containers / containers/podman-py

userns_mode option is not honoured

Open
#493 5 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
381
Forks
140
Avg merge
5h 30m
Merged PRs (30d)
1

Description

Hi,

It seems like userns mode is not honoured by either podman-py or the podman API.

Running podman 4.9.3 on an up-to-date Ubuntu 24.04.1 LTS virtual machine.

```
$ cat /etc/sub{uid,gid}
[some random username]:100000:65536
containers:2147483647:2147483648
[some random username]:100000:65536
containers:2147483647:2147483648
```

When creating and running the same exact container with `podman-py` and with the Podman CLI, it is apparent that in the former case the `userns_mode='auto'` option is not honoured.

I attach this test case which shows the issue clearly: https://gist.github.com/vmsh0/f32b137b6d4bf1d3dbf5b6745e92911c

One unit test creates a container using `podman-py`: the test fails as after inspecting the container you can see that `UsernsMode` is empty. The other unit test creates the same container by calling the podman CLI: in this case, the test succeeds and you can see that `UsernsMode` is set to `'private'` as expected.

As far as I can see, this fails silently. I noticed the issue by pure chance while investigating a different problem. This might potentially have security implications, as users might be expecting their containers to run in a separate user namespace while they are really running in the root namespace.

Contributor guide

Open the contributing guide

Research direction

Start with the attached gist and its two unit tests, comparing the podman-py container-creation path with the Podman CLI invocation. Trace how userns_mode='auto' is sent through the API and inspect the resulting UsernsMode value. Done means the podman-py case honors the option like the CLI case and the regression tests pass.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.