Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cannot run in a rootless container using podman #76

Open
yanjiew1 opened this issue May 24, 2023 · 1 comment
Open

Cannot run in a rootless container using podman #76

yanjiew1 opened this issue May 24, 2023 · 1 comment
Labels
bug Something isn't working

Comments

@yanjiew1
Copy link

Describe the bug
The startup script in dev-variant container assumes that it is not run in a user namespace.
However, it is not true when using a rootless container. When it is run in a rootless container, uid 0 in the container will be mapped to the user who starts the container.

The startup script will try to create a user with uid 0 and the creation will fail with the error message.

useradd: UID 0 is not unique

To Reproduce
Run the dev container using podman as normal user:

podman run -it \
       -v "${HOME}":"${HOME}" -e EDK2_DOCKER_USER_HOME="${HOME}" \
       ghcr.io/tianocore/containers/ubuntu-20-dev:latest /bin/bash

Expected behavior
The container starts successfully and we can see the shell prompt.

Execution environment
Host OS: Ubuntu 22.04
Container Engine: podman version 4.5.0
Podman command run as normal user:

podman run -it \
       -v "${HOME}":"${HOME}" -e EDK2_DOCKER_USER_HOME="${HOME}" \
       ghcr.io/tianocore/containers/ubuntu-20-dev:latest /bin/bash

Additional context
Add any other context about the problem here.

@yanjiew1 yanjiew1 added the bug Something isn't working label May 24, 2023
@osteffenrh
Copy link
Contributor

I can confirm that.

Maybe a check if the uid is already 0 and then skip useradd will do the trick?

osteffenrh added a commit to osteffenrh/edk2-containers that referenced this issue Jun 1, 2023
Don't abort the entrypoint script if the user-id already exists.
This allows using the dev images as root or when using Podman,
which does some user mapping already.

This should fix tianocore#76

Signed-off-by: Oliver Steffen <[email protected]>
osteffenrh added a commit to osteffenrh/edk2-containers that referenced this issue Jun 1, 2023
Don't abort the entrypoint script if the user-id already exists.
This allows using the dev images as root or when using Podman,
which does some user mapping already.

This should fix tianocore#76

Signed-off-by: Oliver Steffen <[email protected]>
osteffenrh added a commit to osteffenrh/edk2-containers that referenced this issue Dec 6, 2023
Don't abort the entrypoint script if the user-id already exists.
This allows using the dev images as root or when using Podman,
which does some user mapping already.

This should fix tianocore#76

Signed-off-by: Oliver Steffen <[email protected]>
osteffenrh added a commit to osteffenrh/edk2-containers that referenced this issue Dec 6, 2023
Don't abort the entrypoint script if the user-id already exists.
This allows using the dev images as root or when using Podman,
which does some user mapping already.

See issue tianocore#76 and PR tianocore#77.

Signed-off-by: Oliver Steffen <[email protected]>
osteffenrh added a commit to osteffenrh/edk2-containers that referenced this issue Dec 6, 2023
Don't abort the entrypoint script if the user-id already exists.
This allows using the dev images as root or when using Podman,
which does some user mapping already.

See issue tianocore#76 and PR tianocore#77.

Signed-off-by: Oliver Steffen <[email protected]>
osteffenrh added a commit that referenced this issue Dec 8, 2023
* Fedora 39: Use Qemu from package repo

Fedora 39 ships Qemu 8. We can use that instead of building it from
source.

Also add Qemu for RiscV.

Signed-off-by: Oliver Steffen <[email protected]>

* Allow using dev image as root

Don't abort the entrypoint script if the user-id already exists.
This allows using the dev images as root or when using Podman,
which does some user mapping already.

See issue #76 and PR #77.

Signed-off-by: Oliver Steffen <[email protected]>

* Readme: Add Fedora 39 image to table

Add links and badges for the Fedora 39 images to the table.

Signed-off-by: Oliver Steffen <[email protected]>

---------

Signed-off-by: Oliver Steffen <[email protected]>
mairudiF added a commit to mairudiF/containers that referenced this issue Mar 2, 2024
* Add Fedora 39 image with gcc13 (tianocore#82)

Added Fedora 39 base image, providing GCC13 and Python 3.12.

Signed-off-by: Chao Li <[email protected]>

* Fedora 39 fixups (tianocore#87)

* Fedora 39: Use Qemu from package repo

Fedora 39 ships Qemu 8. We can use that instead of building it from
source.

Also add Qemu for RiscV.

Signed-off-by: Oliver Steffen <[email protected]>

* Allow using dev image as root

Don't abort the entrypoint script if the user-id already exists.
This allows using the dev images as root or when using Podman,
which does some user mapping already.

See issue tianocore#76 and PR tianocore#77.

Signed-off-by: Oliver Steffen <[email protected]>

* Readme: Add Fedora 39 image to table

Add links and badges for the Fedora 39 images to the table.

Signed-off-by: Oliver Steffen <[email protected]>

---------

Signed-off-by: Oliver Steffen <[email protected]>

* Fedora 39 Build Fixes (tianocore#88)

* Fedora39: Don't use fixed package versions

Specifying version numbers for the packages provided by the Linux
distribution is counterproductive. The available patchlevel versions of a
package can change within a Fedora release. This can breaks image builds
which requires additional manual work. Since the major versions stay
fixed, there should not be any compatibility issues between image
builds. Additionally, bug fixes are picked up automatically.

This patch removes the explicit version numbers from the packages and
installs the default versions instead.

Signed-off-by: Oliver Steffen <[email protected]>

* Fedora 39: Install python-setuptools via pip

Install python-setuptools via pip instead of taking it from the Fedora
repo. This avoids possible conflicts with `pip install --upgrade ...`

Signed-off-by: Oliver Steffen <[email protected]>

---------

Signed-off-by: Oliver Steffen <[email protected]>

---------

Signed-off-by: Chao Li <[email protected]>
Signed-off-by: Oliver Steffen <[email protected]>
Co-authored-by: Chao Li <[email protected]>
Co-authored-by: Oliver Steffen <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants