opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-05-22 09:36:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

docs: add workaround for --device with rootless containers

Browse Source 
Fixes #4477

Signed-off-by: Stefan Becker <chemobejk@gmail.com>
This commit is contained in:
Stefan Becker
2019-11-10 15:07:43 +02:00
parent 11621836df
commit aec62d2862
4 changed files with 29 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docs/source/markdown/podman-build.1.md
View File

@ -176,6 +176,10 @@ value can be entered. The password is entered without echo.
Add a host device to the container. The format is `<device-on-host>[:<device-on-container>][:<permissions>]` (e.g. --device=/dev/sdc:/dev/xvdc:rwm) Add a host device to the container. The format is `<device-on-host>[:<device-on-container>][:<permissions>]` (e.g. --device=/dev/sdc:/dev/xvdc:rwm)
Note: if the user only has access rights via a group then accessing the device
from inside a rootless container will fail. The `crun` runtime offers a
workaround for this by adding the option `--annotation io.crun.keep_original_groups=1`.
**--disable-compression, -D** **--disable-compression, -D**
Don't compress filesystem layers when building the image unless it is required Don't compress filesystem layers when building the image unless it is required

4
docs/source/markdown/podman-create.1.md
View File

@ -204,6 +204,10 @@ Specify the key sequence for detaching a container. Format is a single character
Add a host device to the container. The format is `<device-on-host>[:<device-on-container>][:<permissions>]` (e.g. --device=/dev/sdc:/dev/xvdc:rwm) Add a host device to the container. The format is `<device-on-host>[:<device-on-container>][:<permissions>]` (e.g. --device=/dev/sdc:/dev/xvdc:rwm)
Note: if the user only has access rights via a group then accessing the device
from inside a rootless container will fail. The `crun` runtime offers a
workaround for this by adding the option `--annotation io.crun.keep_original_groups=1`.
**--device-read-bps**=*path* **--device-read-bps**=*path*
Limit read rate (bytes per second) from a device (e.g. --device-read-bps=/dev/sda:1mb) Limit read rate (bytes per second) from a device (e.g. --device-read-bps=/dev/sda:1mb)

4
docs/source/markdown/podman-run.1.md
View File

@ -210,6 +210,10 @@ Specify the key sequence for detaching a container. Format is a single character
Add a host device to the container. The format is `<device-on-host>[:<device-on-container>][:<permissions>]` (e.g. --device=/dev/sdc:/dev/xvdc:rwm) Add a host device to the container. The format is `<device-on-host>[:<device-on-container>][:<permissions>]` (e.g. --device=/dev/sdc:/dev/xvdc:rwm)
Note: if the user only has access rights via a group then accessing the device
from inside a rootless container will fail. The `crun` runtime offers a
workaround for this by adding the option `--annotation io.crun.keep_original_groups=1`.
**--device-read-bps**=*path* **--device-read-bps**=*path*
Limit read rate (bytes per second) from a device (e.g. --device-read-bps=/dev/sda:1mb) Limit read rate (bytes per second) from a device (e.g. --device-read-bps=/dev/sda:1mb)

18
troubleshooting.md
View File

@ -468,4 +468,20 @@ $ podman unshare cat /proc/self/uid_map
1 100000 65536 1 100000 65536
``` ```
Reference [subuid](http://man7.org/linux/man-pages/man5/subuid.5.html) and [subgid](http://man7.org/linux/man-pages/man5/subgid.5.html) man pages for more detail. Reference [subuid](http://man7.org/linux/man-pages/man5/subuid.5.html) and [subgid](http://man7.org/linux/man-pages/man5/subgid.5.html) man pages for more detail.
### 20) Passed-in device can't be accessed in rootless container
As a non-root user you have group access rights to a device that you want to
pass into a rootless container with `--device=...`.
#### Symptom
Any access inside the container is rejected with "Permission denied".
#### Solution
The runtime uses `setgroups(2)` hence the process looses all additional groups
the non-root user has. If you use the `crun` runtime, 0.10.4 or newer,
then you can enable a workaround by adding `--annotation io.crun.keep_original_groups=1`
to the `podman` command line.