From 91dbd6dc335883e18763f0ec99cb3ee5c8cb387e Mon Sep 17 00:00:00 2001 From: Paul Holzinger Date: Mon, 16 Sep 2024 11:39:57 +0200 Subject: [PATCH] pkg/specgen: allow pasta when running inside userns pasta doesn't switch to nobody when we already run in a userns so we can use it there. The unshare package checks the same condition and returns true even if uid 0 in this case so we can directly call this. ref https://github.com/containers/podman/issues/17840#issuecomment-2343251014 Signed-off-by: Paul Holzinger --- pkg/specgen/namespaces.go | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/pkg/specgen/namespaces.go b/pkg/specgen/namespaces.go index f685ab3e8c..e5b99f89d9 100644 --- a/pkg/specgen/namespaces.go +++ b/pkg/specgen/namespaces.go @@ -11,9 +11,9 @@ import ( "github.com/containers/common/pkg/cgroups" "github.com/containers/podman/v5/libpod/define" "github.com/containers/podman/v5/pkg/namespaces" - "github.com/containers/podman/v5/pkg/rootless" "github.com/containers/podman/v5/pkg/util" "github.com/containers/storage/pkg/fileutils" + "github.com/containers/storage/pkg/unshare" storageTypes "github.com/containers/storage/types" spec "github.com/opencontainers/runtime-spec/specs-go" "github.com/opencontainers/runtime-tools/generate" @@ -160,10 +160,15 @@ func validateNetNS(n *Namespace) error { case Slirp: break case Pasta: - if rootless.IsRootless() { + // Check if we run rootless/in a userns. Do not use rootless.IsRootless() here. + // Pasta switches to nobody when running as root which causes it to fail while + // opening the netns owned by root. However when pasta is already in a userns + // it doesn't switch to nobody so it works there. + // https://github.com/containers/podman/issues/17840 + if unshare.IsRootless() { break } - return fmt.Errorf("pasta networking is only supported for rootless mode") + return fmt.Errorf("pasta networking is only supported for rootless mode or when inside a nested userns") case "", Default, Host, Path, FromContainer, FromPod, Private, NoNetwork, Bridge: break default: