rootless podman run container as user rather than root
Hi All Been looking at this one for a good few days, I think I might have the wrong idea of how it works so I'd like some advice. I created my container image - bioconda that all works nicely, and I can run it from my /home directory as follows: - podman run -v /home/bryan/data:/home/bryan:z -it bioconda This starts it up and I can create Directories and Files ok within it and they retain the correct uid and gid's, however some of my other images warn that you are running as root which I'd like to stop happening. Is it possible to use the userns=keep-uid to do this? I can't seem to make it work correctly if this is the way I'm interpreting it to do so. Thank you Bryan
On 1/8/20 5:35 AM, bryan.hepworth@gmail.com wrote:
Hi All
Been looking at this one for a good few days, I think I might have the wrong idea of how it works so I'd like some advice.
I created my container image - bioconda that all works nicely, and I can run it from my /home directory as follows: -
podman run -v /home/bryan/data:/home/bryan:z -it bioconda
This starts it up and I can create Directories and Files ok within it and they retain the correct uid and gid's, however some of my other images warn that you are running as root which I'd like to stop happening. Is it possible to use the userns=keep-uid to do this? I can't seem to make it work correctly if this is the way I'm interpreting it to do so.
Thank you
Bryan _______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io
You are not really running as root, you are running as your UID, but the processes inside of the container are confused. But if you want to run with your own UID then running with --keep-id is fine. You could also pick a user within the container to run as, something like: podman run --user 1000 -v /home/bryan/data:/home/bryan:z -it bioconda
Hi Dan Thanks for the reply, unfortunately it doesn't like --keep-id and says unknown flag, the user value does work though. Am I making a mountain out of molehill with wanting it to be run this way. I appreciated the container was running with my credentials rather than real root. Bryan
Hi Dan Sorry the --userns=keep-id does work, it dawned on me that the bioconda package all needs configuring when you start it up for the first time. I think I'll try with a few less container examples and see how I go. For anyone else wondering the command line was: - podman run --userns=keep-id -v /home/bryan/data:/home/bryan:z -it bioconda It sees my numerical userid 1001 rather than my name bryan Bryan
Hi All Just a follow up to say everything worked exactly as I wanted it, files created inside the container were written to the data folder on the real machine. Extremely happy is an understatement as I can now let my end users create and use their own containers and have them write to their data folders. Just have to build a suite of bioinformatics containers, but I've got the hang of that already. Thanks once again. Bryan
Bryan, If you'd like to write up a little blog on how you're setting that all up, I'd love to publish it on https://podman.io t On 01/09/2020 06:54 AM, bryan.hepworth@gmail.com wrote:
Hi All
Just a follow up to say everything worked exactly as I wanted it, files created inside the container were written to the data folder on the real machine. Extremely happy is an understatement as I can now let my end users create and use their own containers and have them write to their data folders.
Just have to build a suite of bioinformatics containers, but I've got the hang of that already.
Thanks once again.
Bryan _______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io
participants (3)
-
bryan.hepworth＠gmail.com -
Daniel Walsh -
Tom Sweeney