Option --userns auto is ignored in podman pod create #27770
-
|
I'm trying to create a pod with userns=auto in rootless mode. According to the documentation, this should work. But on Debian 13 (stable) with Podman 5.4.2 it just doesn't. The pod is started without any error, but podman pod inspect shows "userns": "host" and the containers that join the pod do indeed have the expected mapping of userns=host, i.e. root inside the container is mapped to my user on the host. If I use userns=keep-id,however, that seems to be honored - so it's just the auto value, that doesn't work. I tried creating the pod in two ways, first with a quadlet file and also manually on the command line with I also set the logging level to verbose to see if anything strange shows up that would explain this, but no. It's as if the option is just silently ignored. Please note that this only affects pods and member containers. For other containers that are not part of any pod and run individually, the userns=auto option works absolutely fine. It's just with pods, that I encounter this issue. And to be clear, I'm not using the userns option on the containers that are supposed to join the pod. I know (and intend) that they share the namespace of the pod. But as the example shows, userns=auto doesn't even work with an "empty" pod. |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 1 reply
-
|
Ok, a quick update. It turns out that |
Beta Was this translation helpful? Give feedback.
Sorry for the noise - there is no issue. I tried it again with a new user and then everything worked fine even on my Debian system (i.e. the containers in the pod have the correct uid mapping applied with userns=auto). After restarting the system I also cannot reproduce the issue anymore even with the original user. So, I can only assume that there was an issue with the state of the pods and containers that made this seem like a bug (like the pod being stopped/removed properly before testing different userns settings) - I don't know. But it's solved now and works as expected.