配置Podman使用XFS存储卷配额时重复更新配额的问题

问题 #

我想为Podman卷（使用挂载了prjquota选项的XFS存储）设置配额，已按官方文档完成以下配置：

root@odroid:~# cat /etc/projects 
100000:/storage/containers/graphroot/overlay
200000:/storage/containers/graphroot/volumes

root@odroid:~# cat /etc/projid 
storage:100000
volumes:200000

创建第一个卷时一切正常：

root@odroid:~# podman volume create --opt o=size=100M volume1
volume1

root@odroid:~# xfs_quota -x -c "report -a -h" /storage/containers
Project quota on /storage/containers (/dev/mapper/luks-73764eef-ecc9-4323-aadc-9940738aff36)
                        Blocks              
Project ID   Used   Soft   Hard Warn/Grace   
---------- --------------------------------- 
#0           128K      0      0  00 [------]
storage        4K      0      0  00 [------]
volumes         0      0      0  00 [------]
#200001         0  95.4M  95.4M  00 [------]

但创建第二个卷时，并未生成新的项目ID，仅更新了第一个卷的配额：

root@odroid:~# podman volume create --opt o=size=200M volume2
volume2
root@odroid:~# xfs_quota -x -c "report -a -h" /storage/containers
Project quota on /storage/containers (/dev/mapper/luks-73764eef-ecc9-4323-aadc-9940738aff36)
                        Blocks              
Project ID   Used   Soft   Hard Warn/Grace   
---------- --------------------------------- 
#0           128K      0      0  00 [------]
storage        4K      0      0  00 [------]
volumes         0      0      0  00 [------]
#200001         0 190.7M 190.7M  00 [------]

我的Podman配置信息如下：

root@odroid:~# podman info
host:
  arch: arm64
  buildahVersion: 1.23.1
  cgroupControllers:
  - io
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: 'conmon: /usr/bin/conmon'
    path: /usr/bin/conmon
    version: 'conmon version 2.0.25, commit: unknown'
  cpus: 4
  distribution:
    codename: jammy
    distribution: ubuntu
    version: "22.04"
  eventLogger: journald
  hostname: odroid
  idMappings:
    gidmap: null
    uidmap: null
  kernel: 4.9.337-13
  linkmode: dynamic
  logDriver: journald
  memFree: 2585001984
  memTotal: 3889238016
  ociRuntime:
    name: crun
    package: 'crun: /usr/bin/crun'
    path: /usr/bin/crun
    version: |-
      crun version 0.17
      commit: 0e9229ae34caaebcb86f1fde18de3acaf18c6d9a
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +YAJL
  os: linux
  remoteSocket:
    exists: true
    path: /run/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: false
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: 'slirp4netns: /usr/bin/slirp4netns'
    version: |-
      slirp4netns version 1.0.1
      commit: 6a7b16babc95b6a3056b33fb45b74a6f62262dd4
      libslirp: 4.6.1
  swapFree: 0
  swapTotal: 0
  uptime: 2h 4m 36.78s (Approximately 0.08 days)
plugins:
  log:
  - k8s-file
  - none
  - journald
  network:
  - bridge
  - macvlan
  volume:
  - local
registries: {}
store:
  configFile: /etc/containers/storage.conf
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /storage/containers/graphroot
  graphStatus:
    Backing Filesystem: xfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Using metacopy: "false"
  imageStore:
    number: 0
  runRoot: /storage/containers/runroot
  volumePath: /storage/containers/graphroot/volumes
version:
  APIVersion: 3.4.4
  Built: 0
  BuiltTime: Thu Jan  1 00:00:00 1970
  GitCommit: ""
  GoVersion: go1.18.1
  OsArch: linux/arm64
  Version: 3.4.4

解决方案 #

问题根源 #

你把/storage/containers/graphroot/volumes目录绑定了固定项目ID200000，Podman会把所有新建卷都归到这个父项目ID下，导致新卷的配额直接叠加到同一个ID上，无法生成独立的项目配额。

修复步骤 #

1. 调整项目ID配置文件
   移除volumes对应的固定项目ID配置，让Podman可以自动分配子项目ID：

   # 编辑/etc/projects，删除200000:/storage/containers/graphroot/volumes行
   root@odroid:~# cat /etc/projects 
   100000:/storage/containers/graphroot/overlay
   
   # 编辑/etc/projid，删除volumes:200000行
   root@odroid:~# cat /etc/projid 
   storage:100000
   

2. 配置Podman存储的项目ID范围
   编辑/etc/containers/storage.conf，在[storage.options]段添加以下配置：

   [storage.options]
   xfs_quota_project = "100000-200000"
   

   这个配置指定Podman可以使用的项目ID区间，确保每个新卷都能获得独立的ID。

3. 重启Podman并清理现有卷

   root@odroid:~# systemctl restart podman
   root@odroid:~# podman volume rm volume1 volume2
   

4. 重新创建卷验证效果

   root@odroid:~# podman volume create --opt o=size=100M volume1
   root@odroid:~# podman volume create --opt o=size=200M volume2
   root@odroid:~# xfs_quota -x -c "report -a -h" /storage/containers
   

   此时应该能看到两个独立的项目ID，各自对应不同的配额设置。

补充说明 #

• 先确认XFS文件系统确实挂载了prjquota选项，可通过mount | grep /storage/containers验证。
• 你使用的Podman 3.4.4版本需要明确配置xfs_quota_project范围，才能实现每个卷的独立配额分配。

内容的提问来源于stack exchange，提问作者fdb