I'm trying to mount NFS inside Podman rootless container. I tried several method with/without CAPS and security profile parameters. Unfortunately, mount works only, if Podman is run as root. I'm spent 2 week on this issue, but honestly i'm out of ideas how to deal with this issue.
- As root with cap-add container (Working)
[root@rack-host1~]# podman run --cap-add=CAP_SYS_ADMIN -it myredhatimage:8 bash [root@d8e09797b797 /]# mount -vv -t nfs4 -o rw,relatime,vers=4.0,rsize=65536,wsize=65536,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,local_lock=none,addr=10.0.0.12nfs-server06:/MoviesShare /data mount: nfs-server06:/MoviesShare mounted on /data. [root@d8e09797b797 /]# ls /data configs containers movies logs pictures
- As non root without caps [Failed]
[podman-user@rack-host1~]$ podman run -it myredhatimage:8 bash [root@fbd0cfca851d /]# mkdir -p /data [root@fbd0cfca851d /]# mount -vv -t nfs4 -o rw,relatime,vers=4.0,rsize=65536,wsize=65536,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,local_lock=none,addr=10.0.0.12nfs-server06:/MoviesShare /data mount: /data: permission denied.
- As non root with caps [Failed]
[podman-user@rack-host1~]$ podman run --cap-add=CAP_SYS_ADMIN -it myredhatimage:8 bash [root@56e79e6f30cf /]# mkdir -p /data [root@56e79e6f30cf /]# mount -vv -t nfs4 -o rw,relatime,vers=4.0,rsize=65536,wsize=65536,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,local_lock=none,addr=10.0.0.12nfs-server06:/MoviesShare /data mount: /data: permission denied.
- As non root with caps and privileged [Failed]
[podman-user@rack-host1~]$ podman run --privileged --cap-add=CAP_SYS_ADMIN -it myredhatimage:8 bash [root@bc40b4065cf1 /]# mkdir -p /data [root@bc40b4065cf1 /]# mount -vv -t nfs4 -o rw,relatime,vers=4.0,rsize=65536,wsize=65536,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,local_lock=none,addr=10.0.0.12nfs-server06:/MoviesShare /data mount: /data: permission denied.
I use newest Podman 5.0.0-dev-d08414686 and RHEL8.9 with kernel 4.18.0-513.9.1.el8_9.x86_64
Client: Podman
Engine Version: 5.0.0-dev-d08414686
API Version: 5.0.0-dev-d08414686
Go Version: go1.20.10
Built: Mon Jan 22 16:32:20 2024
OS/Arch: linux/amd64
Podman is configured to use runc engine. NFS is in version 4. Please let know.