fix broken rootless storage.conf mount option (metacopy=on conflicts with userxattr)
Split storage vendor configuration into separate rootful and rootless drop-in files so that metacopy=on is only used for rootful overlay mounts where it is valid. Rootless overlay automatically enables userxattr which conflicts with metacopy=on. Upstream fix: https://github.com/podman-container-tools/container-libs/pull/954 Resolves: RHEL-191669 Signed-off-by: Jindrich Novy <jnovy@redhat.com>
This commit is contained in:
Jindrich Novy
parent
9e5f3d1358
commit
a8fc88fc2a
@ -1,2 +0,0 @@
|
||||
[storage.options]
|
||||
additionalimagestores = ["/usr/lib/containers/storage"]
|
||||
6
00-storage-rootful.conf
Normal file
6
00-storage-rootful.conf
Normal file
@ -0,0 +1,6 @@
|
||||
[storage.options]
|
||||
additionalimagestores = ["/usr/lib/containers/storage"]
|
||||
|
||||
[storage.options.overlay]
|
||||
# mountopt specifies comma separated list of extra mount options
|
||||
mountopt = "nodev,metacopy=on"
|
||||
4
00-storage-rootless.conf
Normal file
4
00-storage-rootless.conf
Normal file
@ -0,0 +1,4 @@
|
||||
[storage.options.overlay]
|
||||
# mountopt specifies comma separated list of extra mount options
|
||||
# Note unlike the rootful config we cannot use metacopy=on as rootless user
|
||||
mountopt = "nodev"
|
||||
@ -1,6 +1,2 @@
|
||||
[storage]
|
||||
driver = "overlay"
|
||||
|
||||
[storage.options.overlay]
|
||||
# mountopt specifies comma separated list of extra mount options
|
||||
mountopt = "nodev,metacopy=on"
|
||||
|
||||
@ -6,15 +6,16 @@
|
||||
|
||||
# Packit will automatically update the image and storage versions on Fedora and
|
||||
# CentOS Stream dist-git PRs.
|
||||
%global container_libs_branch podman-6.0
|
||||
%global container_libs_branch main
|
||||
%global container_libs_url https://raw.githubusercontent.com/containers/container-libs/refs/heads/%{container_libs_branch}
|
||||
|
||||
%global container_libs_version %(v=%{container_libs_branch}; echo ${v:7})
|
||||
%global container_libs_version 6.0
|
||||
#%%global container_libs_version %(v=%{container_libs_branch}; echo ${v:7})
|
||||
|
||||
Name: containers-common
|
||||
Epoch: 6
|
||||
Version: %{container_libs_version}
|
||||
Release: 1%{?dist}
|
||||
Release: 2%{?dist}
|
||||
License: Apache-2.0
|
||||
BuildArch: noarch
|
||||
# for BuildRequires: go-md2man
|
||||
@ -66,8 +67,9 @@ Source29: REKOR-signing-key
|
||||
Source30: SIGSTORE-redhat-release3
|
||||
Source31: %{container_libs_url}/common/rpm/00-containers.conf
|
||||
Source32: %{container_libs_url}/common/rpm/00-storage.conf
|
||||
Source33: %{container_libs_url}/common/rpm/00-storage-additional-store.conf
|
||||
Source33: %{container_libs_url}/common/rpm/00-storage-rootful.conf
|
||||
Source34: %{container_libs_url}/common/rpm/00-rhel-registries.conf
|
||||
Source35: %{container_libs_url}/common/rpm/00-storage-rootless.conf
|
||||
|
||||
# scripts used for synchronization with upstream and shortname generation
|
||||
Source100: update.sh
|
||||
@ -124,7 +126,8 @@ install -dp %{buildroot}%{_sharedstatedir}/containers/sigstore
|
||||
# install custom vendor overwrites
|
||||
install -Dp -m0644 %{SOURCE31} %{buildroot}%{_datadir}/containers/containers.conf.d/00-vendor.conf
|
||||
install -Dp -m0644 %{SOURCE32} %{buildroot}%{_datadir}/containers/storage.conf.d/00-vendor.conf
|
||||
install -Dp -m0644 %{SOURCE33} %{buildroot}%{_datadir}/containers/storage.rootful.conf.d/00-vendor-additional-store.conf
|
||||
install -Dp -m0644 %{SOURCE33} %{buildroot}%{_datadir}/containers/storage.rootful.conf.d/00-vendor-rootful.conf
|
||||
install -Dp -m0644 %{SOURCE35} %{buildroot}%{_datadir}/containers/storage.rootless.conf.d/00-vendor-rootless.conf
|
||||
install -Dp -m0644 %{SOURCE34} %{buildroot}%{_datadir}/containers/registries.conf.d/00-vendor.conf
|
||||
|
||||
# for containers-common
|
||||
@ -237,7 +240,9 @@ ln -s ../../../..%{_sysconfdir}/yum.repos.d/redhat.repo %{buildroot}%{_datadir}/
|
||||
%dir %{_datadir}/containers/storage.conf.d
|
||||
%{_datadir}/containers/storage.conf.d/00-vendor.conf
|
||||
%dir %{_datadir}/containers/storage.rootful.conf.d
|
||||
%{_datadir}/containers/storage.rootful.conf.d/00-vendor-additional-store.conf
|
||||
%{_datadir}/containers/storage.rootful.conf.d/00-vendor-rootful.conf
|
||||
%dir %{_datadir}/containers/storage.rootless.conf.d
|
||||
%{_datadir}/containers/storage.rootless.conf.d/00-vendor-rootless.conf
|
||||
%dir %{_datadir}/rhel
|
||||
%dir %{_datadir}/rhel/secrets
|
||||
%{_datadir}/rhel/secrets/*
|
||||
@ -245,6 +250,11 @@ ln -s ../../../..%{_sysconfdir}/yum.repos.d/redhat.repo %{buildroot}%{_datadir}/
|
||||
%files extra
|
||||
|
||||
%changelog
|
||||
* Thu Jul 02 2026 Jindrich Novy <jnovy@redhat.com> - 6:6.0-2
|
||||
- fix broken rootless storage.conf mount option (metacopy=on conflicts with
|
||||
userxattr) - split storage vendor config into separate rootful and rootless
|
||||
drop-in files - Resolves: RHEL-191669
|
||||
|
||||
* Fri Jun 26 2026 Jindrich Novy <jnovy@redhat.com> - 6:6.0-1
|
||||
- bump to container_libs_branch podman-6.0
|
||||
- use RHEL-specific mounts.conf from common/contrib/redhat/ (container-libs#842)
|
||||
|
||||
@ -416,6 +416,11 @@ default_sysctls = [
|
||||
# via kernel splice, which preserves the original source IP address inside the
|
||||
# container. This option is experimental and subject to change.
|
||||
#
|
||||
# Important: This option must only be changed when no containers are running.
|
||||
# Switching while containers are active leads to port-forwarding rules being
|
||||
# leaked or cleanup failures because the running netns was created with the
|
||||
# previous setting.
|
||||
#
|
||||
#rootless_port_forwarder = "rootlessport"
|
||||
|
||||
# Path to the directory where network configuration files are located.
|
||||
|
||||
@ -496,6 +496,10 @@ Valid options are `rootlessport` (default) and `pasta`.
|
||||
which preserves the original source IP address inside the container.
|
||||
The `pasta` option is **experimental** and subject to change.
|
||||
|
||||
**Important:** This option must only be changed when no containers are running.
|
||||
Switching while containers are active leads to port-forwarding rules being leaked
|
||||
or cleanup failures because the running netns was created with the previous setting.
|
||||
|
||||
**network_config_dir**="/etc/containers/networks"
|
||||
|
||||
Path to the directory where network configuration files are located.
|
||||
|
||||
@ -418,6 +418,7 @@
|
||||
"signalfd4",
|
||||
"sigprocmask",
|
||||
"sigreturn",
|
||||
"socket",
|
||||
"socketcall",
|
||||
"socketpair",
|
||||
"splice",
|
||||
|
||||
18
update.sh
18
update.sh
@ -28,9 +28,12 @@ for FILE in *; do
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
ensure storage.conf driver \"overlay\"
|
||||
ensure storage.conf mountopt \"nodev,metacopy=on\"
|
||||
ensure registries.conf unqualified-search-registries [\"registry.access.redhat.com\",\ \"registry.redhat.io\",\ \"docker.io\"]
|
||||
# The following settings are now handled by vendor drop-in config files:
|
||||
# 00-storage.conf sets driver, 00-storage-rootful.conf / 00-storage-rootless.conf
|
||||
# set mountopt, and 00-rhel-registries.conf sets unqualified-search-registries.
|
||||
#ensure storage.conf driver \"overlay\"
|
||||
#ensure storage.conf mountopt \"nodev,metacopy=on\"
|
||||
#ensure registries.conf unqualified-search-registries [\"registry.access.redhat.com\",\ \"registry.redhat.io\",\ \"docker.io\"]
|
||||
|
||||
if pwd | grep -e rhel-8 -e c8s > /dev/null
|
||||
then
|
||||
@ -58,9 +61,12 @@ ensure containers.conf runtime \"crun\"
|
||||
|
||||
elif pwd | grep -e rhel-10 -e c10s > /dev/null
|
||||
then
|
||||
ensure registries.conf short-name-mode \"enforcing\"
|
||||
ensure containers.conf runtime \"crun\"
|
||||
ensure storage.conf enable_partial_images \"false\"
|
||||
# These settings are now handled by vendor drop-in config files:
|
||||
# 00-rhel-registries.conf sets short-name-mode, 00-containers.conf sets runtime,
|
||||
# and enable_partial_images upstream default is already "false".
|
||||
#ensure registries.conf short-name-mode \"enforcing\"
|
||||
#ensure containers.conf runtime \"crun\"
|
||||
#ensure storage.conf enable_partial_images \"false\"
|
||||
else
|
||||
echo "Unknown release"
|
||||
fi
|
||||
|
||||
Loading…
Reference in New Issue
Block a user