I apologize for the late response.  This one fell through the cracks.  Sorry about that.

> podman start --attach  almalinux-toolbox-8
> ...
> level=debug msg="Binding /var/lib/systemd/coredump to
>     /run/host/var/lib/systemd/coredump"
> mount: /var/lib/systemd/coredump: filesystem was mounted,
>     but any subsequent operation failed: Unknown error 5005.
> Error: failed to bind /var/lib/systemd/coredump to /run/host/var/lib/systemd/coredump

Thanks a lot for the `podman start` logs!  This is the all important line:
  mount: /var/lib/systemd/coredump: filesystem was mounted,
      but any subsequent operation failed: Unknown error 5005.

It's coming from the container's entry point attempting this inside it's mount and user namespace:

  # mount --rbind -o ro /run/host/var/lib/systemd/coredump
      /var/lib/systemd/coredump
  mount: /var/lib/systemd/coredump: filesystem was mounted,
      but any subsequent operation failed: Unknown error 5005.

Looking at the util-linux code [1] it becomes clear that 5005 is MNT_ERR_APPLYFLAGS.

I suspect that on the host /var/lib/systemd/coredump is mounted with some restricted flags beyond 'ro' (like 'nodev', 'nosuid', 'noexec', etc.), and the kernel is unhappy that they are not being used inside the container's mount and user namespace.  This wouldn't have failed if it was attempted inside the host's namespace.

[1] https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/

Christophe, could you please show me the results from:

  $ df --output=target /var/lib/systemd/coredump
  Mounted on
  <mount-point>

  $ findmnt --output OPTIONS,PROPAGATION <mount-point>
  OPTIONS       PROPAGATION
  ...           ...

Yes, /var is using nosuid

Please find the requested information

$ rpm -q toolbox
toolbox-0.0.99.3-7.module_el8.8.0+3470+252b1910.x86_64
$ df --output=target /var/lib/systemd/coredump
Mounted on
/var
$ findmnt --output OPTIONS,PROPAGATION /var
OPTIONS                    PROPAGATION
rw,nosuid,noatime,seclabel shared

For what it's worth, I sent a pull request to get mount(8) to show a better error message:
https://github.com/util-linux/util-linux/pull/2376

Toolbx pull request: https://github.com/containers/toolbox/pull/1340

(In reply to Debarshi Ray from comment #7)
> Toolbx pull request: https://github.com/containers/toolbox/pull/1340

Christophe, would it be possible for you to test this pull request?  Thanks for your patience and persistence.

Where can I found the RPM for this pull request for RHEL/CentOS 8 ?

(In reply to Christophe GRENIER from comment #13)
> Where can I found the RPM for this pull request for RHEL/CentOS 8 ?

You should be able to get them in https://kojihub.stream.centos.org/koji/taskinfo?taskID=2488636 (please keep in mind that these are only test builds)

Thanks. With the new rpm, "toolbox enter almalinux-toolbox-8" now works correctly.
I have also tested successfully
  toolbox create --image quay.io/toolbx-images/almalinux-toolbox:9
  toolbox enter almalinux-toolbox-9

Let's use this bug for the 'rolling' stream of the container-tools module in RHELL 8.  I filed bug 2231464 as the 4.0 stream counterpart.

Built toolbox-0.0.99.4-5.el8:
https://mbs.stream.rdu2.redhat.com/module-build-service/2/module-builds/649
https://kojihub.stream.rdu2.redhat.com/koji/taskinfo?taskID=2675260

https://desktopqe-jenkins.rhev-ci-vms.eng.rdu2.redhat.com/job/beaker-toolbox-RHEL-8.9/7/