What am I doing wrong here? Am I misunderstanding how owneridmap works?
I’m exploring using NixOS containers to host services and I really like it so far except I’ve hit a snag: I want to use privateUsers = true and also need bind mounts. (I’m actually interested in this without user namespacing too, so I don’t have to line up host and container user UIDs)
I understand that by default this is broken, but my understanding is that using the owneridmap mode with a bind mount should map the host user UID of the source to the container user UID of the target[1].
The containers module doesn’t provide an option for bind mount modes, but it looks like there’s a workaround by suffixing the mountPoint string with the mode[2].
Despite making sure the mount point is owned by the container service user, the folder ends up owned by root inside the container.
[root@forgejo:~]# ll /
total 36
drwxr-xr-x 3 forgejo forgejo 4096 Sep 26 22:11 test
...
[root@forgejo:~]# ll /test
total 4
drwxr-xr-x 2 root nogroup 4096 Sep 25 19:14 test
An (only slightly) simplified version of my container config is below. The “drew” user is created in another file.
{ config, ... }:
{
containers.forgejo = {
autoStart = true;
privateUsers = "pick";
bindMounts = {
test = {
hostPath = "/home/drew/test";
mountPoint = "/test/test:owneridmap";
isReadOnly = false;
};
};
config = { config, ... }: {
services.forgejo.enable = true;
# Make sure /test is owned by the "forgejo" user
# so owneridmap maps the UID of "forgejo"
systemd.tmpfiles.settings.forgejo = {
"/test" = {
d = {
user = config.services.forgejo.user;
group = config.services.forgejo.group;
mode = "0755";
};
};
};
};
};
};