Podman: automatic `--userns=keep-id` breaks containers using host networking
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 68/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- typescript
Research direction
Start in src/spec-node/singleContainer.ts at getPodmanArgs(), then compare how runArgs and --network=host are incorporated into the generated Podman command. Use the Alpine reproducer from the issue to verify the conflicting arguments, and confirm that an explicit user choice can prevent the failing automatic combination.
Written by the indexing model from the issue text.
Description
I'm facing an issue when using podman and --network=host combination:
Environment
@devcontainers/cli: 0.88.0- Podman client/server: 5.7.1
- Host: WSL2
- Podman server: rootful
Problem
For Podman on Linux and a non-root remoteUser, Dev Containers automatically adds:
--security-opt label=disable --userns=keep-id
See https://github.com/devcontainers/cli/issues/1004 and https://github.com/microsoft/vscode-remote-release/issues/10399.
When the configuration also requires --network=host, the container fails to start.
Minimal underlying reproducer
This fails:
podman run --rm \
--network=host \
--userns=keep-id \
docker.io/library/alpine:3.20 \
true
Error:
crun: mount `sysfs` to `sys`: Operation not permitted: OCI permission denied
Without --userns=keep-id, it succeeds:
podman run --rm \
--network=host \
docker.io/library/alpine:3.20 \
true
The CLI-generated podman run command contains both:
--userns=keep-id --network=host
The automatic argument is added in:
src/spec-node/singleContainer.ts
getPodmanArgs()
Expected behavior
Users must be able to prevent the CLI from adding --userns=keep-id.
Possible fixes
No one is perfect I'm afraid.
- Do not add
--userns=keep-idwhen--network=hostis present. - Add a setting or CLI option to disable automatic Podman arguments.
- Respect an explicit
--userns=...inrunArgsand do not add--userns=keep-id. - Make automatic
--userns=keep-idopt-in instead of unconditional for non-root users.
Big thanks.
- Dominant language
- TypeScript
- Stars
- 3k
- Forks
- 461
- Avg merge
- 18m
- Merged PRs (30d)
- 5
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from devcontainers/cli
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
devcontainers/cli#1203 ·
-
Difficulty 1/5 1-3 hours Newbie friendliness 68/100
devcontainers/cli#1178 · 1 comment ·
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
devcontainers/cli#1308 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 78/100
devcontainers/cli#1307 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 55/100
devcontainers/cli#1305 ·
All issues in devcontainers/cli
Similar issues
-
clawsweeper:linked-pr-open clawsweeper:no-new-fix-pr clawsweeper:source-repro impact:message-loss issue-rating: 🦞 diamond lobster maturity:stable P2
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Eynzof/Hermes-CN-Desktop#616 ·
-
ZCode 3.14.3 に対応する Open
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
supermomonga/zcode-acp#24 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
growthbook/growthbook#7100 ·
-
triage
Difficulty 1/5 1-3 hours Newbie friendliness 88/100