead: on performance.stat-prefetch: on cluster.self-heal-daemon: enable _autofs_ makes the moutpoing with: /00-APKI -fstype=glusterfs,capability,kernel-writeback-cache=1,acl,log-file=/var/log/glusterfs/mount.APKI.log 10.1.1.100,10.1.1.99,10.1.1.101:/APKI I fiddled with both autofs & gluster but cannot figure it out - would somebody know what's wrong/missing here? I suspect it's due to SE labeling - which would be great to have, naturally. many thanks, L.

2 1

subuids in sync across ?
by lejeczek 15 Dec '23

15 Dec '23

Hi guys. I thought this must be trivial & common yet I failed to find here on the list & the net, any info on: how to keep subuid & subgid in sync across different PCssystems? Would it be simply a matter of keeping all relevant /etc bits in sync - naturally I'm thinking all the bits which are important to _podman_ many thanks, L.

2 1

Podman Community Cabal Meeting Tuesday, Dec 12, 2023, at 11:00 a.m. EST (UTC-5)
by Tom Sweeney 11 Dec '23

11 Dec '23

Hi All, There's a Podman Community Cabal Meeting tomorrow, Tues Dec 12, 2023, at 11:00 am EST (UTC-5). We'll be talking about Confidential Containers and Backporting without a Release branch. Agenda with video link: https://hackmd.io/gQCfskDuRLm7iOsWgH2yrg?both Hope to see you there! t

1 0

New Podman bugfix release: v4.8.2
by Lokesh Mandvekar 11 Dec '23

11 Dec '23

Podman v4.8.2 is now out with a couple of bugfixes to unblock the upcoming Podman-Desktop release, along with a Quadlet fix for Kube image build failures when starting service with missing image. Check out the release page for the list of fixes and release artifacts https://github.com/containers/podman/releases/tag/v4.8.2 Enjoy -- Lokesh Libera, GitLab, GitHub, Fedora: lsm5 Matrix: @lsm5:lsm5.ems.host GPG: 9E33DD8704CC03E2DEB84D9A1C1EDD7CC7C3A0DD https://keybase.io/lsm5

1 0

docker registry token authentication and podman
by Михаил Иванов 06 Dec '23

06 Dec '23

Hallo, not sure if this is the right place for such question, but still. I'm trying to set up a token authentication for docker registry and using podman login to test it. As per description podman should receive '401 Unauthorized' error and headers in the reply should contain 'Www-Authenticate:' entry. As far as I understand, podman should then automatically try to access url, specified in this entry to get the token. But it just terminates with 401 error. I verified registry access with curl and I see, that Www-Authenticate is present. Should podman actually request the token automatically or do I misunderstand this? Best regards, -- Michael Ivanov

3 4

Podman 4.7.2 can't run imported containers by a service user. Is it a bug?
by Hans F 06 Dec '23

06 Dec '23

Hi folks, My storage config looks like: # /etc/containers/storage.conf [storage] driver = "overlay" graphroot = "/custom/path/root/data" rootless_storage_path = "/custom/path/$USER/data" runroot = "/run/containers/storage And I have "service" users (that are not to supposed to be used as normal users) with such config: # /etc/passwd foobar:x:5000:100::/var/empty:/usr/sbin/nologin I can run a container like this: su foobar podman run -d docker.io/library/debian:bookworm sleep infinity but I can't import a container and run it: podman load < /tmp/image.tar.gz podman image ls podman run -d 9ff9136eaaab sleep infinity Error: mkdir /var/empty/.cache: operation not permitted Testing this as a "normal" user (user with writable home directory) I noticed that Podman creates the following file: ls -lA .cache/containers/short-name-aliases.conf.lock -rw-r--r-- 1 me users 0 Dec 3 16:45 .cache/containers/short-name-aliases.conf.lock Obviously that can't work with a "service" user since it doesn't have writable home. Could you please advise is this a bug? Should I create an issue on github? Thank you. Hans

2 2

How to build image for own jar file
by Thomas 05 Dec '23

05 Dec '23

Hello, I have successfully build docker image "sapmachine", a build of OpenJDK. Now I want to build my own image to run my own jar file. This jar file is located in ~/.mpw-gui/masterpassword-gui.jar, and with locally installed OpenJDK I would run this command: java -jar .mpw-gui/masterpassword-gui.jar Could you please advise how to build my own image for this java application? THX

4 8

New Podman bugfix release: v4.8.1
by Lokesh Mandvekar 05 Dec '23

05 Dec '23

Podman v4.8.1 is now out, with bugfixes for the new sqlite database backend and a couple of WSL fixes among others. Check out the release page for a complete list of bugfixes https://github.com/containers/podman/releases/tag/v4.8.1 -- Lokesh Libera, GitLab, GitHub, Fedora: lsm5 Matrix: @lsm5:lsm5.ems.host GPG: 9E33DD8704CC03E2DEB84D9A1C1EDD7CC7C3A0DD https://keybase.io/lsm5

1 0