busybox image does not work with rootless buildah about busybox HOT 7 CLOSED

There is a nice writeup for podman explaining the UID/GID limit https://www.redhat.com/sysadmin/rootless-podman

from busybox.

We just use etc/passwd provided by busybox buildroot upstream. Here is the commit where they chose 65534: https://git.busybox.net/buildroot/commit/?id=9c67af2c524ad2b6585af2f5e43f76dacd7cc109.

Running containers via a rootless daemon is still very new and rough, so I don't think it is something we should use to patch upstream source.

from busybox.

Agreed -- this was definitely an intentional choice by busybox/buildroot upstream. I'd suggest the best fix is probably modifying your host's configuration to provide a larger range for your rootless containers.

from busybox.

@yosifkit Thanks for the pointer.

I'd suggest the best fix is probably modifying your host's configuration to provide a larger range for your rootless containers.

@tianon You're right - I tried - but until now I didn't succeed :(

But maybe it's interesting that other images just work fine, because they either use / or a non-existing directory as home for nobody.

docker.io/library/archlinux:latest: nobody:x:65534:65534:Nobody:/:/usr/bin/nologin

docker.io/library/alpine:latest: nobody:x:65534:65534:nobody:/:/sbin/nologin

docker.io/library/ubuntu:latest: nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin

from busybox.

So it seems that the issue will come up in all those images if the nobody user or group ever has ownership of a file or folder.

from busybox.

Right. But I really wonder why an image should contain any files with nobody as owner at all ?

I'm quite new to rootless containers, so maybe someone more experienced should take a look at this.

from busybox.

@thisguy726 Why did you reference this issue ?

from busybox.