mock tries to use mknod(), which fails in Podman container about mock HOT 4 CLOSED

Thank you for the report. Mock Indeed pre-creates some device files in chroots.

Running mock in an unprivileged container is probably going to fail for multiple
reasons. You at least need to do podman run --privileged as a non-root user
(IOW, running in a separate user namespace).

We at least need more info; what device files shouldn't be created, and what to do
instead to actually make the RPM build work.

This breaks nspawn isolation in the Podman executor for Qubes OS’s builderv2.

This is weird. --isolation=nspawn isn't used in containers (i.e. mock doesn't spawn
containers in containers).

from mock.

Thank you for the report. Mock Indeed pre-creates some device files in chroots.

Running mock in an unprivileged container is probably going to fail for multiple reasons. You at least need to do podman run --privileged as a non-root user (IOW, running in a separate user namespace).

Unprivileged users cannot use mknod(), whether it be in a user namespace or otherwise. They can, however, bind-mount the inodes that exist in the host /dev, and I believe this is what Podman actually does.

We at least need more info; what device files shouldn't be created, and what to do instead to actually make the RPM build work.

Mock should bind-mount the device nodes.

This breaks nspawn isolation in the Podman executor for Qubes OS’s builderv2.

This is weird. --isolation=nspawn isn't used in containers (i.e. mock doesn't spawn containers in containers).

Why is this? --isolation=nspawn is necessary to ensure that builds do not access the network, so not supporting it is rather annoying.

from mock.

Why is this? --isolation=nspawn is necessary to ensure that builds do not access the network, so not supporting it is rather annoying.

Because starting containers in containers is rather a hard topic to
implement, debug, and maintain (especially for us in Mock, we aren't the
upstream for Podman, Systemd, Docker, etc.). Even Mock builds with a
single level of containerization is pretty hard thing to take care of.
Patches are welcome of course, if you are ready to help us with this.

Otherwise, Mock does "unshare" for a separate network namespace and does
other mitigations related to disabling the network. So networking is not
enough motivating us... also, Mock explicitly claims that it doesn't
fully "isolate", see "Scope" section in our docs.

from mock.

There's been no activity recently, closing. Feel free to continue with the discussion (we can reopen the issue).

from mock.