diff --git a/00-storage-additional-store.conf b/00-storage-additional-store.conf deleted file mode 100644 index 8bb6711..0000000 --- a/00-storage-additional-store.conf +++ /dev/null @@ -1,2 +0,0 @@ -[storage.options] -additionalimagestores = ["/usr/lib/containers/storage"] diff --git a/00-storage-rootful.conf b/00-storage-rootful.conf new file mode 100644 index 0000000..f49f57b --- /dev/null +++ b/00-storage-rootful.conf @@ -0,0 +1,6 @@ +[storage.options] +additionalimagestores = ["/usr/lib/containers/storage"] + +[storage.options.overlay] +# mountopt specifies comma separated list of extra mount options +mountopt = "nodev,metacopy=on" diff --git a/00-storage-rootless.conf b/00-storage-rootless.conf new file mode 100644 index 0000000..d9ffb01 --- /dev/null +++ b/00-storage-rootless.conf @@ -0,0 +1,4 @@ +[storage.options.overlay] +# mountopt specifies comma separated list of extra mount options +# Note unlike the rootful config we cannot use metacopy=on as rootless user +mountopt = "nodev" diff --git a/00-storage.conf b/00-storage.conf index 2574bcd..2f4bc14 100644 --- a/00-storage.conf +++ b/00-storage.conf @@ -1,6 +1,2 @@ [storage] driver = "overlay" - -[storage.options.overlay] -# mountopt specifies comma separated list of extra mount options -mountopt = "nodev,metacopy=on" diff --git a/containers-common.spec b/containers-common.spec index 9e1b3f6..6f37a05 100644 --- a/containers-common.spec +++ b/containers-common.spec @@ -6,15 +6,16 @@ # Packit will automatically update the image and storage versions on Fedora and # CentOS Stream dist-git PRs. -%global container_libs_branch podman-6.0 +%global container_libs_branch main %global container_libs_url https://raw.githubusercontent.com/containers/container-libs/refs/heads/%{container_libs_branch} -%global container_libs_version %(v=%{container_libs_branch}; echo ${v:7}) +%global container_libs_version 6.0 +#%%global container_libs_version %(v=%{container_libs_branch}; echo ${v:7}) Name: containers-common Epoch: 6 Version: %{container_libs_version} -Release: 1%{?dist} +Release: 2%{?dist} License: Apache-2.0 BuildArch: noarch # for BuildRequires: go-md2man @@ -66,8 +67,9 @@ Source29: REKOR-signing-key Source30: SIGSTORE-redhat-release3 Source31: %{container_libs_url}/common/rpm/00-containers.conf Source32: %{container_libs_url}/common/rpm/00-storage.conf -Source33: %{container_libs_url}/common/rpm/00-storage-additional-store.conf +Source33: %{container_libs_url}/common/rpm/00-storage-rootful.conf Source34: %{container_libs_url}/common/rpm/00-rhel-registries.conf +Source35: %{container_libs_url}/common/rpm/00-storage-rootless.conf # scripts used for synchronization with upstream and shortname generation Source100: update.sh @@ -124,7 +126,8 @@ install -dp %{buildroot}%{_sharedstatedir}/containers/sigstore # install custom vendor overwrites install -Dp -m0644 %{SOURCE31} %{buildroot}%{_datadir}/containers/containers.conf.d/00-vendor.conf install -Dp -m0644 %{SOURCE32} %{buildroot}%{_datadir}/containers/storage.conf.d/00-vendor.conf -install -Dp -m0644 %{SOURCE33} %{buildroot}%{_datadir}/containers/storage.rootful.conf.d/00-vendor-additional-store.conf +install -Dp -m0644 %{SOURCE33} %{buildroot}%{_datadir}/containers/storage.rootful.conf.d/00-vendor-rootful.conf +install -Dp -m0644 %{SOURCE35} %{buildroot}%{_datadir}/containers/storage.rootless.conf.d/00-vendor-rootless.conf install -Dp -m0644 %{SOURCE34} %{buildroot}%{_datadir}/containers/registries.conf.d/00-vendor.conf # for containers-common @@ -237,7 +240,9 @@ ln -s ../../../..%{_sysconfdir}/yum.repos.d/redhat.repo %{buildroot}%{_datadir}/ %dir %{_datadir}/containers/storage.conf.d %{_datadir}/containers/storage.conf.d/00-vendor.conf %dir %{_datadir}/containers/storage.rootful.conf.d -%{_datadir}/containers/storage.rootful.conf.d/00-vendor-additional-store.conf +%{_datadir}/containers/storage.rootful.conf.d/00-vendor-rootful.conf +%dir %{_datadir}/containers/storage.rootless.conf.d +%{_datadir}/containers/storage.rootless.conf.d/00-vendor-rootless.conf %dir %{_datadir}/rhel %dir %{_datadir}/rhel/secrets %{_datadir}/rhel/secrets/* @@ -245,6 +250,11 @@ ln -s ../../../..%{_sysconfdir}/yum.repos.d/redhat.repo %{buildroot}%{_datadir}/ %files extra %changelog +* Thu Jul 02 2026 Jindrich Novy - 6:6.0-2 +- fix broken rootless storage.conf mount option (metacopy=on conflicts with + userxattr) - split storage vendor config into separate rootful and rootless + drop-in files - Resolves: RHEL-191669 + * Fri Jun 26 2026 Jindrich Novy - 6:6.0-1 - bump to container_libs_branch podman-6.0 - use RHEL-specific mounts.conf from common/contrib/redhat/ (container-libs#842) diff --git a/containers.conf b/containers.conf index 1725909..7f52238 100644 --- a/containers.conf +++ b/containers.conf @@ -416,6 +416,11 @@ default_sysctls = [ # via kernel splice, which preserves the original source IP address inside the # container. This option is experimental and subject to change. # +# Important: This option must only be changed when no containers are running. +# Switching while containers are active leads to port-forwarding rules being +# leaked or cleanup failures because the running netns was created with the +# previous setting. +# #rootless_port_forwarder = "rootlessport" # Path to the directory where network configuration files are located. diff --git a/containers.conf.5.md b/containers.conf.5.md index 52308be..2041c12 100644 --- a/containers.conf.5.md +++ b/containers.conf.5.md @@ -496,6 +496,10 @@ Valid options are `rootlessport` (default) and `pasta`. which preserves the original source IP address inside the container. The `pasta` option is **experimental** and subject to change. +**Important:** This option must only be changed when no containers are running. +Switching while containers are active leads to port-forwarding rules being leaked +or cleanup failures because the running netns was created with the previous setting. + **network_config_dir**="/etc/containers/networks" Path to the directory where network configuration files are located. diff --git a/seccomp.json b/seccomp.json index 6ccf86d..52bc237 100644 --- a/seccomp.json +++ b/seccomp.json @@ -418,6 +418,7 @@ "signalfd4", "sigprocmask", "sigreturn", + "socket", "socketcall", "socketpair", "splice", diff --git a/update.sh b/update.sh index 2bcd25a..569fcd5 100755 --- a/update.sh +++ b/update.sh @@ -28,9 +28,12 @@ for FILE in *; do exit 1 fi done -ensure storage.conf driver \"overlay\" -ensure storage.conf mountopt \"nodev,metacopy=on\" -ensure registries.conf unqualified-search-registries [\"registry.access.redhat.com\",\ \"registry.redhat.io\",\ \"docker.io\"] +# The following settings are now handled by vendor drop-in config files: +# 00-storage.conf sets driver, 00-storage-rootful.conf / 00-storage-rootless.conf +# set mountopt, and 00-rhel-registries.conf sets unqualified-search-registries. +#ensure storage.conf driver \"overlay\" +#ensure storage.conf mountopt \"nodev,metacopy=on\" +#ensure registries.conf unqualified-search-registries [\"registry.access.redhat.com\",\ \"registry.redhat.io\",\ \"docker.io\"] if pwd | grep -e rhel-8 -e c8s > /dev/null then @@ -58,9 +61,12 @@ ensure containers.conf runtime \"crun\" elif pwd | grep -e rhel-10 -e c10s > /dev/null then -ensure registries.conf short-name-mode \"enforcing\" -ensure containers.conf runtime \"crun\" -ensure storage.conf enable_partial_images \"false\" +# These settings are now handled by vendor drop-in config files: +# 00-rhel-registries.conf sets short-name-mode, 00-containers.conf sets runtime, +# and enable_partial_images upstream default is already "false". +#ensure registries.conf short-name-mode \"enforcing\" +#ensure containers.conf runtime \"crun\" +#ensure storage.conf enable_partial_images \"false\" else echo "Unknown release" fi