Buildah: rootless buildah bud fails due to filesystem capabilities

Created on 19 Feb 2020 · 13Comments · Source: containers/buildah

Description
buildah bud fails to build containers that set capabilities inside them. podman build on the same machine, succeeds.

FROM centos:7

RUN yum -y install epel-release
RUN yum -y install fping

buildah

Running transaction
  Installing : fping-3.10-4.el7.x86_64                                                                                               1/1 
Error unpacking rpm package fping-3.10-4.el7.x86_64
error: unpacking of archive failed on file /usr/sbin/fping;5e4d84b7: cpio: cap_set_file
  Verifying  : fping-3.10-4.el7.x86_64                                                                                               1/1 

Failed:
  fping.x86_64 0:3.10-4.el7

Steps to reproduce the issue:

Build minimal example using "buildah bud" as non-root user
Build again as "podman build"
Watch difference

Describe the results you received:
Container fails due to cap_set_file

Describe the results you expected:
Successful container. It has worked before.

Output of rpm -q buildah or apt list buildah:

podman-1.8.0-2.fc31.x86_64
buildah-1.14.0-2.fc31.x86_64

Output of buildah version:

Version:         1.14.0
Go Version:      go1.13.6
Image Spec:      1.0.1-dev
Runtime Spec:    1.0.1-dev
CNI Spec:        0.4.0
libcni Version:  
image Version:   5.2.0
Git Commit:      
Built:           Thu Jan  1 01:00:00 1970
OS/Arch:         linux/amd64

Output of podman version if reporting a podman build issue:

Version:            1.8.0
RemoteAPI Version:  1
Go Version:         go1.13.6
OS/Arch:            linux/amd64

Output of cat /etc/*release:

Fedora release 31 (Thirty One)
NAME=Fedora
VERSION="31 (Workstation Edition)"
ID=fedora
VERSION_ID=31
VERSION_CODENAME=""
PLATFORM_ID="platform:f31"
PRETTY_NAME="Fedora 31 (Workstation Edition)"
ANSI_COLOR="0;34"
LOGO=fedora-logo-icon
CPE_NAME="cpe:/o:fedoraproject:fedora:31"
HOME_URL="https://fedoraproject.org/"
DOCUMENTATION_URL="https://docs.fedoraproject.org/en-US/fedora/f31/system-administrators-guide/"
SUPPORT_URL="https://fedoraproject.org/wiki/Communicating_and_getting_help"
BUG_REPORT_URL="https://bugzilla.redhat.com/"
REDHAT_BUGZILLA_PRODUCT="Fedora"
REDHAT_BUGZILLA_PRODUCT_VERSION=31
REDHAT_SUPPORT_PRODUCT="Fedora"
REDHAT_SUPPORT_PRODUCT_VERSION=31
PRIVACY_POLICY_URL="https://fedoraproject.org/wiki/Legal:PrivacyPolicy"
VARIANT="Workstation Edition"
VARIANT_ID=workstation
Fedora release 31 (Thirty One)
Fedora release 31 (Thirty One)

Output of uname -a:

(paste your output here)

Output of cat /etc/containers/storage.conf:

Linux nerk 5.4.18-200.fc31.x86_64 #1 SMP Fri Feb 7 14:50:05 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

Podman info

host:
  BuildahVersion: 1.13.1
  CgroupVersion: v2
  Conmon:
    package: conmon-2.0.10-2.fc31.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.0.10, commit: 6b526d9888abb86b9e7de7dfdeec0da98ad32ee0'
  Distribution:
    distribution: fedora
    version: "31"
  IDMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
  MemFree: 5994844160
  MemTotal: 33667923968
  OCIRuntime:
    name: crun
    package: crun-0.12.1-1.fc31.x86_64
    path: /usr/bin/crun
    version: |-
      crun version 0.12.1
      commit: df5f2b2369b3d9f36d175e1183b26e5cee55dd0a
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +YAJL
  SwapFree: 16936595456
  SwapTotal: 16936595456
  arch: amd64
  cpus: 16
  eventlogger: journald
  hostname: nerk
  kernel: 5.4.18-200.fc31.x86_64
  os: linux
  rootless: true
  slirp4netns:
    Executable: /usr/bin/slirp4netns
    Package: slirp4netns-0.4.0-20.1.dev.gitbbd6f25.fc31.x86_64
    Version: |-
      slirp4netns version 0.4.0-beta.3+dev
      commit: bbd6f25c70d5db2a1cd3bfb0416a8db99a75ed7e
  uptime: 54h 16m 35.54s (Approximately 2.25 days)
registries:
  search:
  - docker.io
  - registry.fedoraproject.org
  - registry.access.redhat.com
  - registry.centos.org
  - quay.io
store:
  ConfigFile: /home/spider/.config/containers/storage.conf
  ContainerStore:
    number: 6
  GraphDriverName: overlay
  GraphOptions:
    overlay.mount_program:
      Executable: /usr/bin/fuse-overlayfs
      Package: fuse-overlayfs-0.7.5-2.fc31.x86_64
      Version: |-
        fusermount3 version: 3.6.2
        fuse-overlayfs: version 0.7.5
        FUSE library version 3.6.2
        using FUSE kernel interface version 7.29
  GraphRoot: /home/spider/.local/share/containers/storage
  GraphStatus:
    Backing Filesystem: btrfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Using metacopy: "false"
  ImageStore:
    number: 46
  RunRoot: /run/user/1000
  VolumePath: /home/spider/.local/share/containers/storage/volumes

buildah info
{
    "host": {
        "CgroupVersion": "v2",
        "Distribution": {
            "distribution": "fedora",
            "version": "31"
        },
        "MemTotal": 33667923968,
        "MenFree": 5950418944,
        "OCIRuntime": "crun",
        "SwapFree": 16936595456,
        "SwapTotal": 16936595456,
        "arch": "amd64",
        "cpus": 16,
        "hostname": "nerk",
        "kernel": "5.4.18-200.fc31.x86_64",
        "os": "linux",
        "rootless": true,
        "uptime": "54h 16m 32.97s (Approximately 2.25 days)"
    },
    "store": {
        "ContainerStore": {
            "number": 6
        },
        "GraphDriverName": "overlay",
        "GraphOptions": [
            "overlay.mount_program=/usr/bin/fuse-overlayfs"
        ],
        "GraphRoot": "/home/spider/.local/share/containers/storage",
        "GraphStatus": {
            "Backing Filesystem": "btrfs",
            "Native Overlay Diff": "false",
            "Supports d_type": "true",
            "Using metacopy": "false"
        },
        "ImageStore": {
            "number": 46
        },
        "RunRoot": "/run/user/1000"
    }
}

Source

Spindel

👍1

Most helpful comment

that happens because Podman uses by default these capabilities:

cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap

while Buildah uses: cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write

It used to be the same set in Buildah, it is a regression introduced with 09d1c24e3dd4c5c3071a3088dc0d600d929ba8ec

I've opened a PR here: https://github.com/containers/common/pull/69

giuseppe on 20 Feb 2020

👍2

All 13 comments

@Spindel thanks for the report. Can you try the same buildah bud command again, but this time include the --layers option? That option is set to false by default in Buildah, and to true by default in Podman FWIW.

TomSweeneyRedHat on 19 Feb 2020

This works:

podman system prune -f
podman build --no-cache .

This fails:

podman build --no-cache . ( I cant figure out how to do that with buildah)
buildah bud --layers .

Spindel on 19 Feb 2020