如何用Podman将主机UID 1000映射到容器NGINX的UID 101？

问题场景 #

尝试以非特权用户启动NGINX，用于提供指定目录下的文件，需要将容器中nginx用户的UID 101映射到当前主机UID 1000，确保容器能访问挂载的数据。执行以下命令：

podman run --rm -i -p 9876:8080 \
--uidmap 101:@1000:1 \
--volume `pwd`:/usr/share/nginx/html:ro \
docker.io/nginxinc/nginx-unprivileged

执行失败，报错信息：

Error: initializing ID mappings: UID setting is malformed expected ["uint32:uint32:uint32"]: ["101:@1000:1"]

根据Podman文档，@1000的语法应该可行，但实际报错，希望找到无Root权限下实现主机UID到容器UID映射的简便方法。

文档引用 #

Referencing a host ID from the parent namespace

As a rootless user, the given host ID in --uidmap or --gidmap is mapped from the intermediate namespace generated by Podman. Sometimes it is desirable to refer directly at the host namespace. It is possible to manually do so, by running podman unshare cat /proc/self/gid_map, finding the desired host id at the second column of the output, and getting the corresponding intermediate id from the first column.

Podman can perform all that by preceding the host id in the mapping with the @ symbol. For instance, by specifying --gidmap 100000:@2000:1, podman will look up the intermediate id corresponding to host id 2000 and it will map the found intermediate id to the container id 100000. The given host id must have been subordinated (otherwise it would not be mapped into the intermediate space in the first place).

If the length is greater than one, for instance with --gidmap 100000:@2000:2, Podman will map host ids 2000 and 2001 to 100000 and 100001, respectively, regardless of how the intermediate mapping is defined.

使用的Podman版本 #

Using podman 4.6.2
Client:       Podman Engine
Version:      4.6.2
API Version:  4.6.2
Go Version:   go1.18.1
Built:        Thu Jan  1 01:00:00 1970
OS/Arch:      linux/amd64

解决方案 #

方案一：手动计算中间ID映射 #

Podman在无Root模式下会创建中间用户命名空间，@符号语法失效时，可手动获取主机UID对应的中间ID来完成映射：

1. 执行以下命令查看UID映射关系：

podman unshare cat /proc/self/uid_map

输出示例（第二列是主机UID，第一列是对应中间ID）：

0       1000          1
         1     100000      65536

这里主机UID1000对应的中间ID是0。

2. 修改启动命令，用中间ID替换@1000：

podman run --rm -i -p 9876:8080 \
--uidmap 101:0:1 \
--volume "$(pwd)":/usr/share/nginx/html:ro \
docker.io/nginxinc/nginx-unprivileged

方案二：调整容器内用户UID适配主机权限 #

如果允许临时修改容器内的nginx用户UID，可使用--userns=keep-id参数结合用户修改命令，直接让容器内用户UID与主机当前用户一致：

podman run --rm -i -p 9876:8080 \
--userns=keep-id \
--volume "$(pwd)":/usr/share/nginx/html:ro \
docker.io/nginxinc/nginx-unprivileged \
sh -c "usermod -u 1000 nginx && nginx -g 'daemon off;'"

补充说明 #

若坚持要使用@符号语法，可检查以下两点：

• 确认当前用户的子ID配置（/etc/subuid和/etc/subgid）中包含主机UID1000；
• 尝试升级Podman到更高版本（如5.x系列），该版本对@符号映射语法的支持更稳定。

内容的提问来源于stack exchange，提问作者Antoniossss