opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-06-28 06:18:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #10194 from rhatdan/docs

Browse Source 
[CI:DOCS] Fix troubleshooting documentation on handling supplemental groups.
This commit is contained in:
OpenShift Merge Robot
2021-05-03 22:46:30 +02:00
committed by GitHub
parent af8943a620 65b62cca04
commit 9788289f94
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
troubleshooting.md
View File

@ -495,10 +495,10 @@ $ podman unshare cat /proc/self/uid_map
Reference [subuid](http://man7.org/linux/man-pages/man5/subuid.5.html) and [subgid](http://man7.org/linux/man-pages/man5/subgid.5.html) man pages for more detail. Reference [subuid](http://man7.org/linux/man-pages/man5/subuid.5.html) and [subgid](http://man7.org/linux/man-pages/man5/subgid.5.html) man pages for more detail.
### 20) Passed-in device can't be accessed in rootless container ### 20) Passed-in devices or files can't be accessed in rootless container
As a non-root user you have group access rights to a device that you want to As a non-root user you have group access rights to a device or files that you
pass into a rootless container with `--device=...`. want to pass into a rootless container with `--device=...` or `--volume=...`
#### Symptom #### Symptom
@ -507,9 +507,9 @@ Any access inside the container is rejected with "Permission denied".
#### Solution #### Solution
The runtime uses `setgroups(2)` hence the process looses all additional groups The runtime uses `setgroups(2)` hence the process looses all additional groups
the non-root user has. If you use the `crun` runtime, 0.10.4 or newer, the non-root user has. Use the `--group-add keep-groups` flag to pass the
then you can enable a workaround by adding `--annotation io.crun.keep_original_groups=1` user's supplementary group access into the container. Currently only available
to the `podman` command line. with the `crun` OCI runtime.
### 21) A rootless container running in detached mode is closed at logout ### 21) A rootless container running in detached mode is closed at logout