How to use idmap bind mounts? All experiments are failing

[johnson-earls]

I am running podman version 4.9.4 as root:

# podman version
Client:       Podman Engine
Version:      4.9.4-dev
API Version:  4.9.4-dev
Go Version:   go1.21.7 (Red Hat 1.21.7-1.module_el8+960+4060efbe)
Built:        Wed Feb 21 17:03:29 2024
OS/Arch:      linux/amd64

I need to mount a host directory into the container (using type=bind), but need to remap the UIDs of the files from 0 to 1000.

According to the documentation, the idmap option for --mount with type=bind takes a true or false option:

Options specific to bind and glob:

• idmap: true or false (default if unspecified: false). If true, create an idmapped mount to the target user namespace in the container.

So I tried this, but it failed:

# podman run -it --rm --entrypoint=bash --mount=type=bind,source=/var/log/containers,destination=/var/log/containers,readonly=true,idmap=true filebeat:8.11.4 -c 'ls -la /var/log/containers/gotenberg'
Error: unknown option "true"

Trying with the idmap format from the documented option for type=volume runs, but does not do the id mapping:

# podman run -it --rm --entrypoint=bash --mount=type=bind,source=/var/log/containers,destination=/var/log/containers,readonly=true,idmap=uids=0-1000-1 filebeat:8.11.4 -c 'ls -la /var/log/containers/gotenberg'
-rw-------. 1 root root 3414 Apr 26 14:53 /var/log/containers/gotenberg

How should this work?

[eriksjolund]

I created an issue

• parsing of --volume option idmap succeeds but parsing of option idmap=true fails with Error: unknown option "true" #24249

regarding the error

Error: unknown option "true"

---

For me it worked when I passed the option idmap instead of idmap=true

[keturn]

Did you ever figure this one out? It's still the case for me in podman 5.4. For example, I run

podman run -it --rm -v /mnt/my-stuff:/mnt/shared:idmap=uids=1000-1000-1 docker.io/ubuntu:rolling \
  ls -l /mnt/shared

but it shows everything under that mount as owned by root, not by user 1000.