diff options
| -rw-r--r-- | docs/podman.1.md | 2 | ||||
| -rw-r--r-- | pkg/rootless/rootless_linux.go | 3 | ||||
| -rw-r--r-- | test/e2e/rootless_test.go | 1 |
3 files changed, 6 insertions, 0 deletions
diff --git a/docs/podman.1.md b/docs/podman.1.md index c946ccb02..ea7f93afa 100644 --- a/docs/podman.1.md +++ b/docs/podman.1.md @@ -158,6 +158,8 @@ Podman can also be used as non-root user. When podman runs in rootless mode, an Containers created by a non-root user are not visible to other users and are not seen or managed by podman running as root. +It is required to have multiple uids/gids set for an user. Be sure the user is present in the files `/etc/subuid` and `/etc/subgid`. + Images are pulled under `XDG_DATA_HOME` when specified, otherwise in the home directory of the user under `.local/share/containers/storage`. Currently it is not possible to create a network device, so rootless containers need to run in the host network namespace. If a rootless container creates a network namespace, diff --git a/pkg/rootless/rootless_linux.go b/pkg/rootless/rootless_linux.go index 6089ad73a..3d6402040 100644 --- a/pkg/rootless/rootless_linux.go +++ b/pkg/rootless/rootless_linux.go @@ -104,6 +104,9 @@ func BecomeRootInUserNS() (bool, int, error) { var uids, gids []idtools.IDMap username := os.Getenv("USER") mappings, err := idtools.NewIDMappings(username, username) + if err != nil && os.Getenv("PODMAN_ALLOW_SINGLE_ID_MAPPING_IN_USERNS") == "" { + return false, -1, err + } if err == nil { uids = mappings.UIDs() gids = mappings.GIDs() diff --git a/test/e2e/rootless_test.go b/test/e2e/rootless_test.go index d628b6fa1..918faa320 100644 --- a/test/e2e/rootless_test.go +++ b/test/e2e/rootless_test.go @@ -82,6 +82,7 @@ var _ = Describe("Podman rootless", func() { env := os.Environ() env = append(env, fmt.Sprintf("XDG_RUNTIME_DIR=%s", xdgRuntimeDir)) env = append(env, fmt.Sprintf("HOME=%s", home)) + env = append(env, "PODMAN_ALLOW_SINGLE_ID_MAPPING_IN_USERNS=1") cmd := podmanTest.PodmanAsUser([]string{"run", "--rootfs", mountPath, "echo", "hello"}, 1000, 1000, env) cmd.WaitWithDefaultTimeout() Expect(cmd.LineInOutputContains("hello")).To(BeTrue()) |