Permission denied when trying to use the /var/run/docker.sock file generated by the mac-helper
#14238
Replies: 10 comments 13 replies
-
|
@baude PTAL |
Beta Was this translation helpful? Give feedback.
-
|
I have a similar issue on podman 4.0.3 on Mac (m1). This is simulating how testcontainers starts the ryuk container. Even with Another more direct way to test it. podman was setup using: |
Beta Was this translation helpful? Give feedback.
-
|
Someone may correct me, but in my recent experience:
Means that you don't have
Is caused by SELinux, see coreos/fedora-coreos-tracker#585 for details. As a proper solution maybe |
Beta Was this translation helpful? Give feedback.
-
|
According to this accessing @aaronjwhiteside I've had success with both your @rafaelfranca I'm not familiar with VSCode Remote container extension and the Also, I don't believe the |
Beta Was this translation helpful? Give feedback.
-
I can't control what VSCode uses to run the container, only the executable between I guess podman not being a drop replacement for docker makes it unusable for devcontainers for now. |
Beta Was this translation helpful? Give feedback.
-
|
Late reply, but thanks @shanesmith that indeed was the issue, I had to hunt down documentation on how to do that with Test Containers. Thanks for pointing me in the direct direction. Like most things it makes sense in hindsight. |
Beta Was this translation helpful? Give feedback.
-
|
You do not need to run --privileged you could disable SELinux for the container. podman run --security-opt label:disabled |
Beta Was this translation helpful? Give feedback.
-
|
This worked for me like a charm! |
Beta Was this translation helpful? Give feedback.
-
|
How did you get this to work with VS Code dev containers? I'm trying to figure this out! |
Beta Was this translation helpful? Give feedback.
-
|
Try |
Beta Was this translation helpful? Give feedback.
-
|
I am moving this to discussion, since I do not believe Podman is doing anything incorrect here. |
Beta Was this translation helpful? Give feedback.
-
|
This is also tracked at microsoft/vscode-remote-release#2881. It seems there are some key differences with podman that make it unusable in the way devcontainers work. |
Beta Was this translation helpful? Give feedback.
-
|
Hi @holly-cummins, this is not the correct solution for Test Containers. It's not clearly stated in their documentation, but you just need to tell Test Containers to start the Ryuk container in privileged mode. https://www.testcontainers.org/features/configuration/#customizing-ryuk-resource-reaper
You would add this in your Running Test Containers without Ryuk can lead to serious issues, because containers that are started are never automatically stopped/cleaned up. I hope this helps others, after realising that podman required containers to be privileged to mount the docker socket, I had to go hunting to understand how to make Test Containers do this. It would have been nice if they said "hey if you're using podman, enable this bit of configuration or things won't work". |
Beta Was this translation helpful? Give feedback.
-
|
I like @aaronjwhiteside's answer so much, since it's so much cleaner than disabling ryuk... but it didn't work for me. I tried both
and
... but it didn't resolve the issue. I have a feeling that some extra step combined with that property setting would do the trick - maybe my test containers is ignoring the config because of how it's being run? Maybe I need rootful podman? I can confirm (doh!) that I do see issues with cleanup being missed because of blanket-disabling ryuk. |
Beta Was this translation helpful? Give feedback.
-
|
@holly-cummins, sorry to hear it's not working for you :( |
Beta Was this translation helpful? Give feedback.
-
|
I think that's it @aaronjwhiteside , thanks! |
Beta Was this translation helpful? Give feedback.
-
|
I've been following @holly-cummins #14238 (reply in thread) suggestions also specifically from this stackoverflow answer. But at least on Mac and using TestContainers for Go I also need to specify is Hope this might help someone, or happy to hear comments |
Beta Was this translation helpful? Give feedback.
-
|
If you have control over the source of the mount, this should work: podman run -v /run/user/501/podman/podman.sock:/var/run/docker.sock vsc-volume-bootstrapIf you do not (e.g. need to the same path on the local and remote host: $ podman machine ssh ls -l /var/run/docker.sock
lrwxrwxrwx. 1 root root 23 Jul 9 09:31 /var/run/docker.sock -> /run/podman/podman.sock
$ podman machine ssh sudo ln -sf /run/user/501/podman/podman.sock /var/run/docker.sock
$ podman machine ssh ls -l /var/run/docker.sock
lrwxrwxrwx. 1 root root 32 Jul 9 09:33 /var/run/docker.sock -> /run/user/501/podman/podman.sockA proper way if your program supports the cat >>~/.ssh/config <<EOF
Host localhost
IdentityFile $(podman machine inspect --format='{{.SSHConfig.IdentityPath}}')
EOF
export DOCKER_HOST="$(podman machine inspect --format='ssh://{{.SSHConfig.RemoteUsername}}@localhost:{{.SSHConfig.Port}}')"
export DOCKER_SOCK="$(podman system info --format='{{.Host.RemoteSocket.Path}}')"Then my goal was to create a $ podman machine ssh cat /sys/fs/cgroup/user.slice/user-501.slice/user@501.service/cgroup.controllers
cpu io memory pids
$ podman machine ssh bash -e <<EOF
printf '[Service]\nDelegate=cpuset\n' | sudo tee /etc/systemd/system/user@.service.d/k3d.conf
sudo systemctl daemon-reload
sudo systemctl restart "user@\${UID}"
EOF
$ podman machine ssh cat /sys/fs/cgroup/user.slice/user-501.slice/user@501.service/cgroup.controllers
cpuset cpu io memory pids |
Beta Was this translation helpful? Give feedback.
-
|
Just my 5 cents: Was also fighting with the podman bugs on macOS and it turned out to do all podman stuff via Parallels takes almost half less resources on Mac, is free and also no such bugs. |
Beta Was this translation helpful? Give feedback.
-
|
Fine-print:
|
Beta Was this translation helpful? Give feedback.
-
|
No way to fix this
|
Beta Was this translation helpful? Give feedback.
-
|
Perhaps you should open a new discussion, since this one has been inactive for a while. podman-docker is for use within a Linux machine. But it does not give access to rootless users if the docker.sock is owned by root. |
Beta Was this translation helpful? Give feedback.
-
Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)
/kind bug
Description
When trying to use the VSCode Remote container extension with podman, one of the commands that is executed tries to use the
/var/run/docker.sockfile to mount a volume. That file has different file permission than the original podman socket it is being liked to:This is causing the command to fail with permission denied. I believe that symlink should have the same permissions as the original file.
Steps to reproduce the issue:
podman run -v /var/run/docker.sock:/var/run/docker.sock vsc-volume-bootstrapwith any valid container.Describe the results you received:
Command failed: podman run -d --mount type=volume,src=rails-main-ecb592c6d095efde43d1d0e49d27304d,dst=/workspaces -v /var/run/docker.sock:/var/run/docker.sock vsc-volume-bootstrap sleep infinity
[953 ms] Error: statfs /var/run/docker.sock: permission denied
Describe the results you expected:
Command executed with success
Additional information you deem important (e.g. issue happens only occasionally):
Output of
podman version:Output of
podman info --debug:Have you tested with the latest version of Podman and have you checked the Podman Troubleshooting Guide? (https://github.com/containers/podman/blob/main/troubleshooting.md)
Yes
Additional environment details (AWS, VirtualBox, physical, etc.):
Beta Was this translation helpful? Give feedback.
All reactions