[Bug]: podman uidmapping and gidmapping with an idmapped volume #17433
Description
Issue Description
Under Debian SID, the podman uidmapping and gidmapping with an idmapped volume test (test/e2e/run_userns_test.go:118) test fails under root, rootless, and remote scenarios. Note: The all CI Debian VM's are setup to use runc and CgroupsV1 (not the default).
Steps to reproduce the issue
Steps to reproduce the issue
podman --storage-opt vfs.imagestore=/tmp/imagecachedir --root /tmp/podman_test331015218/root --runroot /tmp/podman_test331015218/runroot --runtime runc --conmon /usr/bin/conmon --network-config-dir /etc/containers/networks --network-backend netavark --cgroup-manager systemd --tmpdir /tmp/podman_test331015218 --events-backend file --storage-driver vfs run --uidmap=0:1:500 --gidmap=0:200:5000 -v my-foo-volume:/foo:Z,idmap alpine stat -c #%u:%g# /foo
Describe the results you received
#65534:65534#
Describe the results you expected
#0:0#
podman info output
host:
arch: amd64
buildahVersion: 1.30.0-dev
cgroupControllers:
- cpuset
- cpu
- cpuacct
- blkio
- memory
- devices
- freezer
- net_cls
- perf_event
- net_prio
- hugetlb
- pids
- rdma
- misc
cgroupManager: systemd
cgroupVersion: v1
conmon:
package: conmon_2.1.3+ds1-1_amd64
path: /usr/bin/conmon
version: 'conmon version 2.1.3, commit: unknown'
cpuUtilization:
idlePercent: 12.07
systemPercent: 32.48
userPercent: 55.45
cpus: 2
distribution:
codename: bookworm
distribution: debian
version: "12.03"
eventLogger: journald
hostname: cirrus-task-5015209052471296
idMappings:
gidmap: null
uidmap: null
kernel: 6.1.0-3-cloud-amd64
linkmode: dynamic
logDriver: journald
memFree: 1872896000
memTotal: 4116254720
networkBackend: netavark
ociRuntime:
name: runc
package: runc_1.1.4+ds1-1+b1_amd64
path: /usr/bin/runc
version: |-
runc version 1.1.4+ds1
commit: 1.1.4+ds1-1+b1
spec: 1.0.2-dev
go: go1.19.4
libseccomp: 2.5.4
os: linux
remoteSocket:
exists: true
path: /run/podman/podman.sock
security:
apparmorEnabled: true
capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
rootless: false
seccompEnabled: true
seccompProfilePath: /usr/share/containers/seccomp.json
selinuxEnabled: false
serviceIsRemote: false
slirp4netns:
executable: /usr/bin/slirp4netns
package: slirp4netns_1.2.0-1_amd64
version: |-
slirp4netns version 1.2.0
commit: 656041d45cfca7a4176f6b7eed9e4fe6c11e8383
libslirp: 4.7.0
SLIRP_CONFIG_VERSION_MAX: 4
libseccomp: 2.5.4
swapFree: 0
swapTotal: 0
uptime: 0h 26m 42.00s
plugins:
authorization: null
log:
- k8s-file
- none
- passthrough
- journald
network:
- bridge
- macvlan
volume:
- local
registries:
docker.io:
Blocked: false
Insecure: false
Location: mirror.gcr.io
MirrorByDigestOnly: false
Mirrors: null
Prefix: docker.io
PullFromMirror: ""
docker.io/library:
Blocked: false
Insecure: false
Location: quay.io/libpod
MirrorByDigestOnly: false
Mirrors: null
Prefix: docker.io/library
PullFromMirror: ""
localhost:5000:
Blocked: false
Insecure: true
Location: localhost:5000
MirrorByDigestOnly: false
Mirrors: null
Prefix: localhost:5000
PullFromMirror: ""
search:
- docker.io
- quay.io
- registry.fedoraproject.org
store:
configFile: /usr/share/containers/storage.conf
containerStore:
number: 0
paused: 0
running: 0
stopped: 0
graphDriverName: overlay
graphOptions: {}
graphRoot: /var/lib/containers/storage
graphRootAllocated: 211116445696
graphRootUsed: 7109332992
graphStatus:
Backing Filesystem: extfs
Native Overlay Diff: "true"
Supports d_type: "true"
Using metacopy: "false"
imageCopyTmpDir: /var/tmp
imageStore:
number: 0
runRoot: /run/containers/storage
transientStore: false
volumePath: /var/lib/containers/storage/volumes
version:
APIVersion: 4.5.0-dev
Built: 1675807077
BuiltTime: Tue Feb 7 21:57:57 2023
GitCommit: c048b994b7a8bf69590660d5d0b12267b93aa72f
GoVersion: go1.19.5
Os: linux
OsArch: linux/amd64
Version: 4.5.0-devPodman in a container
No
Privileged Or Rootless
None
Upstream Latest Release
Yes
Additional environment details
This is occurring within an initial integration of Debian SID VMs in podman's CI setup. It's easily and reliably reproducible.
Additional information
Debian GNU/Linux bookworm/sid \n \l
Kernel: 6.1.0-3-cloud-amd64
Cgroups: tmpfs
dpkg-query: no packages found matching containers-common
dpkg-query: no packages found matching cri-o-runc
conmon-2.1.3+ds1-1-amd64
containernetworking-plugins-1.1.1+ds1-3+b1-amd64
criu-3.17.1-2-amd64
crun-1.5+dfsg-1+b1-amd64
golang-2:1.19~1-amd64
libseccomp2-2.5.4-1+b3-amd64
podman-4.3.1+ds1-5+b1-amd64
runc-1.1.4+ds1-1+b1-amd64
skopeo-1.9.3+ds1-1-amd64
slirp4netns-1.2.0-1-amd64