- Podman - Podman List Archives

rootless-cni-infra - when & how?
by lejeczek 04 May '21

04 May '21

Hi guys. I assume that 'rootless-cni-infra' gets created somewhere under the hood without user intervention and I wonder how and when, as I see this: .. ERRO[0000] error starting some container dependencies ERRO[0000] "rootless CNI infra image not present - please build image from https://github.com/containers/podman/blob/v3.0.1-rhel/contrib/rootless-cni-… and tag as \"rootless-cni-infra\"" Error: error starting some containers: internal libpod error Would somebody care to shed some light on it? many thanks, L.

1 0

Capabilities and rootless containers
by Vincent QUEMENER 04 May '21

04 May '21

Hi, I am looking for some guidance on how to securely containerize an application that depends on the `CAP_SYS_NICE` capability to work. Outside of the container world, one would probably just set the capability on the binary so that a non-privileged user could run it : ``` $ my_app Error! $ sudo setcap 'cap_sys_nice+ep' my_app $ my_app Success! ``` When working with containers, the easiest solution would be to execute Podman as root with the `--cap-add` parameter : ``` $ sudo podman run --rm --cap-add "sys_nice" -v "$PWD/my_app:/my_app" fedora:34 /my_app Success! ``` A somewhat more secure option would consist in switching to a non-privileged user with the `--user` parameter : ``` $ sudo podman run --rm --cap-add "sys_nice" -v "$PWD/my_app:/my_app" --user nobody fedora:34 /my_app Success! ``` Now, in order to mitigate potential container-breakout vulnerabilities, I would like to go a bit further and set up a rootless container. I have recently learned about ambient capabilities and I have started experimenting with the `capsh` command. This seems to work : ``` $ sudo capsh --caps="cap_sys_nice+eip cap_setpcap,cap_setuid,cap_setgid+ep" --keep=1 --user="${USER}" --addamb=cap_sys_nice -- -c ./my_app Success! ``` But this does not (the ambient capability is not set in the container and `strace` indicates that the `setpriority` system call fails with a `Permission denied`) : ``` $ sudo capsh --caps="cap_sys_nice+eip cap_setpcap,cap_setuid,cap_setgid+ep" --keep=1 --user="${USER}" --addamb=cap_sys_nice -- -c "HOME=${HOME} podman run --rm --cap-add sys_nice -v $PWD/my_app:/my_app fedora:34 /my_app" Error! ``` Is this a podman limitation (Could it be improved?)? Is there a better approach? Thank you, Vincent Quéméner.

2 2

Podman Community Meeting Recording - May 4, 2021
by Tom Sweeney 04 May '21

04 May '21

HI All, The recording for the Podman Community Meeting is now available at: https://bluejeans.com/s/Qq_IsjrnOaG. The talks included the progress of IPV6 in Podman, a demo of the WIP Podman Python Client, and a talk and Demo on "Running Docker, Podman, and even Kubernetes inside rootless Podman containers" by Cesar Talledo of Nestybox. In addition, you might find a reference or two to Star Wars being it was recorded on May the Fourth. I'll get the meeting notes posted to the podman.io website within the week and hope to see you at the next meeting on June 1, 2021 at 11:00 a.m. Eastern (UTC-4) t ps. Please remember that if Darth Vader had cooked meals for a living, he'd be Darth Caterer....

1 0

Podman Community Meeting - Tues May 4, 2021 11:00 a.m. EDT (UTC-4)
by Tom Sweeney 03 May '21

03 May '21

HI All, The Podman Community Meeting will be happending in a little over 24 hours from now on Tuesday May 4, 2021 at 11:00 a.m. EDT (UTC-4). We'll be talking about IPV6, Running Docker, Podman and even Kubernetes inside rootless Podman Containers, a Python Demo and an open forum for any questions. All free to attend via BlueJeans video conference: https://bluejeans.com/796412039 The full agenda here: https://podman.io/community/meeting/agenda/ Hope to see you there! t

1 0

overlayfs driver VS images - overlayfs: unrecognized
by lejeczek 27 Apr '21

27 Apr '21

Hi guys. First thing which came to mind was to try driver newer version of the driver or newer kernel all together - when I got this upon container creation: .... overlayfs: unrecognized mount option "volatile" or missing value overlayfs: unrecognized mount option "volatile" or missing value .... But before I do that - would there be a way to tamper with the image perhaps and/or other bits involved in order to get get rid of the problem? many thanks, L.

4 4

Re: Need help in creating a rootless container in podman
by supravapanda＠gmail.com 27 Apr '21

27 Apr '21

Hello All, Looks like there is no write permission on /home other than root user.so i think i am getting below error i will try to create a newuser with different home directory and try do podman run. dir: mkdir ... /home/orequest/.local/share/containers/storage/overlay/476579af086aee7 ... 8cb12d88b08fd6b61a80a3f055cae293ec2d15a37dbe7b3f9/diff/.pivot_root4716 ... 72024: permission denied

1 0

Re: Need help in creating a rootless container in podman
by Scott McCarty 26 Apr '21

26 Apr '21

I've never seen this error. Is this a default install of RHEL 8.3? Try adding a new user to the system and running the podman with that new user. On Mon, Apr 26, 2021 at 10:14 AM Collins, Kent <Robert.Collins(a)bnsf.com> wrote: > Hi > > > > I am using podman and running non-root > > ==> podman version > > Version: 2.2.1 > > API Version: 2 > > Go Version: go1.14.7 > > Built: Mon Feb 8 15:19:06 2021 > > OS/Arch: linux/amd64 > > > > I’ve loaded one docker image. But because of security and restrictions > the building of that docker image I performed on my laptop. We have a > local repository which as intense security scans of images which I will use > as some point. > > > > So I downloaded the docker image I needed on my laptop. Exported the > image and copied it to the server with podman. Then I ran LOAD to add the > image. Import does not work because of the external registry. > > > > Thanks > > > > Kent Collins > > Office: 817.352.0251 | Enterprise Information Management | Cell: > 817.879.7764 > > Data Solutions Architect/Scientist – Published Author and Conference > Speaker > > > > “Death and life are in the power of the tongue: and they that love it > shall eat the fruit thereof.” > > Prov 18:21 > > > > > > > > -----Original Message----- > From: Daniel Walsh [mailto:dwalsh@redhat.com] > Sent: Monday, April 26, 2021 5:58 AM > To: podman(a)lists.podman.io > Subject: [Podman] Re: Need help in creating a rootless container in podman > > > > External Message > > On 4/25/21 09:17, supravapanda(a)gmail.com wrote: > > > I have tried all options.when run podman pull command as a normal user i > get below error.but as sudo it works fine. > > > Can i know what need to done to run the command as a non root user.. > > > > > > atlvrmsbmld02:/home/orequest[ 53 ] --> podman pull > > > registry.access.redhat.com/ubi8/ubi > > > Trying to pull registry.access.redhat.com/ubi8/ubi:latest... > > > Getting image source signatures > > > Copying blob 4b21dcdd136d done > > > Copying blob 55eda7743468 done > > > Copying config 613e5da7a9 done > > > Writing manifest to image destination > > > Storing signatures > > > Error processing tar file(exit status 1): Error setting up pivot > > > dir: mkdir > > > /home/orequest/.local/share/containers/storage/overlay/476579af086aee7 > > > 8cb12d88b08fd6b61a80a3f055cae293ec2d15a37dbe7b3f9/diff/.pivot_root4716 > > > 72024: permission denied > > > Error: Error committing the finished image: error adding layer with > > > blob > > > "sha256:4b21dcdd136d133a4df0840e656af2f488c226dd384a98b89ced79064a4081 > > > b4": Error processing tar file(exit status 1): Error setting up pivot > > > dir: mkdir > > > /home/orequest/.local/share/containers/storage/overlay/476579af086aee7 > > > 8cb12d88b08fd6b61a80a3f055cae293ec2d15a37dbe7b3f9/diff/.pivot_root4716 > > > 72024: permission denied > > > _______________________________________________ > > > Podman mailing list -- podman(a)lists.podman.io To unsubscribe send an > > > email to podman-leave(a)lists.podman.io > > > > Perhaps user namesapce is not setup correctly. > > > > > > podman unshare cat /proc/self/uid_map > > > > _______________________________________________ > > Podman mailing list -- podman(a)lists.podman.io To unsubscribe send an > email to podman-leave(a)lists.podman.io > > > > <p></p> > _______________________________________________ > Podman mailing list -- podman(a)lists.podman.io > To unsubscribe send an email to podman-leave(a)lists.podman.io > -- -- 18 ways to differentiate open source products from upstream suppliers: https://opensource.com/article/21/2/differentiating-products-upstream-suppl… -- Scott McCarty Product Management - Containers, Red Hat Enterprise Linux & OpenShift Email: smccarty(a)redhat.com Phone: 312-660-3535 Cell: 330-807-1043 Web: http://crunchtools.com

1 0

Need help in creating a rootless container in podman
by supravapanda＠gmail.com 26 Apr '21

26 Apr '21

Trying to create a rootless container on Redhat . i am facing some problems. Can anybody help ?I am following below link https://medium.com/devops-dudes/how-to-setup-root-less-podman-containers-ef… I can create a container from root user on redhat but when trying from normal user getting below error Error: Error initializing source docker://registry.access.redhat.com/ubi8/ubi:latest: error getting username and password: error reading JSON file "/home/$USER/.docker/config.json": open /home/$USER/.docker/config.json: permission denied

6 7

Podman Community Meeting Tues May 4, 2021 11:00 a.m. EDT (UTC-4) Agenda
by Tom Sweeney 21 Apr '21

21 Apr '21

Hi All, The next Podman Community Meeting is coming up in just under two weeks! It will be happening at 11:00 a.m. Eastern Daylight Time (UTC-4) and we will be using a BlueJeans video conference room (https://bluejeans.com/796412039) We've a few great topics lined up, an update on IPV6 in Podman, Running Docker, Podman, and even K11 inside rootless Podman containers, Podman Python Client and more! For the full agenda, see: https://podman.io/community/meeting/agenda/ Hope to see you there! t

1 0

Tuesday May 4 Podman Community Meeting Topics
by Tom Sweeney 16 Apr '21

16 Apr '21

Hi All, Just a quick ping asking for any topics for the the May 4th Podman Community Meeting at 11:00 a.m. Eastern (UTC-4). If you've something container related that you'd like to talk about, or have particular functions in Podman, Buildah or Skopeo that you'd like to see a discussion on, please let me know. At the moment, I've about 20 to 30 minutes of time remaining in the meeting and hope to get an agenda out for the Tuesday May 4th meeting sometime later next week. So if you've a thought, please send me an email. Bonus points if you can work in a Star Wars reference! Thanks! t

5 6