5:43 a.m.
Hi,
Fedora 33 user here. Whenever I run a rootful container I can perform
either:
df -t overlay
or
mount -t overlay
....in the host and I can clearly see where the root filesystem of the
container is actually mounted (the "merged" one).
Now, with the new native overlay filesystem support for rootless
containers, whenever I run a rootless one I don't see the same behavior
with the mount or df commands (either as regular user or the root user).
In fact, there's no overlay fs shown. I know it's there because I found
them somewhere hidden in /proc/*/mounts and I also performed the "podman
system reset" that Dan & Giuseppe mentioned in a recent blog post.
There's got to be some explanation like perhaps it's under another
"mount namespace" ...but then why do the overlay entries appear in the
host when rootful containers are running?
Thanks!
Jorge
9:31 a.m.
Hi Jorge,
Rootless podman runs in an extra user+mount namespace. You can join this
namespace with the podman unshare command, e.g. podman unshare mount -t
overlay. See podman-unshare(1)
<https://docs.podman.io/en/latest/markdown/podman-unshare.1.html> for more
information about this command.
Paul
On Mon, Sep 6, 2021 at 5:44 AM Jorge Fábregas <jorge.fabregas(a)gmail.com>
wrote:
Hi,
Fedora 33 user here. Whenever I run a rootful container I can perform
either:
df -t overlay
or
mount -t overlay
....in the host and I can clearly see where the root filesystem of the
container is actually mounted (the "merged" one).
Now, with the new native overlay filesystem support for rootless
containers, whenever I run a rootless one I don't see the same behavior
with the mount or df commands (either as regular user or the root user).
In fact, there's no overlay fs shown. I know it's there because I found
them somewhere hidden in /proc/*/mounts and I also performed the "podman
system reset" that Dan & Giuseppe mentioned in a recent blog post.
There's got to be some explanation like perhaps it's under another
"mount namespace" ...but then why do the overlay entries appear in the
host when rootful containers are running?
Thanks!
Jorge
_______________________________________________
Podman mailing list -- podman(a)lists.podman.io
To unsubscribe send an email to podman-leave(a)lists.podman.io
4:38 p.m.
New subject: Rootless - Native overlay not shown in df or mount commands
On 9/6/21 3:31 AM, Paul Holzinger wrote:
Hi Jorge,
Rootless podman runs in an extra user+mount namespace. You can join this
namespace with the podman unshare command, e.g. podman unshare mount -t
overlay. See podman-unshare(1)
<https://docs.podman.io/en/latest/markdown/podman-unshare.1.html> for
more information about this command.
Paul
Thanks Paul !
11:13 a.m.
New subject: Rootless - Native overlay not shown in df or mount commands
Jorge Fábregas <jorge.fabregas(a)gmail.com> writes:
Hi,
Fedora 33 user here. Whenever I run a rootful container I can perform
either:
df -t overlay
or
mount -t overlay
....in the host and I can clearly see where the root filesystem of the
container is actually mounted (the "merged" one).
Now, with the new native overlay filesystem support for rootless
containers, whenever I run a rootless one I don't see the same behavior
with the mount or df commands (either as regular user or the root user).
In fact, there's no overlay fs shown. I know it's there because I found
them somewhere hidden in /proc/*/mounts and I also performed the "podman
system reset" that Dan & Giuseppe mentioned in a recent blog post.
There's got to be some explanation like perhaps it's under another
"mount namespace" ...but then why do the overlay entries appear in the
host when rootful containers are running?
yes exactly, it is under the rootless user+mount namespace.
You can use "podman unshare" to join the rootless user+mount namespace
and see the overlay mount.
Regards,
Giuseppe
4:41 p.m.
New subject: Rootless - Native overlay not shown in df or mount commands
On 9/6/21 5:13 AM, Giuseppe Scrivano wrote:
yes exactly, it is under the rootless user+mount namespace.
You can use "podman unshare" to join the rootless user+mount namespace
and see the overlay mount.
Thanks Giuseppe. That makes sense. So rootful containers run in the
same default root "mount namespace" and that's why I can see the overlay
mounts?
5:34 p.m.
New subject: Rootless - Native overlay not shown in df or mount commands
Jorge Fábregas <jorge.fabregas(a)gmail.com> writes:
On 9/6/21 5:13 AM, Giuseppe Scrivano wrote:
> yes exactly, it is under the rootless user+mount namespace.
>
> You can use "podman unshare" to join the rootless user+mount namespace
> and see the overlay mount.
Thanks Giuseppe. That makes sense. So rootful containers run in the
same default root "mount namespace" and that's why I can see the overlay
mounts?
exactly. root can create mounts directly in the current mount namespace
so it doesn't need to create a new one owned by a different user
namespace.
Giuseppe
5:52 p.m.
New subject: Rootless - Native overlay not shown in df or mount commands
On 9/6/21 11:34 AM, Giuseppe Scrivano wrote:
exactly. root can create mounts directly in the current mount
namespace
so it doesn't need to create a new one owned by a different user
namespace.
Ok, I see this now. Forgot the part that regular users can't create new
mount points. I was mainly concentrating in the "isolation" aspect of a
new mount namespace.
Wouldn't new mount namespace for rootful containers provide an extra
isolation?
Thanks Gisueppe.
9:55 p.m.
New subject: Rootless - Native overlay not shown in df or mount commands
Jorge Fábregas <jorge.fabregas(a)gmail.com> writes:
On 9/6/21 11:34 AM, Giuseppe Scrivano wrote:
> exactly. root can create mounts directly in the current mount namespace
> so it doesn't need to create a new one owned by a different user
> namespace.
Ok, I see this now. Forgot the part that regular users can't create new
mount points. I was mainly concentrating in the "isolation" aspect of a
new mount namespace.
Wouldn't new mount namespace for rootful containers provide an extra
isolation?
for rootless it is more of a necessity than for extra security.
In the new mount namespace it is still possible to access all the
existing mount points from the host.
For root, it could make sense to have a separate mount namespace so that
the mount points won't be visible from the host. This setup is not
currently supported, you'd need to create it manually.
Giuseppe
5 p.m.
Just curious, I tried this as my user account on Fedora 34 and do not see
any mount points. I assume this is does't work because the root overlay is
not enabled by default?
fatherlinux $ podman run -id ubi8 bash
fatherlinux $ mount -t overlay
Thoughts?
Best Regards
Scott M
On Mon, Sep 6, 2021 at 3:56 PM Giuseppe Scrivano <gscrivan(a)redhat.com>
wrote:
Jorge Fábregas <jorge.fabregas(a)gmail.com> writes:
> On 9/6/21 11:34 AM, Giuseppe Scrivano wrote:
>> exactly. root can create mounts directly in the current mount namespace
>> so it doesn't need to create a new one owned by a different user
>> namespace.
>
> Ok, I see this now. Forgot the part that regular users can't create new
> mount points. I was mainly concentrating in the "isolation" aspect of a
> new mount namespace.
>
> Wouldn't new mount namespace for rootful containers provide an extra
> isolation?
for rootless it is more of a necessity than for extra security.
In the new mount namespace it is still possible to access all the
existing mount points from the host.
For root, it could make sense to have a separate mount namespace so that
the mount points won't be visible from the host. This setup is not
currently supported, you'd need to create it manually.
Giuseppe
_______________________________________________
Podman mailing list -- podman(a)lists.podman.io
To unsubscribe send an email to podman-leave(a)lists.podman.io
--
--
18 ways to differentiate open source products from upstream suppliers:
https://opensource.com/article/21/2/differentiating-products-upstream-sup...
--
Scott McCarty
Product Management - Containers, Red Hat Enterprise Linux & OpenShift
Email: smccarty(a)redhat.com
Phone: 312-660-3535
Cell: 330-807-1043
Web: http://crunchtools.com
5:07 p.m.
New subject: Rootless - Native overlay not shown in df or mount commands
On 9/7/21 11:00 AM, Scott McCarty wrote:
Just curious, I tried this as my user account on Fedora 34 and do not
see
any mount points. I assume this is does't work because the root overlay is
not enabled by default?
Hi Scott,
Mine worked by doing the suggested "podman unshare" after starting
container:
podman unshare mount -t overlay
I'm now able to see the overlay filesystem. There's some reset you
might need to do like mentioned here:
https://www.redhat.com/sysadmin/podman-rootless-overlay
The thing is that I wasn't aware that rootful containers are *not* in a
separate mount-namespace and that's why you see the overlay mounts in
the host.
Regards,
Jorge
5:02 p.m.
New subject: Rootless - Native overlay not shown in df or mount commands
On 9/6/21 3:55 PM, Giuseppe Scrivano wrote:
for rootless it is more of a necessity than for extra security.
In the new mount namespace it is still possible to access all the
existing mount points from the host.
For root, it could make sense to have a separate mount namespace so that
the mount points won't be visible from the host. This setup is not
currently supported, you'd need to create it manually.
Thanks Giuseppe.
955
days inactive
956
days old
10 comments
4 participants
participants (4)
-
Giuseppe Scrivano -
Jorge Fábregas -
Paul Holzinger -
Scott McCarty