podman in podman

gistfile1.md

rootless podman in rootless podman なら動く(Ubuntu 22.04)。 ただし、ホストに書き込むには podman unshare を使ってコンテナ内のユーザー用にパーミッションを変更する必要がある。

$ echo $UID:$GID
1000:1000
$ podman unshare chown 1000:1000 -R $PWD
$ podman run -it --rm --user podman --device /dev/fuse -v $PWD:/workdir:Z -w /workdir quay.io/podman/stable bash
[podman@328a1796e173 workdir]$ podman run -it --rm -v $PWD:/workdir:Z -w /workdir alpine sh
...
/workdir # touch aaa.txt
/workdir # ls -l
total 0
-rw-r--r--    1 root     root             0 Jul 14 02:49 aaa.txt
/workdir # exit
[podman@328a1796e173 workdir]$ exit
$ ls -l
合計 0
-rw-r--r-- 1 100999 100999 0  7月 14 11:49 aaa.txt

rootful podman in rootless podman は動かない…

$ podman run -it --rm --device /dev/fuse -v $PWD:/workdir:Z -w /workdir quay.io/podman/stable bash
[root@cef508b41df1 workdir]# podman pull alpine
WARN[0000] "/" is not a shared mount, this could cause issues or missing mounts with rootless containers
WARN[0000] Using rootless single mapping into the namespace. This might break some images. Check /etc/subuid and /etc/subgid for adding sub*ids if not using a network user
Resolved "alpine" as an alias (/etc/containers/registries.conf.d/000-shortnames.conf)
Trying to pull docker.io/library/alpine:latest...
Getting image source signatures
Copying blob 530afca65e2e done
Error: writing blob: adding layer with blob "sha256:530afca65e2ea04227630ae746e0c85b2bd1a179379cbf2b6501b49c4cab2ccc": Error processing tar file(exit status 1): potentially insufficient UIDs or GIDs available in user namespace (requested 0:42 for /etc/shadow): Check /etc/subuid and /etc/subgid if configured locally and run podman-system-migrate: lchown /etc/shadow: invalid argument