storage: Document force_mask UID 0 mapping requirement by ipilcher · Pull Request #742 · containers/container-libs

ipilcher · 2026-04-03T17:05:31Z

force_mask doesn't work in rootless mode when the container's UID 0 is mapped to something other than the host UID of the user running the container. This PR adds a note about this requirement to containers-storage.conf.5.md.

Signed-off-by: Ian Pilcher <arequipeno@gmail.com>

TomSweeneyRedHat · 2026-04-03T22:07:58Z

And more importantly, thanks for the PR @ipilcher !

ipilcher · 2026-04-04T13:53:35Z

I seem to have bollixed everything up by hitting GitHub's "Commit suggestion" button.

EDIT: I think I managed to fix it.

Signed-off-by: Ian Pilcher <arequipeno@gmail.com> Co-authored-by: Tom Sweeney <tsweeney@redhat.com>

mtrmac

Thanks! This looks plausible but I’d prefer a LGTM from @giuseppe .

mtrmac · 2026-04-09T18:09:45Z

 "force_mask"  permissions.

- When force_mask is used in rootless mode with explicit UID mappings (e.g., `--uidmap`), the container's UID 0 must map to the host user's UID.  fuse-overlayfs (see "mount_program" below) creates a FUSE mount that that is only accessible to the user who created it (the user running podman in this case).  If UID 0 within the container is mapped to a different host UID (such as a subordinate UID from /etc/subuid), the OCI runtime (which runs in the user namespace) will not be able to access the FUSE mount.
+- When force_mask is used in rootless mode with explicit UID mappings (e.g., `--uidmap`), the container's UID 0 must map to the host user's UID.  The fuse-overlayfs (see "mount_program" below) storage driver creates a FUSE mount accessible only to the user who created it (the user running podman in this case).  If UID 0 within the container is mapped to a different host UID (such as a subordinate UID from /etc/subuid), the OCI runtime (which runs in the user namespace) will not be able to access the FUSE mount.


fuse-overlayfs is a filesystem implementation, not a “storage driver” in the c/storage sense (overlay/vfs/btrfs). Maybe “filesystem”? “process”? Or revert to the previous version, which can be ambiguous about what exactly the thing is?

giuseppe

The fuse-overlayfs process doesn't run inside the nested user namespace.

What error are you seeing?

ipilcher · 2026-04-10T15:28:05Z

The fuse-overlayfs process doesn't run inside the nested user namespace.

What error are you seeing?

I see an error if I map UID 0 to a subuid.

$ podman run --rm -it \
        \
        --uidmap 0:@500100 \
        --uidmap 42:@500101 \
        --uidmap 499:@500102 \
        \
        --gidmap 0:@500100 \
        --gidmap 4:@500101 \
        --gidmap 5:@500102 \
        --gidmap 8:@500103 \
        --gidmap 42:@500104 \
        --gidmap 43:@500105 \
        --gidmap 50:@500106 \
        --gidmap 499:@500107 \
        \
        docker.io/library/debian:bookworm-slim \
        /bin/sh
Error: crun: open `/var/tmp/intermediate-mountpoint-1000.0/etc/hosts`: No such file or directory: OCI runtime attempted to invoke a command that was not found

If I map UID 0 to the UID of the user running podman, it works.

$ podman run --rm -it \
        \
        --uidmap 0:@1000 \
        --uidmap 42:@500101 \
        --uidmap 499:@500102 \
        \
        --gidmap 0:@500100 \
        --gidmap 4:@500101 \
        --gidmap 5:@500102 \
        --gidmap 8:@500103 \
        --gidmap 42:@500104 \
        --gidmap 43:@500105 \
        --gidmap 50:@500106 \
        --gidmap 499:@500107 \
        \
        docker.io/library/debian:bookworm-slim \
        /bin/sh
# whoami
root

giuseppe · 2026-04-10T16:45:03Z

Is it enough that the user is mapped into the user namespace (any id, not necessarily root)?

ipilcher · 2026-04-10T17:07:35Z

Is it enough that the user is mapped into the user namespace (any id, not necessarily root)?

It doesn't appear to be.

$ podman run --rm -it \
        \
        --uidmap 0:@500100 \
        --uidmap 42:@500101 \
        --uidmap 499:@1000 \
        \
        --gidmap 0:@500100 \
        --gidmap 4:@500101 \
        --gidmap 5:@500102 \
        --gidmap 8:@500103 \
        --gidmap 42:@500104 \
        --gidmap 43:@500105 \
        --gidmap 50:@500106 \
        --gidmap 499:@500107 \
        \
        docker.io/library/debian:bookworm-slim \
        /bin/sh
Error: crun: open `/var/tmp/intermediate-mountpoint-1000.0/etc/hosts`: No such file or directory: OCI runtime attempted to invoke a command that was not found

giuseppe · 2026-04-13T08:46:56Z

what podman version are you using?

Your command works on my Fedora Rawhide:

 cat ~/.config/containers/storage.conf  | grep -E -v '^(#|$)'
[storage]
driver = "overlay"
[storage.options]
additionalimagestores = [
]
[storage.options.pull_options]
[storage.options.overlay]
mount_program = "/usr/bin/fuse-overlayfs"
mountopt = "nodev,metacopy=on"
force_mask = "000"

$ podman run --rm -it \
        \
        --uidmap 0:@100100 \
        --uidmap 42:@100101 \
        --uidmap 499:@100102 \
        \
        --gidmap 0:@100100 \
        --gidmap 4:@100101 \
        --gidmap 5:@100102 \
        --gidmap 8:@100103 \
        --gidmap 42:@100104 \
        --gidmap 43:@100105 \
        --gidmap 50:@100106 \
        --gidmap 499:@100107 \
        \
        docker.io/library/debian:bookworm-slim \
        /bin/sh
#

I think we should treat this as an issue, and figure out why it doesn't work for you instead of documenting it

ipilcher · 2026-04-13T14:38:15Z

what podman version are you using?

I am running podman-5.8.1-1.fc43.x86_64 on Fedora 43.

Your command works on my Fedora Rawhide:

Interesting!

I think we should treat this as an issue, and figure out why it doesn't work for you instead of documenting it

I have created #764.

ipilcher · 2026-04-21T15:49:22Z

@giuseppe

As requested, I opened #764. It's been sitting there for a week now with no response. How should I proceed?

giuseppe · 2026-04-21T16:31:30Z

Someone needs to look at it, so far nobody got to it. Are you interested to work on it?

ipilcher · 2026-04-21T17:09:06Z

Someone needs to look at it, so far nobody got to it. Are you interested to work on it?

I don't understand what you're asking. I'm more than happy to help investigate what is going on, but I don't have the knowledge of the code base to figure it out on my own.

giuseppe · 2026-04-22T09:12:09Z

sorry for not being clear. The point I was trying to make is that there is no promise with an open source project that someone is going to look at it quickly.

It is an issue because we should expect it to work and not just document it is broken (as this PR does), so I think we should close this PR and wait that someone is going to dig into it.

ipilcher · 2026-04-22T14:34:19Z

Turns out this was a bug/limitation in fuse-overlayfs.

storage: Document force_mask UID 0 mapping requirement

a6c6d77

Signed-off-by: Ian Pilcher <arequipeno@gmail.com>

github-actions Bot added the storage Related to "storage" package label Apr 3, 2026

TomSweeneyRedHat reviewed Apr 3, 2026

View reviewed changes

Comment thread storage/docs/containers-storage.conf.5.md Outdated

Update storage/docs/containers-storage.conf.5.md

526cbe9

Signed-off-by: Ian Pilcher <arequipeno@gmail.com> Co-authored-by: Tom Sweeney <tsweeney@redhat.com>

ipilcher force-pushed the force_mask_uidmap_doc branch from 011492b to 526cbe9 Compare April 4, 2026 14:23

mtrmac reviewed Apr 9, 2026

View reviewed changes

giuseppe requested changes Apr 10, 2026

View reviewed changes

ipilcher requested a review from giuseppe April 10, 2026 15:29

ipilcher closed this Apr 22, 2026

Conversation

ipilcher commented Apr 3, 2026

Uh oh!

Uh oh!

TomSweeneyRedHat commented Apr 3, 2026

Uh oh!

ipilcher commented Apr 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mtrmac left a comment

Choose a reason for hiding this comment

Uh oh!

mtrmac Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

giuseppe left a comment

Choose a reason for hiding this comment

Uh oh!

ipilcher commented Apr 10, 2026

Uh oh!

giuseppe commented Apr 10, 2026

Uh oh!

ipilcher commented Apr 10, 2026

Uh oh!

giuseppe commented Apr 13, 2026

Uh oh!

ipilcher commented Apr 13, 2026

Uh oh!

ipilcher commented Apr 21, 2026

Uh oh!

giuseppe commented Apr 21, 2026

Uh oh!

ipilcher commented Apr 21, 2026

Uh oh!

giuseppe commented Apr 22, 2026

Uh oh!

ipilcher commented Apr 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

ipilcher commented Apr 4, 2026 •

edited

Loading