diff options
| author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2019-12-17 16:38:00 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2019-12-17 16:38:00 +0100 |
| commit | fab67f33930cf793d6780408406bc0305c70ff8f (patch) | |
| tree | 0eb925f58c35b62b70ffe0e03c1a9366ad01a4d8 /troubleshooting.md | |
| parent | 1e440a3a3f7c7a1ac5896ae834e884c0dc3907f3 (diff) | |
| parent | aec62d286296423a2f97cb376d9e11d2ea68cc8c (diff) | |
| download | podman-fab67f33930cf793d6780408406bc0305c70ff8f.tar.gz podman-fab67f33930cf793d6780408406bc0305c70ff8f.tar.bz2 podman-fab67f33930cf793d6780408406bc0305c70ff8f.zip | |
Merge pull request #4487 from stefanb2/topic-pr-4477
docs: add workaround for --device with rootless containers
Diffstat (limited to 'troubleshooting.md')
| -rw-r--r-- | troubleshooting.md | 18 |
1 files changed, 17 insertions, 1 deletions
diff --git a/troubleshooting.md b/troubleshooting.md index 432c0e32b..d122983d7 100644 --- a/troubleshooting.md +++ b/troubleshooting.md @@ -468,4 +468,20 @@ $ podman unshare cat /proc/self/uid_map 1 100000 65536 ``` -Reference [subuid](http://man7.org/linux/man-pages/man5/subuid.5.html) and [subgid](http://man7.org/linux/man-pages/man5/subgid.5.html) man pages for more detail.
\ No newline at end of file +Reference [subuid](http://man7.org/linux/man-pages/man5/subuid.5.html) and [subgid](http://man7.org/linux/man-pages/man5/subgid.5.html) man pages for more detail. + +### 20) Passed-in device can't be accessed in rootless container + +As a non-root user you have group access rights to a device that you want to +pass into a rootless container with `--device=...`. + +#### Symptom + +Any access inside the container is rejected with "Permission denied". + +#### Solution + +The runtime uses `setgroups(2)` hence the process looses all additional groups +the non-root user has. If you use the `crun` runtime, 0.10.4 or newer, +then you can enable a workaround by adding `--annotation io.crun.keep_original_groups=1` +to the `podman` command line. |