containers / containers/toolbox
Nested rootless podman is dangerous for rootless host podman
- Dominant language
- Go
- Stars
- 3.5k
- Forks
- 262
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 1
Description
**Describe the bug**
As-is, toolbox currently maps all of the home directory to the running container. This is dangerous for nested podman. If settings are modified for ~/.config/containers, it can modify the host environment. I am unsure of the exact effects of downloading images with rootless podman; however, I can assume that they would also pollute the host.
This issue is of particular concern as it can cause Fedora Silverblue toolbox to break which seems to be counter to the goal of an "immutable" OS like Silverblue.
**Steps how to reproduce the behaviour**
1. Enter a toolbox container
2. Setup rootless podman in the container
3. Use rootless podman in the container
**Expected behaviour**
I am unsure of the expected behavior here. I would assume that it is best to isolate the particular local folders used by podman to allow for safe nested rootless podman.
**Actual behaviour**
No isolation of rootless podman
**Screenshots**
If applicable, add screenshots to help explain your problem.
**Output of `toolbox --version` (v0.0.90+)**
0.0.99.3
**Toolbox package info (`rpm -q toolbox`)**
`toolbox-0.0.99.3-2.fc35.x86_64`
**Output of `podman version`**
```
Version: 3.4.4
API Version: 3.4.4
Go Version: go1.16.8
Built: Wed Dec 8 16:45:07 2021
OS/Arch: linux/amd64
```
**Podman package info (`rpm -q podman`)**
`podman-3.4.4-1.fc35.x86_64`
**Info about your OS**
Fedora Silverblue 35
Contributor guide
Assessment
This issue has not been assessed yet.