Bug 1931800

Summary:	mounting "sysfs" to rootfs at "/sys" caused: operation not permitted - rootless
Product:	Red Hat Enterprise Linux 8	Reporter:	lejeczek <peljasz>
Component:	podman	Assignee:	Tom Sweeney <tsweeney>
Status:	CLOSED DUPLICATE	QA Contact:	atomic-bugs <atomic-bugs>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	CentOS Stream	CC:	bbaude, bstinson, carl, dwalsh, jligon, jnovy, jwboyer, lsm5, mheon, pthomas, umohnani
Target Milestone:	rc	Flags:	pm-rhel: mirror+
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-02-23 10:58:05 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description lejeczek 2021-02-23 09:27:59 UTC

Description of problem:

-> $ podman run -d --restart=always --name postgress docker.io/bitnami/postgresql 
Error: container_linux.go:370: starting container process caused: process_linux.go:459: container init caused: rootfs_linux.go:59: mounting "sysfs" to rootfs at "/sys" caused: operation not permitted: OCI permission denied

I've tried a number of different images and result is always the same.

regards, L.

Version-Release number of selected component (if applicable):

podman-3.0.0-0.33rc2.module_el8.4.0+673+eabfc99d.x86_64

How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 1 lejeczek 2021-02-23 10:49:31 UTC

Gee.. zus... a sleepless night only because 'podman' does not request nor pull a rpm dependency? 'crun', which appears to be critical to rootless podman 3.0.0 setups. 
I think it would be wise and very much appreciated by us regular folks if 'crun' got bundled in as podman's rpm dependency.

many thanks, L.

Comment 2 Jindrich Novy 2021-02-23 10:58:05 UTC

This is actually related to a kernel regression and I mark this bug as duplicate of it. The fix is in progress there.

*** This bug has been marked as a duplicate of bug 1903983 ***