Older Toolbx Containers fail to run with crun >= 1.8.2
- Dominant language
- C
- Stars
- 4.1k
- Forks
- 444
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 43
Description
### Summary
I encountered an error while testing the backward compatibility of the Toolbx containers. Running older Toolbx containers (created with Toolbx version 0.0.96) fails with newer versions of `crun` (starting from version 1.8.2).
### Error
```
Error: crun: chown `/dev/pts/N`: Operation not permitted: OCI permission denied
```
### Steps to Reproduce
Reproduced using Podman on **Fedora 39 Workstation** with **Podman version 4.7.0** to ensure compatibility with older crun versions.
1. Create a container:
```bash
podman create --name toolbox-container-old --userns=keep-id --user root:root --volume /dev:/dev:rslave registry.fedoraproject.org/fedora:42 sleep 5m
```
2. Start the container:
```bash
podman start toolbox-container-old
```
3. Attempt to execute a command:
```bash
podman exec --tty --user 1000 toolbox-container-old pwd
```
- This results in the mentioned error when using **crun 1.8.2** (`crun-1.8.2-2.fc39.x86_64.rpm`).
- However, this sequence **works as expected with crun 1.8.1** (`crun-1.8.1-1.fc39.x86_64.rpm`).
### System Information
- **OS:** Fedora 39 Workstation ([Fedora 39 ISO](https://archives.fedoraproject.org/pub/archive/fedora/linux/releases/39/Workstation/x86_64/iso/))
- **Podman version:** 4.7.0 (4.7.0-1.fc39.x86_64)
- **crun versions tested:**
- 1.8.1 (1.8.1-1.fc39.x86_64) -> works
- 1.8.2 (1.8.2-2.fc39.x86_64) -> fails
I used Fedora 39 Workstation to ensure having a version of podman old enough, compatible with older versions of crun.
### Related Discussions
This regression appears to be related to [containers/crun#1159](https://github.com/containers/crun/pull/1159). The issue was previously discussed in [containers/crun#1158](https://github.com/containers/crun/issues/1158):
> Is it possible that `podman exec --tty --user $UID ...` stopped working due to [#1159](https://github.com/containers/crun/pull/1159), unless the container was created with `--mount type=devpts,destination=/dev/pts`? Is that expected?
>
> I was trying not have the separate `devpts` to see if it helps with [containers/toolbox#568](https://github.com/containers/toolbox/issues/568)
### Background
Newer versions of Toolbx now use the following podman create option to avoid this issue:
```bash
--mount type=devpts,destination=/dev/pts
```
However, containers created with older versions (such as Toolbx 0.0.96) did **not** include this mount, resulting in this failure with newer `crun` versions.
Contributor guide
Assessment
This issue has not been assessed yet.