containers / containers/podman-py
userns_mode option is not honoured
- Dominant language
- Python
- Stars
- 381
- Forks
- 140
- Avg merge
- 5h 30m
- Merged PRs (30d)
- 1
Description
Hi,
It seems like userns mode is not honoured by either podman-py or the podman API.
Running podman 4.9.3 on an up-to-date Ubuntu 24.04.1 LTS virtual machine.
```
$ cat /etc/sub{uid,gid}
[some random username]:100000:65536
containers:2147483647:2147483648
[some random username]:100000:65536
containers:2147483647:2147483648
```
When creating and running the same exact container with `podman-py` and with the Podman CLI, it is apparent that in the former case the `userns_mode='auto'` option is not honoured.
I attach this test case which shows the issue clearly: https://gist.github.com/vmsh0/f32b137b6d4bf1d3dbf5b6745e92911c
One unit test creates a container using `podman-py`: the test fails as after inspecting the container you can see that `UsernsMode` is empty. The other unit test creates the same container by calling the podman CLI: in this case, the test succeeds and you can see that `UsernsMode` is set to `'private'` as expected.
As far as I can see, this fails silently. I noticed the issue by pure chance while investigating a different problem. This might potentially have security implications, as users might be expecting their containers to run in a separate user namespace while they are really running in the root namespace.
Contributor guide
Research direction
Start with the attached gist and its two unit tests, comparing the podman-py container-creation path with the Podman CLI invocation. Trace how userns_mode='auto' is sent through the API and inspect the resulting UsernsMode value. Done means the podman-py case honors the option like the CLI case and the regression tests pass.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100