3:36 p.m.
I think the directive "PodmanArgs" can be used to set podman arguments
that don't have any
container option counterpart.
See man page:
https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html
Maybe something like this could work?
PodmanArgs=--uidmap 0:0:1 --uidmap 100:1:1 --gidmap 0:0:1 --gidmap 65534:1:1
(untested)
Erik
On Mon, Sep 4, 2023 at 7:03 PM jklaiho(a)iki.fi <jklaiho(a)iki.fi> wrote:
>>
>> Nonetheless, I would really appreciate help with how to express these old style
mappings with the new UserNS option in Quadlet:
>>
>> RemapUsers=manual
>> RemapUid=0:0:1
>> RemapUid=100:1:1
>> RemapGid=0:0:1
>> RemapGid=65534:1:1
>>
> The syntax is `container ID: host ID: range`. So `100:1:1` means that container UID
100 is mapped to host UID 1 for the range of length 1. `100:1:10` would mean that 10 UIDs
starting at 100 inside the container are mapped to 10 outside the container at UID 1.
>
> That being said, are you sure what you specified above is correct? In case you are
not sure, can you elaborate why you want to achieve? I am hesitant to give an answer as
the ranges look strange to me.
>
>
> See this thread:
https://lists.podman.io/archives/list/podman@lists.podman.io/thread/3ZN4U...
>
> It describes the original issue I had, and how I arrived at those numbers. Remember,
this is a rootless container being run by a regular user. According to Erik Sjölund's
post in the thread, the middle number is only a host UID in a rootful container –
otherwise it's an "intermediate UID", a term Erik says he invented for
explanatory purposes. ("Positional index", he later also called it; so AFAIK, an
index to the subordinate UIDs of the host user.)
>
> As for what I'm trying to achieve:
>
> RemapUid=0:0:1 and RemapGid=0:0:1 just make it so that the container root appears to
the host as the regular host user, for purposes of host file permissions for bind mounted
volumes. (A file created into the mounted volume as the container's root shows up on
the host side as being created by the regular user, etc.)
>
> RemapUid=100:1:1 and RemapGid=65534:1:1 fix the apt-related error described in the
thread, and have no other purpose for me. If (if!) I understood anything from Erik's
and Guiseppe Scrivano's explanations in that thread, this gives the container one
extra UID and GID to work with when performing seteuid/setegid/setgroups operations. It
seems to need those when the container root drops privileges to become the container _apt
user during package installation.
>
> Phew :-D. With all that said, I hope the correct UserNS invocation can be
determined.
>
> - JK
>
> _______________________________________________
> Podman mailing list -- podman(a)lists.podman.io
> To unsubscribe send an email to podman-leave(a)lists.podman.io