3 ms·

That’s fine until you need to actually write to NFS/GPFS.

• mroche 6y ago
  Words might not be clicking with me today, I’m trying to specifically decipher this part: > but that will actually work just fine if you stay as root inside the container, which maps to your uid outside the container The context of the statement isn’t clicking with me. You start with “it’s a problem with these filesystems” which I’m on board with but then follow with “but it’s fine if you do this” and I’m not seeing the correct correlation.
  • prpl 6y ago
    With user namespaces you can get different uids inside the container. They are usually mapped to something above 65535, in blocks of 65535, according to /etc/subuid. When you run as rootless on podman with uid=1000, you end up at 66535, or 1000 above your start range in /etc/subuid, for example. This is what NFS/GPFS doesn’t like. Locally, in other file systems on the node, it’s fine. When you run as uid=0 in same the container, you are actually mapped to your uid, since the range starts to be applicable for uid=1. If you can stay as root, you can write to NFS/GPFS just fine. The issue with this is that lots of available containers have moved away from using things as root. For example, you couldn’t start the vanilla redis container with a data directory on NFS for snapshots because redis runs as user 999.
    • mroche 6y ago
      > When you run as uid=0 in same the container, you are actually mapped to your uid, since the range starts to be applicable for uid=1. If you can stay as root, you can write to NFS/GPFS just fine. Oh oh oh, you were just saying run the container as root, like literally. That’s what threw me off, because I was in the mindset of rootless. Wasn’t allowing myself to think outside of that environment. Sorry for the confusion on that. Long day yesterday.