Documentation/experience on rootless containers?

[nicholasjng]

Hello! I'm currently looking for ways to build Linux wheels as a non-root user with cibuildwheel in GitHub Actions.

The docs mention that podman is the available alternative container engine for people looking to build using rootless containers, but there is no "official" cibuildwheel example config/snippet on this with GHA. I researched a little bit, and it does not look straightforward to produce these containers.

Does anyone have experience using rootless containers in GH Actions? I'll continue researching in the meantime, and if I get somewhere, I'm of course open to contribute a working setup demo if there is interest.

PS: I tried with CIBW_CONTAINER_ENGINE: "docker; create_args: --user 1001", but that fails in the OCIContainer start due to lack of permissions to use mkdir:

cibuildwheel/cibuildwheel/oci_container.py

Lines 185 to 189 in 9cf99e7

	if self.cwd:
	# Although `docker create -w` does create the working dir if it
	# does not exist, podman does not. There does not seem to be a way
	# to setup a workdir for a container running in podman.
	self.call(["mkdir", "-p", os.fspath(self.cwd)], cwd="/")

[joerick]

Why do you want to run as non-root in GitHub Actions? I think the default runners give you root anyway. Or, maybe you're running on a self-hosted runner?

I'll also ping @Erotemic who contributed the podman support and seems to know a lot more about containers than me!

[nicholasjng]

I get that it's a bit of an odd request - I'm building C++ extensions with Bazel inside the container, and one of my dependencies does not allow building as root (TL,DR: it has to do with caching and the creation of .pyc files in a hermetic Python interpreter), a practice which has been criticized by users.

For that reason, I was exploring a little bit on GitHub Actions, but rootless mode seems out of scope there. I work around this by patching my build file when I detect that I'm on cibuildwheel in Linux (a little hacky, but eh), so I'm not blocked in any way.

[Erotemic]

When using podman you still are root inside the container by default. The use-case for podman is when you are not root in the environment where CI is running. From what I understand, podman can be setup and run without a superuser needing to install or configure things. This is unlike docker where there at least needs to be a superuser to add you to the docker group.

Also my knowledge of containers is mostly limited to cases where I've used them in a workflow. I can use them, but I'm not an expert.

For what it's worth, I think being able to run as a non-root user inside of a container is a good idea. I like replicating what the out-of-container user-experience would be inside of containers. However, I've also found this to be a pain with both docker and podman, so my idea of purity has yielded to practicality.

I'm wondering if the lack of permissions to use mkdir could be worked around by creating the directory inside of the user's home? Then maybe your create_args: --user 1001 hack would work?

[nicholasjng]

Thanks, I can completely understand that. Your comment matches my findings, apparently the "podman = rootless" way of thinking indeed requires that the runtime be started in rootless mode.

Regarding the mkdir, I'm not sure. On one hand, with your proposed change, I would probably get past that line, but in the oci_container.py alone there are multiple mkdir and copy operations, which might be working on privileged locations.

It's not that high on my list anymore, since I've worked around it as mentioned, but if there's interest in exploring rootless containers from the cibuildwheel side, I'll mark this down to revisit in the future.

[joerick]

The paths /project and /output are hard-coded in cibuildwheel, and I think many users have got those paths written into their build scripts, so it's not going to be simple for us to change it.

Anyway, it's a pretty esoteric situation. Pleased you got something working.