How to start podman rootless and with user access to app-data/ ?

[alioth9]

Hi, thanks you for the good work.
I don't know if it should go into Issues or if there is something i don't see. Or if it is not possible to do with otterwiki.
I want to build an otterwiki via podman compose rootless and with user permission to rw files in app-data/.
Something like #252 but rootless.

For now, i follow recommandation and add

environment:
        PUID: 1000
        PGID: 1000

to the docker-compose.yml

I am able to access directory as user if i start container as root.
If I start the otterwiki container rootless app-data/ get chown according to subuid/subgid and is not accessible to user.

Previously I manage that use case with dokuwiki (via podman compose) like so in docker-compose.yml (picked somewhere)

services:
    user: "1000:1000"
...
    x-podman.uidmaps:
      - "0:1:1"
      - "${UID:-1000}:0:1"
    x-podman.gidmaps:
      - "0:1:1"
      - "${GID:-1000}:0:1"

or another proposed solution is using userns_mode: keep-id

x-podman:
    in_pod: false
services:
...
    userns_mode: keep-id

in_pod: false is necessary because userns need to disable in-pod.

But in those case the otterwiki is inaccessible and i get errors in logs like

# when trying userns_mode: keep-id
...
chown: changing ownership of '/app-data/db.sqlite': Operation not permitted
chown: changing ownership of '/app-data': Operation not permitted

or

# whith the dokuwiki solution above
...
chown: changing ownership of '/app-data/db.sqlite': Invalid argument
chown: changing ownership of '/app-data': Invalid argument

If someone as manage to have otterwiki running rootless and with user acces to data, could you share the docker-compose file, or podman run ... ? Else. could you give me some hints ?

Hope it is clear, sorry for the long post
Note, I am still quite newb to container and all...

[redimp]

Hey @alioth9,

please provide your complete docker-compose.yaml and some more information, like on which OS you are running podman.

To double check I installed a fresh Fedora 43, installed podman and podman-compose:

sudo dnf install podman podman-compose

I checked the subuid and subgid for my user with

$ grep $USER /etc/subuid; grep $USER /etc/subgid
redimp:524288:65536
redimp:524288:65536

created a directory otterwiki-podman-rootless with a compose.yaml:

services:
  otterwiki:
    image: redimp/otterwiki:2
    restart: unless-stopped
    ports:
      - "8080:80"
    volumes:
      # The :Z suffix is essential for rootless Podman on SELinux systems (Fedora, RHEL)
      - ./app-data:/app-data:Z

Started it up with

podman compose up

and An Otterwiki came up at port 8080 as expected.

The files created in ./app-data had the owner ids in the expected subuid range:

$ ls -al app-data/
total 44
drwxr-xr-x. 3 524320 524320    61 Jan 25 12:26 .
drwxr-xr-x. 3 redimp redimp    42 Jan 25 12:30 ..
-rw-r--r--. 1 524320 524320 40960 Jan 25 12:26 db.sqlite
drwxr-xr-x. 3 524320 524320    33 Jan 25 12:26 repository
-rw-r--r--. 1 524320 524320   156 Jan 25 12:26 settings.cfg

So running An Otter Wiki with rootless podman in general works. Will test how to keep the uid next.

[redimp]

tl;dr: Running An Otter Wiki rootless with podman while using the current user UID in the mounted directory can be run using with the -slim image. Tested with this compose.yaml:

x-podman:
    in_pod: false

services:
  otterwiki:
    image: redimp/otterwiki:2-slim
    userns_mode: keep-id:uid=33,gid=33
    restart: unless-stopped
    ports:
      - "8080:8080"
    volumes:
      # The :Z suffix is essential for rootless Podman on SELinux systems (Fedora, RHEL)
      - ./app-data:/app-data:Z

$ podman compose up -d
$ ls -al app-data
total 44
drwxr-xr-x. 3 redimp redimp    61 Jan 25 13:01 .
drwxr-xr-x. 3 redimp redimp    42 Jan 25 13:02 ..
-rw-r--r--. 1 redimp redimp 40960 Jan 25 13:01 db.sqlite
drwxr-xr-x. 3 redimp redimp    33 Jan 25 13:01 repository
-rw-r--r--. 1 redimp redimp   156 Jan 25 13:01 settings.cfg

The -slim image is running unprivileged with uid 33, it does not use any other uids, it expects the directory and files that it reads and writes to have the same uid, so never runs any chmod or chown. Being unprivileged the pod listens to port 8080.

The full image is running as root, the nginx is listening on port 80 and uses the uid 33 only for the application itself. So mapping the uid is more complicated. If anyone figures this out, please share the solution.

[alioth9]

Thanks for the quick reply
For the information:

• I am on Arch Linux
• no SElinux

So running An Otter Wiki with rootless podman in general works. Will test how to keep the uid next.

Sorry If I was not clear, I have no problem with the base docker-compose.yaml running otterwiki rootless, But then as you pointed app-data get chown according to subuid/subgid, and I want to access the files.

here is my base docker-compose.yaml

version: "3"

services:
  otterwiki:
    image: redimp/otterwiki:2
    restart: unless-stopped
    ports:
        - 8080:80
    volumes:
        - ./app-data:/app-data
    
    environment:
        PUID: 1000
        PGID: 1001

but I also try other parameters

For now I only tried the normal version but I will have a look at -slim

[alioth9]

Tested and -slim seems to work rootless and with user file access.
With this docker-compose.yml

version: "3"
x-podman:
    in_pod: false

services:
  otterwiki:
    image: redimp/otterwiki:2-slim
    restart: unless-stopped
    ports:
        - 8080:8080
    volumes:
        - ./app-data:/app-data
    userns_mode: keep-id:uid=33,gid=33    

If I may ask a few more questions

What are the drawback with the -slim (if any)?

Also why userns_mode: keep-Id doesn't work with regular container?

Anyway, now I have a working wiki to fill 😁 . Need to try it and will come back if it doesn't works.

[redimp]

Horray 🥳 Thanks for the feedback and sharing your solution!

What are the drawback with the -slim (if any)?

None. There are some environments where running a container with uid=0 is more useful, e.g. when the mounted directory permissions have to be changed.

Also why userns_mode: keep-Id doesn't work with regular container?

As explained above: "The full image is running as root, the nginx is listening on port 80 and uses the uid 33 only for the application itself. So mapping the uid is more complicated."

Let me add some details: The container is running as one user, root (uid=0) that runs chmod and chown commands in /app-data than starts the application as uid=33 which writes /app-data. To make work what you want to achieve you would have to map both ids to your UID. No clue how this would be done.

[alioth9]

Rereading, I saw the explanation, thanks for the added details.

Maybe it would be useful to add some docker-compose.yml example for those different use cases in the docs.
I think particularly a docker-compose.yml based on -slim with explanations for rootless and user access.

x-podman:
    in_pod: false

services:
  otterwiki:
    image: redimp/otterwiki:2-slim
    userns_mode: keep-id:uid=33,gid=33
    restart: unless-stopped
    ports:
      - "8080:8080"
    volumes:
      # The :Z suffix is essential for rootless Podman on SELinux systems (Fedora, RHEL)
      - ./app-data:/app-data:Z