Podman: automatic `--userns=keep-id` breaks containers using host networking

src/spec-node/singleContainer.ts の getPodmanArgs() から始め、runArgs と --network=host が生成された Podman コマンドにどのように組み込まれるかを比較します。issue にある Alpine の reproducer を使って競合する引数を検証し、ユーザーが明示的に選択すれば、失敗する自動的な組み合わせを防げることを確認します。

I'm facing an issue when using podman and --network=host combination:

Environment

• @devcontainers/cli: 0.88.0
• Podman client/server: 5.7.1
• Host: WSL2
• Podman server: rootful

Problem

For Podman on Linux and a non-root remoteUser, Dev Containers automatically adds:

--security-opt label=disable --userns=keep-id

See https://github.com/devcontainers/cli/issues/1004 and https://github.com/microsoft/vscode-remote-release/issues/10399.

When the configuration also requires --network=host, the container fails to start.

Minimal underlying reproducer

This fails:

podman run --rm \
  --network=host \
  --userns=keep-id \
  docker.io/library/alpine:3.20 \
  true

Error:

crun: mount `sysfs` to `sys`: Operation not permitted: OCI permission denied

Without --userns=keep-id, it succeeds:

podman run --rm \
  --network=host \
  docker.io/library/alpine:3.20 \
  true

The CLI-generated podman run command contains both:

--userns=keep-id --network=host

The automatic argument is added in:

src/spec-node/singleContainer.ts
getPodmanArgs()

Expected behavior

Users must be able to prevent the CLI from adding --userns=keep-id.

Possible fixes

No one is perfect I'm afraid.

1. Do not add --userns=keep-id when --network=host is present.
2. Add a setting or CLI option to disable automatic Podman arguments.
3. Respect an explicit --userns=... in runArgs and do not add --userns=keep-id.
4. Make automatic --userns=keep-id opt-in instead of unconditional for non-root users.

Big thanks.