chown permission error building with podman #3958
Replies: 19 comments 5 replies
-
|
Hi @GolanTrevize10 , Thanks for creating the issue. Is your kubernetes container privileged ? Could you share the command which you used to build the container? also it would nice if you could also share output of Edit: Also see #2554 (comment) |
Beta Was this translation helpful? Give feedback.
-
|
Hi @flouthoc , no it is not a privileged container. the command is Output of podman info |
Beta Was this translation helpful? Give feedback.
-
|
I tried this just now following worked for me
podman run -it --rm quay.io/containers/buildah:latest bash
Trying to pull quay.io/containers/buildah:latest...
Getting image source signatures
Copying blob 9c6cc3463716 done
Copying blob 5ec9815b5317 done
Copying blob 09f0ddd3b684 done
Copying blob 229f3952ded4 done
Copying blob 5f0d1d409f0e done
Copying blob ad5a8472a781 done
Copying config c57750d4fe done
Writing manifest to image destination
Storing signatures
[root@dd415d1b4a71 /]# vi Dockerfile
[root@dd415d1b4a71 /]# buildah --storage-driver vfs build -t test .
STEP 1/3: FROM alpine
Resolved "alpine" as an alias (/etc/containers/registries.conf.d/000-shortnames.conf)
Trying to pull docker.io/library/alpine:latest...
Getting image source signatures
Copying blob df9b9388f04a done
Copying config 0ac33e5f5a done
Writing manifest to image destination
Storing signatures
STEP 2/3: USER root
STEP 3/3: RUN touch hello
COMMIT test
Getting image source signatures
Copying blob 4fc242d58285 skipped: already exists
Copying blob c577b75c8c4e done
Copying config 094a0c66ed done
Writing manifest to image destination
Storing signatures
--> 094a0c66ede
Successfully tagged localhost/test:latest
094a0c66ededd96ef02d04ae02e945db4c99f514789b8e8e3303daa7e4f6a009@GolanTrevize10 Could you also add FROM alpine
RUN echo hello |
Beta Was this translation helpful? Give feedback.
-
|
@flouthoc with buildah latest image it works, but not with podman. Try this:
|
Beta Was this translation helpful? Give feedback.
-
|
I realized now you are running buildah with root. If I use the build user it does not work |
Beta Was this translation helpful? Give feedback.
-
|
@GolanTrevize10 It worked fine for me even from
podman run -it --rm --user build quay.io/containers/buildah:latest bash
[build@2faf81db7bb9 ~]$ cat Dockerfile
FROM alpine
USER root
RUN touch hello
[build@2faf81db7bb9 ~]$ buildah --storage-driver vfs build -t test .
STEP 1/3: FROM alpine
STEP 2/3: USER root
STEP 3/3: RUN touch hello
COMMIT test
Getting image source signatures
Copying blob 4fc242d58285 skipped: already exists
Copying blob 7881c59e6e45 done
Copying config 65857c2720 done
Writing manifest to image destination
Storing signatures
--> 65857c27206
Successfully tagged localhost/test:latest
65857c27206785842faa3a50c5ae4191308217c5ad37e03f6caa077f4f3a831a |
Beta Was this translation helpful? Give feedback.
-
|
@flouthoc sorry, yo uare right. With buildah image it works. But with podman image it doesn't:
|
Beta Was this translation helpful? Give feedback.
-
|
Strange it looks like buildah is also attempting to set the hostname. Could you see if there are any errors in the audit.log about setting the hostname? Could you also try with podman --storage-driver vfs build --uts=host ... And see if this works. |
Beta Was this translation helpful? Give feedback.
-
|
With --uts=host it works. Where can I find the audit.log? |
Beta Was this translation helpful? Give feedback.
-
|
/var/log/audit/audit.log |
Beta Was this translation helpful? Give feedback.
-
|
Weird that it looks to me like buildah and podman would follow the same paths. |
Beta Was this translation helpful? Give feedback.
-
|
For me podman fails at a different point [podman@7bd5880d59f7 /]$ cd ~
[podman@7bd5880d59f7 ~]$ vi Dockerfile
[podman@7bd5880d59f7 ~]$ podman --storage-driver vfs build -t test .
WARN[0000] "/" is not a shared mount, this could cause issues or missing mounts with rootless containers
STEP 1/3: FROM alpine
Resolved "alpine" as an alias (/etc/containers/registries.conf.d/000-shortnames.conf)
Trying to pull docker.io/library/alpine:latest...
Getting image source signatures
Copying blob df9b9388f04a done
Copying config 0ac33e5f5a done
Writing manifest to image destination
Storing signatures
STEP 2/3: USER root
--> aced8c862a8
STEP 3/3: RUN touch hello
error running container: error from /usr/bin/crun creating container for [/bin/sh -c touch hello]: remount `/var/tmp/buildah003021833/mnt/rootfs`: Permission denied
: exit status 1
Error: error building at STEP "RUN touch hello": error while running runtime: exit status 1 |
Beta Was this translation helpful? Give feedback.
-
|
Looks like podman has regressed somewhere or something is done differently in podman, regression persists on older versions as well but not on older buildah versions Podman
Buildah
|
Beta Was this translation helpful? Give feedback.
-
|
@rhatdan I don't have any /var/log/audit folder |
Beta Was this translation helpful? Give feedback.
-
|
Anyway my original issue when I run podman on a container in Openshift is different, and it happens even if I add the --uts=host |
Beta Was this translation helpful? Give feedback.
-
@GolanTrevize10 I see but does this discrepancy also exists with using |
Beta Was this translation helpful? Give feedback.
-
|
@flouthoc I tried with buildah instead of podman and same error |
Beta Was this translation helpful? Give feedback.
-
|
How are you running within OpenShift? You need multiple UIDs to run a build, which OpenSHift does not give by default. You also need either all capabilities or CAP_SETUID and CAP_SETGID. Have you read https://www.redhat.com/sysadmin/podman-inside-kubernetes? |
Beta Was this translation helpful? Give feedback.
-
|
Yes, we have multiple UIDs. It only fails with that image. With other images it works. |
Beta Was this translation helpful? Give feedback.
-
|
Most likely you have a UID in that image, that is greater the the list of UIDs available. |
Beta Was this translation helpful? Give feedback.
-
|
But I am not running chown, just switching to root user and running a sed command |
Beta Was this translation helpful? Give feedback.
-
|
Pulling the image is causing a chown. |
Beta Was this translation helpful? Give feedback.
-
|
No, the sed step is causing the chown error |
Beta Was this translation helpful? Give feedback.
-
|
Converting to a conversation, at this point. |
Beta Was this translation helpful? Give feedback.
-
Description
I am building a docker image using rootless podman running inside a kubernetes container. The dockerfile contains these instructions
FROM owasp/dependency-check
ARG REGISTRY_USER
ARG REGISTRY_PASS
USER root
RUN sed -i "s|https://dl-cdn.alpinelinux.org/alpine|https://$REGISTRY_USER:$REGISTRY_PASS@xxxxxx/artifactory/public_alpine_org|g" /etc/apk/repositories
But I am getting this error in the sed step
Error: error building at STEP "RUN sed -i "s|https://dl-cdn.alpinelinux.org/alpine|https://$REGISTRY_USER:$REGISTRY_PASS@xxxxxxx/artifactory/public_alpine_org|g" /etc/apk/repositories": error resolving mountpoints for container "fffad1d7e0424f3b7ec7c5d5fbf8f8c19d4835f8eecafa3254f4bfedf10a9843": chown /var/lib/jenkins/jobs/40/.local/share/containers/storage/vfs-containers/fffad1d7e0424f3b7ec7c5d5fbf8f8c19d4835f8eecafa3254f4bfedf10a9843/userdata/buildah-volumes/8cc63f97e8c58d7c5c77d045c486c19c3ac8ef8dfc50a682653175b1121a9e4d: operation not permitted
Output of
rpm -q buildahorapt list buildah:Output of
podman versionif reporting apodman buildissue:Output of
cat /etc/*release:Output of
uname -a:Output of
cat /etc/containers/storage.conf:Beta Was this translation helpful? Give feedback.
All reactions