self_update seems not to respect settings for "UsernsMode" on update

[ck-c8y]

Before Update

My tedge container in podman was started with the paramater:

podman run -d \
--userns keep-id \
...

When I run on the original container:

$ podman exec tedge ls -la /run/tedge-p11-server/tedge-p11-server.sock
srw-rw----    1 tedge    tedge            0 Oct 28 12:48 /run/tedge-p11-server/tedge-p11-server.sock

and

$ podman inspect tedge --format '{{.HostConfig.UsernsMode}}'
private

After Update

After the update this setting was not copied to the new container resulting in wrong permissions:

$ podman exec tedge ls -la /run/tedge-p11-server/tedge-p11-server.sock
srw-rw----    1 root     root             0 Oct 28 12:48 /run/tedge-p11-server/tedge-p11-server.sock

$ podman inspect tedge --format '{{.HostConfig.UsernsMode}}'

I use podman version 4.3.1.

[reubenmiller]

This might be a trickier one to handle as I’m not sure if that setting is used in docker so it might involve doing some engine specific logic…but anyway this is related to the underlying tedge-container-plugin.

[reubenmiller]

Some questions:

• Are you running podman in rootless mode?
• Are you running the tedge-p11-server in a container?
• Are you using fixed uid and gid for the tedge user (both inside the container and on the host)?

[ck-c8y]

Are you running podman in rootless mode?

thin edge container runs in rootless mode (tedge user)

Are you running the tedge-p11-server in a container?

tedge-p11-server runs on the host

Are you using fixed uid and gid for the tedge user (both inside the container and on the host)?

Yes. We use the same uid, gid on the host and in the container:

on the host

$ id
uid=987(tedge) gid=984(tedge) groups=984(tedge),999(systemd-journal)

in the container

$ podman exec -it tedge sh
/ $ id
uid=987(tedge) gid=984(tedge) groups=984(tedge)

[reubenmiller]

I have an open PR where we're exploring if we can respect some more settings, but we're still experimenting with the settings, thin-edge/tedge-container-plugin#171

[reubenmiller]

@ck-c8y Though given that we currently don't have a rootless setup, you might need to verify that everything works correctly once a new release is made.

[ck-c8y]

So I have to wait for a new release of tedge-container-plugin-ng?

[reubenmiller]

Unfortunately the fix in the tedge-container-plugin-ng doesn't solve the problem as there are far too many differences between docker and podman data models...this will be much more difficult to solve, as currently I don't really know what podman is doing...so I'm afraid there isn't going to be a solution in the near future