Podman 4.2.0无特权模式下d---------权限文件夹异常问题咨询

环境与操作步骤 #

Dockerfile #

FROM quay.io/podman/stable:v4.2.0
USER podman
RUN mkdir -p /home/podman/.local/share/containers 

构建与运行命令 #

# 构建镜像
podman build -t test .

# 创建卷并启动容器
podman volume create vol2
podman run -it --device /dev/fuse -v vol2:/home/podman/.local/share/containers:z test /bin/bash

容器内配置信息 #

容器内用户ID和subuid/subgid配置：

[podman@e38f3aed5158 /]$ id
uid=1000(podman) gid=1000(podman) groups=1000(podman)

[podman@e38f3aed5158 /]$ cat /etc/subuid /etc/subgid
podman:1:999
podman:1001:64535
podman:1:999
podman:1001:64535

错误场景 #

在容器内/tmp目录构建镜像时出现权限错误：

[podman@e38f3aed5158 /]$ cd /tmp
echo 'FROM busybox' > Dockerfile
echo 'RUN echo hello' >> Dockerfile
podman build -t test .

WARN[0000] Failed to remove check directory /home/podman/.local/share/containers/storage/overlay/metacopy-check1039970918: fstatat /home/podman/.local/share/containers/storage/overlay/metacopy-check1039970918/work/work/#7e9: permission denied
WARN[0000] Failed to remove check directory /home/podman/.local/share/containers/storage/overlay/opaque-bug-check3330730474: fstatat /home/podman/.local/share/containers/storage/overlay/opaque-bug-check3330730474/work/work/#7eb: permission denied
STEP 1/2: FROM busybox
WARN[0000] Found incomplete layer "2be83a3d943c678d79fc9b44f1297dc1c5f7f949593f904272cb4940f53779af", deleting it
WARN[0000] Found incomplete layer "2be83a3d943c678d79fc9b44f1297dc1c5f7f949593f904272cb4940f53779af", deleting it
ERRO[0000] Image busybox exists in local storage but may be corrupted (remove the image to resolve the issue): fstatat /home/podman/.local/share/containers/storage/overlay/2be83a3d943c678d79fc9b44f1297dc1c5f7f949593f904272cb4940f53779af/work/work/#7bb: permission denied
Resolved "busybox" as an alias (/etc/containers/registries.conf.d/000-shortnames.conf)
Trying to pull docker.io/library/busybox:latest...
Getting image source signatures
WARN[0001] Found incomplete layer "2be83a3d943c678d79fc9b44f1297dc1c5f7f949593f904272cb4940f53779af", deleting it
Error: creating build container: copying system image from manifest list: trying to reuse blob sha256:205dae5015e78dd8c4d302e3db4eb31576fac715b46d099fe09680ba28093a7a at destination: looking for layers with digest "sha256:205dae5015e78dd8c4d302e3db4eb31576fac715b46d099fe09680ba28093a7a": fstatat /home/podman/.local/share/containers/storage/overlay/2be83a3d943c678d79fc9b44f1297dc1c5f7f949593f904272cb4940f53779af/work/work/#7bb: permission denied

查看对应目录权限：

[podman@e38f3aed5158 tmp]$ ls -la /home/podman/.local/share/containers/storage/overlay/2be83a3d943c678d79fc9b44f1297dc1c5f7f949593f904272cb4940f53779af/work
total 0
drwx------. 3 podman podman 18 Jan 29 03:36 .
drwx------. 3 podman podman 18 Jan 29 03:36 ..
d---------. 2 podman podman 18 Jan 29 03:36 work

[podman@e38f3aed5158 tmp]$ chmod 775 -R /home/podman/.local/share/containers/storage/overlay/2be83a3d943c678d79fc9b44f1297dc1c5f7f949593f904272cb4940f53779af/work
chmod: cannot access '/home/podman/.local/share/containers/storage/overlay/2be83a3d943c678d79fc9b44f1297dc1c5f7f949593f904272cb4940f53779af/work/work/#7bb': Permission denied

正常场景 #

使用特权模式启动容器后，操作一切正常：

podman run --privileged -it --device /dev/fuse -v vol3:/home/podman/.local/share/containers:z test /bin/bash

核心疑问 #

无特权的rootless Podman是否应该支持权限为d---------的文件夹？还是非特权的rootless Podman用户确实无法处理此类场景？

Rootless Podman 在无特权模式下确实无法直接处理权限为d---------的文件夹，原因如下：

1. 文件系统权限基础限制
   d---------意味着该文件夹对所有者、组、其他用户都没有任何权限（读、写、执行都被禁止），即便是所有者自身，也无法进入、查看或修改该目录及其内容——这是Linux文件系统的基础权限规则，和Podman无关。你尝试用chmod修改权限失败也印证了这一点，因为没有执行权限连目录都无法访问，更别说修改权限。

2. Rootless Podman的用户映射机制
   Rootless Podman通过subuid/subgid映射实现容器内用户到主机用户的权限隔离，但这种映射不会突破Linux的基础权限模型。容器内的podman用户（UID1000）即便是目录的所有者，在无特权模式下也没有绕过文件系统权限限制的能力。

3. 特权模式的作用
   特权模式下容器会获得主机的CAP_DAC_OVERRIDE等能力，允许进程绕过文件系统的权限检查，所以此时可以处理这类无权限的目录。但这是特权模式的特殊能力，并非Rootless Podman的常规支持场景。

建议处理方式 #

• 避免在Rootless Podman环境中创建或生成d---------权限的目录，这类权限本身就不符合常规的使用逻辑；
• 如果是镜像拉取或构建过程中意外生成了这类目录，可先删除对应存储目录（或整个卷）后重新操作；
• 若必须处理此类目录，只能临时使用特权模式修复权限后再切换回无特权模式运行。

内容的提问来源于stack exchange，提问作者uniwinux