How to run rootless containers under a user `podman` in NixOS?

1

Does somebody know if using virtualisation.oci-containers.containers.mycontainer.podman.user = podman
does effectively do podman run -it --user <user>:<group> as executed as root user or does it run the container with rootless podman under user podman?

I would like to be doing the second. Or how can I run rootless podman containers in NixOS?

1 Like
2

It creates a service that runs as the specified user: nixpkgs/nixos/modules/virtualisation/oci-containers.nix at 25e53aa156d47bad5082ff7618f5feb1f5e02d01 Ā· NixOS/nixpkgs Ā· GitHub

3

AH niice! Missed that, so I can run podman service as another user, instead of root really cool.

4

But there is no way of running podman both as root (normal) and having oci-containers with another user right? you need another nixos vm for that maybe? or copy the nixos module oci-containers and replicate it under oci-containers-custom or whatever?

5

What use case do you have in mind?

6

Ah just a
Gitlab Runner NixOS VM which currently uses rootfull containers since they run with oci-containers under root.

I thought of making it a bit safer by making an additional runner which truely runs over rootless podlam. But either I have rootless podman or I use the normal rootfull setupā€¦

7

I saw a talk on that topic that proposed: change mapping of container so root inside the container is a user outside the container.

podman run \
    --uidmap="0:$(id -u user):1" \
    --uidmap="1:$(grep -Po '(?<=^user:).*$' /etc/subuid | head -1)" \
    --gidmap="0:$(id -g user):1" \
    --gidmap="1:$(grep -Po '(?<=^user:).*$' /etc/subgid | head -1")

See also: GitHub - neverpanic/podman-rootful-network: Rootful Networking with Rootless Podman Containers (GitHub - neverpanic/podman-rootful-network: Rootful Networking with Rootless Podman Containers

8

Ah thats also nice, so we can just run over podman without running completely as root.
Awesome. Maybe I can trick gitlab-runner to run with that uidmap/gidmap.

9

Iā€™ve never tried it tbh. but always wanted to. So I would be interested in your feedback if you succeed. My use case would be that some networks need root to work but I would not want to run the whole container as root.

10

Did you get a fully functional version of it? I tried it myself but I couldnā€™t get it up and runningā€¦

11

NixOs Gitlab Runner
is currently rootfull podman:

It would be good maybe to try setting the above docker
args.