Rootless - Native overlay not shown in df or mount commands
Hi, Fedora 33 user here. Whenever I run a rootful container I can perform either: df -t overlay or mount -t overlay ....in the host and I can clearly see where the root filesystem of the container is actually mounted (the "merged" one). Now, with the new native overlay filesystem support for rootless containers, whenever I run a rootless one I don't see the same behavior with the mount or df commands (either as regular user or the root user). In fact, there's no overlay fs shown. I know it's there because I found them somewhere hidden in /proc/*/mounts and I also performed the "podman system reset" that Dan & Giuseppe mentioned in a recent blog post. There's got to be some explanation like perhaps it's under another "mount namespace" ...but then why do the overlay entries appear in the host when rootful containers are running? Thanks! Jorge
Hi Jorge, Rootless podman runs in an extra user+mount namespace. You can join this namespace with the podman unshare command, e.g. podman unshare mount -t overlay. See podman-unshare(1) <https://docs.podman.io/en/latest/markdown/podman-unshare.1.html> for more information about this command. Paul On Mon, Sep 6, 2021 at 5:44 AM Jorge Fábregas <jorge.fabregas@gmail.com> wrote:
Hi,
Fedora 33 user here. Whenever I run a rootful container I can perform either:
df -t overlay or mount -t overlay
....in the host and I can clearly see where the root filesystem of the container is actually mounted (the "merged" one).
Now, with the new native overlay filesystem support for rootless containers, whenever I run a rootless one I don't see the same behavior with the mount or df commands (either as regular user or the root user). In fact, there's no overlay fs shown. I know it's there because I found them somewhere hidden in /proc/*/mounts and I also performed the "podman system reset" that Dan & Giuseppe mentioned in a recent blog post.
There's got to be some explanation like perhaps it's under another "mount namespace" ...but then why do the overlay entries appear in the host when rootful containers are running?
Thanks! Jorge _______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io
On 9/6/21 3:31 AM, Paul Holzinger wrote:
Hi Jorge,
Rootless podman runs in an extra user+mount namespace. You can join this namespace with the podman unshare command, e.g. podman unshare mount -t overlay. See podman-unshare(1) <https://docs.podman.io/en/latest/markdown/podman-unshare.1.html> for more information about this command.
Paul
Thanks Paul !
Jorge Fábregas <jorge.fabregas@gmail.com> writes:
Hi,
Fedora 33 user here. Whenever I run a rootful container I can perform either:
df -t overlay or mount -t overlay
....in the host and I can clearly see where the root filesystem of the container is actually mounted (the "merged" one).
Now, with the new native overlay filesystem support for rootless containers, whenever I run a rootless one I don't see the same behavior with the mount or df commands (either as regular user or the root user). In fact, there's no overlay fs shown. I know it's there because I found them somewhere hidden in /proc/*/mounts and I also performed the "podman system reset" that Dan & Giuseppe mentioned in a recent blog post.
There's got to be some explanation like perhaps it's under another "mount namespace" ...but then why do the overlay entries appear in the host when rootful containers are running?
yes exactly, it is under the rootless user+mount namespace. You can use "podman unshare" to join the rootless user+mount namespace and see the overlay mount. Regards, Giuseppe
On 9/6/21 5:13 AM, Giuseppe Scrivano wrote:
yes exactly, it is under the rootless user+mount namespace.
You can use "podman unshare" to join the rootless user+mount namespace and see the overlay mount.
Thanks Giuseppe. That makes sense. So rootful containers run in the same default root "mount namespace" and that's why I can see the overlay mounts?
Jorge Fábregas <jorge.fabregas@gmail.com> writes:
On 9/6/21 5:13 AM, Giuseppe Scrivano wrote:
yes exactly, it is under the rootless user+mount namespace.
You can use "podman unshare" to join the rootless user+mount namespace and see the overlay mount.
Thanks Giuseppe. That makes sense. So rootful containers run in the same default root "mount namespace" and that's why I can see the overlay mounts?
exactly. root can create mounts directly in the current mount namespace so it doesn't need to create a new one owned by a different user namespace. Giuseppe
On 9/6/21 11:34 AM, Giuseppe Scrivano wrote:
exactly. root can create mounts directly in the current mount namespace so it doesn't need to create a new one owned by a different user namespace.
Ok, I see this now. Forgot the part that regular users can't create new mount points. I was mainly concentrating in the "isolation" aspect of a new mount namespace. Wouldn't new mount namespace for rootful containers provide an extra isolation? Thanks Gisueppe.
Jorge Fábregas <jorge.fabregas@gmail.com> writes:
On 9/6/21 11:34 AM, Giuseppe Scrivano wrote:
exactly. root can create mounts directly in the current mount namespace so it doesn't need to create a new one owned by a different user namespace.
Ok, I see this now. Forgot the part that regular users can't create new mount points. I was mainly concentrating in the "isolation" aspect of a new mount namespace.
Wouldn't new mount namespace for rootful containers provide an extra isolation?
for rootless it is more of a necessity than for extra security. In the new mount namespace it is still possible to access all the existing mount points from the host. For root, it could make sense to have a separate mount namespace so that the mount points won't be visible from the host. This setup is not currently supported, you'd need to create it manually. Giuseppe
Just curious, I tried this as my user account on Fedora 34 and do not see any mount points. I assume this is does't work because the root overlay is not enabled by default? fatherlinux $ podman run -id ubi8 bash fatherlinux $ mount -t overlay Thoughts? Best Regards Scott M On Mon, Sep 6, 2021 at 3:56 PM Giuseppe Scrivano <gscrivan@redhat.com> wrote:
Jorge Fábregas <jorge.fabregas@gmail.com> writes:
On 9/6/21 11:34 AM, Giuseppe Scrivano wrote:
exactly. root can create mounts directly in the current mount namespace so it doesn't need to create a new one owned by a different user namespace.
Ok, I see this now. Forgot the part that regular users can't create new mount points. I was mainly concentrating in the "isolation" aspect of a new mount namespace.
Wouldn't new mount namespace for rootful containers provide an extra isolation?
for rootless it is more of a necessity than for extra security.
In the new mount namespace it is still possible to access all the existing mount points from the host.
For root, it could make sense to have a separate mount namespace so that the mount points won't be visible from the host. This setup is not currently supported, you'd need to create it manually.
Giuseppe _______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io
-- -- 18 ways to differentiate open source products from upstream suppliers: https://opensource.com/article/21/2/differentiating-products-upstream-suppli... -- Scott McCarty Product Management - Containers, Red Hat Enterprise Linux & OpenShift Email: smccarty@redhat.com Phone: 312-660-3535 Cell: 330-807-1043 Web: http://crunchtools.com
On 9/7/21 11:00 AM, Scott McCarty wrote:
Just curious, I tried this as my user account on Fedora 34 and do not see any mount points. I assume this is does't work because the root overlay is not enabled by default?
Hi Scott, Mine worked by doing the suggested "podman unshare" after starting container: podman unshare mount -t overlay I'm now able to see the overlay filesystem. There's some reset you might need to do like mentioned here: https://www.redhat.com/sysadmin/podman-rootless-overlay The thing is that I wasn't aware that rootful containers are *not* in a separate mount-namespace and that's why you see the overlay mounts in the host. Regards, Jorge
On 9/6/21 3:55 PM, Giuseppe Scrivano wrote:
for rootless it is more of a necessity than for extra security.
In the new mount namespace it is still possible to access all the existing mount points from the host.
For root, it could make sense to have a separate mount namespace so that the mount points won't be visible from the host. This setup is not currently supported, you'd need to create it manually.
Thanks Giuseppe.
participants (4)
-
Giuseppe Scrivano -
Jorge Fábregas -
Paul Holzinger -
Scott McCarty