8:52 a.m.
I found a relevant Reddit thread where it ended up in a dead end with the OP giving up:
https://www.reddit.com/r/podman/comments/150l2zu/permission_issues_with_r...
A comment from user djzrbz:
You are running into a namespace mapping issue, to your edit, I
don't know anyone that uses secondary groups with bind mounts. Your host user may have
access, but your container isn't "running" as your host user, it is running
as a user within your subuid/subuid range that then gets mapped to your user as
configured.
This was a year and a half ago, with Podman 4.4.1.
tl;dr recap:
- host dir owned by root:sftp-only
- host user secondary group is sftp-only
- host dir is bind mounted into rootless container as nobody:nogroup, container user
cannot access
Restating the question: is there any mechanism for the container user to gain access to a
bind mounted folder that the host user can only access via a non-primary group membership?
chowning the host dir to the host user's primary uid/gid is not possible in our
situation.
- JK Laiho
On Tuesday, Jan 21, 2025 at 5:54 PM, JK Laiho <jklaiho(a)iki.fi
(mailto:jklaiho@iki.fi)> wrote:
I've got a rootless, quadlet-based container running with an unprivileged local user
called "app", with UID 1017 and GID 1020.
In addition, this user belongs to group IDs 1002 ("sftp-only") and 1003
("sftp-reader").
There's a host directory /srv/sftp-home, owned by root with its group set to
sftp-only, 0750 permissions. It has a bunch of subdirectories, owned by individual SFTP
connecting users, but with the group set to sftp-reader on all of them, 0750 permissions
also.
The app user is able to read all of these directories via the host group membership.
In the quadlet config for the service running as this user, I have these lines:
[Container]
# container root is my host "app" user
UIDMap=0:0:1
# For apt-get to work inside the container
UIDMap=42:1:1
# container root group is my host "app" group
GIDMap=0:0:1
# For apt-get to work inside the container
GIDMap=65534:1:1
# Probably irrelevant here, but mentioned just in case
NoNewPrivileges=true
Mount=type=bind,source=/srv/sftp-home,target=/srv/sftp-home
All other quadlet file contents have been omitted here, but there should be nothing else
that's related to this issue there.
Within the container, the bind mounted /srv/sftp-home is owned by nobody:nogroup, and the
in-container root user is unable to access them despite the underlying host user being
able to access the bind mount source directory.
What can be done to fix this? Podman version 5.2.5.
_______________________________________________
Podman mailing list -- podman(a)lists.podman.io
To unsubscribe send an email to podman-leave(a)lists.podman.io