Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Rootless Container Image Unpacking Fails With EACCESS

Aperta
  • Qualcosa non va?
#849 0 commenti 1 reazione 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 2 giorni

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
43/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
rust
Ambito
infrastructure

Direzione di ricerca

Start by reproducing the nested rootless podman pull failure with the provided podman/krun command, then compare behavior when the graph root is on virtiofs versus tmpfs. The issue names no repository files or tests, so first trace how libkrun handles virtiofs permissions during layer unpacking. Done means identifying whether libkrun causes the EACCES and documenting or fixing the confirmed cause.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

I was trying to run rootless podman inside a podman + krun guest, but was unable to podman pull images. They would fail with:

Error: copying system image from manifest list: writing blob: adding layer with blob "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4"/""/"sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c": unpacking failed (error: exit status 1; output: setting up pivot dir: mkdir ./.pivot_root4119440341: permission denied

With EACCESS; from strace:

[pid  1373] mkdirat(AT_FDCWD, "/home/nlordell/.local/share/containers/storage/overlay/34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c/diff", 0555) = 0
...
[pid  1378] mkdirat(AT_FDCWD, "./.pivot_root1142747937", 0700) = -1 EACCES (Permission denied)

A minimal reproducer assuming podman and crun-krun on the host:

podman run --runtime=krun -it --rm debian:13 bash -c "
apt-get update && apt-get install -y podman
podman pull alpine                     # works
useradd -m -U myuser
su -c 'podman pull alpine' - myuser    # fails
"

It appears to be an issue with using a podman graph-root on a virtiofs filesystem as an unprivileged user. If I use, for example, --root /dev/shm/... (which is tmpfs) then everything works.

As a workaround, I was able to loop-mount a disk image in the container itself to get podman to work:

sudo truncate -s 20G /var/lib/podman-storage.img
sudo mkfs.ext4 /var/lib/podman-storage.img
sudo mkdir -p /mnt/podman-storage
sudo mount -o loop /var/lib/podman-storage.img /mnt/podman-storage
sudo install -d -o myuser -g myuser /mnt/podman-storage/container
podman pull --root /mnt/podman-storage/container alpine

In chatting with an LLM, it told be very confidently that:

The overlay and vfs drivers create the layer's diff directory mode 0555 and rely on CAP_DAC_OVERRIDE to write into it. Capabilities are not part of the FUSE protocol — a request carries only uid/gid — so the FUSE server re-evaluates the DAC check as the unprivileged uid and denies the write.

But do not have the know-how or understanding to evaluate whether or not it is accurate. Including it here in case it helps narrow down the issue. I am also not sure whether or not this is actually a libkrun issue, and I really don't have much understanding about how the whole podman, crun, libkrun interact, but looking through the issues in this repo it felt like it was a reasonable place to report it (as it appears to be a virtiofs related issue). Please let me know if I should move this issue elsewhere.

Lingua principale
Rust
Stelle
2.8k
Fork
279
Merge medio
3g 17h
PR unite (30g)
22

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di libkrun/libkrun

Tutte le issue di libkrun/libkrun

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.