Bug 1719452

Summary:	rootless fail: container create failed: cannot specify gid= mount options for unmapped gid in rootless containers
Product:	Red Hat Enterprise Linux 7	Reporter:	James Cassell <fedoraproject>
Component:	runc	Assignee:	Jindrich Novy <jnovy>
Status:	CLOSED ERRATA	QA Contact:	atomic-bugs <atomic-bugs>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.7	CC:	ahogbin, ajia, ddarrah, domosino44, dornelas, dwalsh, jligon, jnovy, lsm5, mheon, mpatel, santiago, smccarty, umohnani
Target Milestone:	rc	Keywords:	Extras
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	runc-1.0.0-64.rc8.el7	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-08-06 17:32:59 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1186913, 1688348, 1693961, 1718378

Description James Cassell 2019-06-11 20:35:56 UTC

Description of problem:

rootless fails with 

may be related: https://bugzilla.redhat.com/show_bug.cgi?id=1693424


Version-Release number of selected component (if applicable):
1.3.2-1.git14fdcd0.el7

How reproducible:
100%

Steps to Reproduce:
1. install podman on RHEL 7.7 Beta
2. podman pull ubi8
3. podman run -it --net=host ubi8

Actual results:
Error: container create failed: cannot specify gid= mount options for unmapped gid in rootless containers
: internal libpod error


Expected results:
bash-4.4#


Additional info:
downgrading to 0.12 makes it work again.

Comment 2 Daniel Walsh 2019-06-12 07:37:59 UTC

Does this mean the podman and runc are not in sync?  We need to make sure we have an updated version of runc to match the podman version.

Comment 11 Derrick Ornelas 2019-07-30 13:34:46 UTC

*** Bug 1734375 has been marked as a duplicate of this bug. ***

Comment 12 Alex Jia 2019-07-31 04:36:13 UTC

Fixed in runc-1.0.0-64.rc8.el7.x86_64

# podman pull ubi8
Trying to pull registry.access.redhat.com/ubi8...Getting image source signatures
Copying blob c585fd5093c6 done
Copying blob e61d8721e62e done
Copying config c7a62535df done
Writing manifest to image destination
Storing signatures
c7a62535df3cebd7cb714574c04fb3aa71b92551c11a164cef461855360d3970

# podman images
REPOSITORY                        TAG      IMAGE ID       CREATED      SIZE
registry.access.redhat.com/ubi8   latest   c7a62535df3c   7 days ago   216 MB

# podman run -it --net=host ubi8
bash-4.4# pwd
/

Comment 14 James Cassell 2019-08-02 22:18:29 UTC

I've confirmed this fix on RHEL 7.7 beta with the latest packages in the rhel-7-server-extras-rpms repo.  All that's missing now for seamless rootless containers is slirp4netns to avoid having to use the `--net=host` and provide network isolation of the rootless containers.

Comment 16 errata-xmlrpc 2019-08-06 17:32:59 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:2389