summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorOpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com>2021-05-03 22:46:30 +0200
committerGitHub <noreply@github.com>2021-05-03 22:46:30 +0200
commit9788289f942ff7a79c214446047d0f943c66f409 (patch)
tree908b98a3113bb50d315543e85364e45113256051
parentaf8943a620c17d7aad8013d140423796bdbdd51b (diff)
parent65b62cca0448355013fdae10f08293ee5ef0658e (diff)
downloadpodman-9788289f942ff7a79c214446047d0f943c66f409.tar.gz
podman-9788289f942ff7a79c214446047d0f943c66f409.tar.bz2
podman-9788289f942ff7a79c214446047d0f943c66f409.zip
Merge pull request #10194 from rhatdan/docs
[CI:DOCS] Fix troubleshooting documentation on handling supplemental groups.
-rw-r--r--troubleshooting.md12
1 files changed, 6 insertions, 6 deletions
diff --git a/troubleshooting.md b/troubleshooting.md
index 1e21edab4..e320f20e7 100644
--- a/troubleshooting.md
+++ b/troubleshooting.md
@@ -495,10 +495,10 @@ $ podman unshare cat /proc/self/uid_map
Reference [subuid](http://man7.org/linux/man-pages/man5/subuid.5.html) and [subgid](http://man7.org/linux/man-pages/man5/subgid.5.html) man pages for more detail.
-### 20) Passed-in device can't be accessed in rootless container
+### 20) Passed-in devices or files can't be accessed in rootless container
-As a non-root user you have group access rights to a device that you want to
-pass into a rootless container with `--device=...`.
+As a non-root user you have group access rights to a device or files that you
+want to pass into a rootless container with `--device=...` or `--volume=...`
#### Symptom
@@ -507,9 +507,9 @@ Any access inside the container is rejected with "Permission denied".
#### Solution
The runtime uses `setgroups(2)` hence the process looses all additional groups
-the non-root user has. If you use the `crun` runtime, 0.10.4 or newer,
-then you can enable a workaround by adding `--annotation io.crun.keep_original_groups=1`
-to the `podman` command line.
+the non-root user has. Use the `--group-add keep-groups` flag to pass the
+user's supplementary group access into the container. Currently only available
+with the `crun` OCI runtime.
### 21) A rootless container running in detached mode is closed at logout