Podman启动openhab:4.3.0-debian镜像时出现权限拒绝问题

问题 #

在Fedora 41 Workstation的Podman v5.3.1环境中运行openhab:4.3.0-debian镜像容器时遭遇权限拒绝错误，使用相同参数的sudo docker run则可正常启动。

前置操作步骤 #

已创建UID/GID为9001的专用openhab用户组及用户，并配置挂载目录：

sudo useradd -r -s /sbin/nologin openhab
sudo usermod -a -G openhab openhab
sudo mkdir -p /opt/openhab/{conf,userdata,addons}
sudo chown -R openhab:openhab /opt/openhab

启动容器命令 #

podman run \
        --name openhab \
        --net=host \
        -v /etc/localtime:/etc/localtime:ro \
        -v /usr/share/zoneinfo/Europe/Rome:/etc/timezone:ro \
        -v /opt/openhab/conf:/openhab/conf \
        -v /opt/openhab/userdata:/openhab/userdata \
        -v /opt/openhab/addons:/openhab/addons \
        -e USER_ID=9001 \
        -e GROUP_ID=9001 \
        -e CRYPTO_POLICY=unlimited \
        openhab/openhab:4.3.0-debian

错误日志片段 #

Initializing empty volume /openhab/conf ...
cp: cannot create directory '/openhab/conf/./html': Permission denied
cp: cannot create directory '/openhab/conf/./icons': Permission denied
cp: cannot create directory '/openhab/conf/./items': Permission denied
# 其余权限拒绝日志省略

解决方案 #

问题根源在于Podman默认的无根容器模式与Docker的root运行模式存在差异：

• Docker默认以root用户运行容器，容器内进程拥有对主机挂载目录的完全权限
• Podman默认启用用户命名空间隔离，容器内的UID/GID会被映射到主机的非特权用户范围，导致无法访问主机上UID=9001的openhab用户所属目录

修复方式二选一 #

1. 以root模式运行Podman
   在命令前添加sudo，与Docker的运行模式对齐，直接获得足够权限访问挂载目录：

   sudo podman run \
           --name openhab \
           --net=host \
           -v /etc/localtime:/etc/localtime:ro \
           -v /usr/share/zoneinfo/Europe/Rome:/etc/timezone:ro \
           -v /opt/openhab/conf:/openhab/conf \
           -v /opt/openhab/userdata:/openhab/userdata \
           -v /opt/openhab/addons:/openhab/addons \
           -e USER_ID=9001 \
           -e GROUP_ID=9001 \
           -e CRYPTO_POLICY=unlimited \
           openhab/openhab:4.3.0-debian
   

2. 保留无根模式，配置用户命名空间映射
   使用--userns=keep-id参数，让容器内的UID/GID直接映射到当前主机用户的UID/GID，同时调整主机目录权限：

   podman run \
           --name openhab \
           --net=host \
           --userns=keep-id \
           -v /etc/localtime:/etc/localtime:ro \
           -v /usr/share/zoneinfo/Europe/Rome:/etc/timezone:ro \
           -v /opt/openhab/conf:/openhab/conf \
           -v /opt/openhab/userdata:/openhab/userdata \
           -v /opt/openhab/addons:/openhab/addons \
           -e USER_ID=$(id -u) \
           -e GROUP_ID=$(id -g) \
           -e CRYPTO_POLICY=unlimited \
           openhab/openhab:4.3.0-debian
   

   调整主机目录权限，确保当前用户拥有读写权限：

   sudo chown -R $USER:$USER /opt/openhab
   

内容的提问来源于stack exchange，提问作者Roberto Milani