That's a weird one. I was going to suggest using the -Z option on externally mounted volumes, but it sounds like you tried the ephemeral storage as well. I'm wondering if this app runs at all, even outside of the container? Could it b something whacky with the Python interpretor and/or kernel interaction? It doesn't "sound" like podman, but it's tonight to call for sure unless we find a root cause. Could you try running it on the exact same system, but as a regular process? Best Regards Scott M On Fri, Jul 30, 2021, 12:42 PM Josh Berkus <jberkus@redhat.com> wrote:

All,

I'm porting a legacy app to containers, and having an issue where apparently it can't write files while running in podman.

Is there any reason why a python process, or child process, running as container-root would be unable to write to either the ephemeral filesystem of the container, or to mounted volumes?

Basically, here's the situation:

- pyhton app with many child processes - all of them run as container-root - app is supposed to write logs to files (yes, I know) - app does not write any logs to any files; in fact, the log-dir initialization appears to fail (no error messages, though, because it's not logging) - one other process which is supposed to write cache to a dir does not do so - all of these directories are under /app/ a directory COPYd into the image definition, not /var/ or home - have tried both with these dirs as local to the container, and as mounted volumes on the host system - if I exec in to the container as container-root, I can write files to those dirs - SELinux denial log on the host does not show any denials

It is entirely possible that this is a problem with the legacy app and is not a podman thing at all. I'm asking here because I want to eliminate podman as a potential cause of the problem.

-- -- Josh Berkus Kubernetes Community Architect OSPO, OCTO _______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io

On 7/30/21 12:40, Josh Berkus wrote:

All,

I'm porting a legacy app to containers, and having an issue where apparently it can't write files while running in podman.

Is there any reason why a python process, or child process, running as container-root would be unable to write to either the ephemeral filesystem of the container, or to mounted volumes?

Basically, here's the situation:

- pyhton app with many child processes - all of them run as container-root - app is supposed to write logs to files (yes, I know) - app does not write any logs to any files; in fact, the log-dir initialization appears to fail (no error messages, though, because it's not logging) - one other process which is supposed to write cache to a dir does not do so - all of these directories are under /app/ a directory COPYd into the image definition, not /var/ or home - have tried both with these dirs as local to the container, and as mounted volumes on the host system - if I exec in to the container as container-root, I can write files to those dirs - SELinux denial log on the host does not show any denials

It is entirely possible that this is a problem with the legacy app and is not a podman thing at all.  I'm asking here because I want to eliminate podman as a potential cause of the problem.

Have you tried this with a --privileged container? Are you running in rootless mode?  If yes, could you try a --privileged rootfull?