I am trying to modify OpenWrt and its podman package to allow users
other than root to manage containers on that system.
I have made some progress, including working through some "bugs" in
podman and the OpenWrt packages:
https://github.com/containers/podman/issues/9687
https://github.com/containers/storage/pull/851
https://github.com/openwrt/packages/pull/15673
A summary of my work so far exists at
https://github.com/openwrt/packages/issues/15096.
There are two things I do not yet understand, so I am looking for a
summary of how these things work or some recommended reading regarding
them.
(1) Non-root users cannot write to /sys/fs/cgroup/*. I am not sure how to
safely handle this, and I have not yet figured out how other distributions
do it. Does a privileged agent exist that performs the updates to
/sys/fs/cgroup that are necessary to setup a container?
(2) Running "podman run ..." wants to mount /proc and so on in the
container. This fails when run as non-root with "mounting '/proc' to
rootfs at '/proc' caused: operation not permitted." Again, I am not sure
what performs these privileged operations on other distributions.
Thank you,
--
Mike
:wq