Re:Podman: A Daemonless Container Engine
by SEJeff on Thursday February 11, 2021 @10:51AM
(#26102879)
You can run podman as root, but it doesn't default to it, for generally sensible security reasons.
Also, docker runs as root, so it won't have permissions problems. You can change the permissions of /dev/fuse if you want to allow podman containers to access it or update the group of the user launching podman.
Re:Podman: A Daemonless Container Engine
by eriksjolund on Thursday February 11, 2021 @05:04PM
(#26108002)
If I understand correctly support
for native rootless mounts is currently under
development:
https://github.com/containers/storage/pull/816
The functionality requires Linux kernel 5.11 (soon to be released)
Re:Podman: A Daemonless Container Engine
by fatherlinnux on Tuesday February 16, 2021 @11:43AM
(#26155786)
That is correct. We're targeting that work for RHEL 8.5 in November-ish, so you'll likely see that drop in Fedora and other Linux distros sooner.
Re:Podman: A Daemonless Container Engine
by stuaxo on Thursday February 11, 2021 @10:46AM
(#26102793)
Are these fuse limitations or fuse-overlayfs limitations ?
Re:Podman: A Daemonless Container Engine
by edwintorok on Thursday February 11, 2021 @01:21PM
(#26105186)
I think FUSE limitations: fuse is served by a single userspace process, which is limited the same way as any other userspace process by ulimit.
It is not a fundamental limitation of podman, just of podman's default rootless behaviour.
There are ways around it: raise the ulimit for your user and run new enough podman to raise limit for fuse-overlayfs, use the 'vfs' driver (it has other perf issues). I heard (but haven't tested yet) that the 'btrfs' driver avoids all these problems and works from userspace. Obviously requires an FS formatted as btrfs...
There are also compatibility issues with Docker. E.g. one container was running sshfs inside Docker just fine, but fails with a permission error on /dev/fuse with podman.