maggesandClaude Sonnet 5
51b7262b72
First live end-to-end install on real Unraid hardware (all 8 built
packages installed via upgradepkg, rc.podman started, containers
pulled/run/networked/port-mapped) — surfaced five genuine bugs no
amount of container-based CI testing could have caught, since none of
them exist inside the vbatts/slackware:15.0 build container:
1. rc.podman never created $PODMAN_LOG_DIR before redirecting the
podman system service's output into it, so the service failed to
even start ("No such file or directory"). Added it alongside the
existing PODMAN_RUN_DIR mkdir.
2. config/storage.conf hardcoded a [storage] table, and
podman-config.sh's `sync` step appended a second one at boot with
the real graphroot/runroot — TOML forbids defining the same table
twice. Removed the template's [storage] entirely; sync already
generates the whole thing.
3. config/policy.json had a "_comment" pseudo-field for
documentation, but containers/image's policy parser rejects any
unknown top-level key outright. JSON has no comment syntax; moved
the rationale into docs/ARCHITECTURE.md instead.
4. netavark >= 2.0 dropped its iptables firewall driver entirely
(verified: passing "iptables" is flatly rejected) — nftables or
firewalld are the only remaining options, and firewalld needs
systemd/dbus, which Unraid has neither of. Set firewall_driver =
"nftables" explicitly and documented that Unraid OS doesn't ship
the `nft` binary this needs (a slackware64 nftables package works;
not yet wired into the build/install pipeline — see follow-up).
5. Every container failed with "crun: pivot_root: Invalid argument".
Root cause: Unraid's / is permanently the kernel's initial "rootfs"
pseudo-filesystem (Unraid never pivots to a real one at boot — the
whole OS runs from RAM), and pivot_root(2) unconditionally rejects
that as the old root. This is not new: Docker/runc hits the exact
same kernel restriction on this exact host and silently falls back
to an MS_MOVE-based chroot; crun has no such fallback, only a
--no-pivot flag with no config-file equivalent. Added
plugin/sbin/crun-no-pivot.sh, a thin wrapper that scans crun's full
argument list (podman puts global flags before the subcommand, so
the subcommand isn't reliably $1) and injects --no-pivot right
after create/run, and pointed containers.conf's crun runtime at it.
Also fixed the podman.plg postinstall's chmod glob
(`podman-*.sh` -> `*.sh`), which would have skipped this new
non-podman-prefixed sbin script.
Verified end-to-end on the real host: pull, run, real network
connectivity (wget through the container's bridge), and a published
port actually serving HTTP (curl through -p 8099:80 to nginx) all
work. --no-pivot's security tradeoff (disabling one particular
container-escape mitigation) was explicitly discussed with and
approved by the user before committing, given it must be the default
for any container to start at all on this platform.
Follow-up not yet done: nftables (needed for #4) is not yet a
packages/ component in the reproducible build pipeline — it was only
installed manually on the test host for this verification run.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
48 lines
2.3 KiB
Plaintext
48 lines
2.3 KiB
Plaintext
# Default containers.conf template for unraid-podman.
|
|
#
|
|
# This is a source template shipped in the repository/package. At install/boot
|
|
# time it is copied to /boot/config/plugins/podman/containers.conf (if not
|
|
# already present, never overwritten on update) and from there synced to
|
|
# /etc/containers/containers.conf by rc.podman start.
|
|
#
|
|
# See docs/ARCHITECTURE.md section 6.1 (Start-/Stop-Skripte) and section 7
|
|
# (Persistenz-Strategie). Placeholder — real defaults to be tuned during MVP
|
|
# implementation.
|
|
#
|
|
# Full reference: https://github.com/containers/common/blob/main/docs/containers.conf.5.md
|
|
|
|
[containers]
|
|
# TODO: default ulimits, log driver (k8s-file, see docs/ARCHITECTURE.md section 15), etc.
|
|
|
|
[engine]
|
|
# TODO: static_dir / volume_path / runroot overrides pointing at the cache-pool
|
|
# backed storage location instead of RAM-root defaults.
|
|
|
|
[engine.runtimes]
|
|
# Unraid's / is the kernel's initial 'rootfs' pseudo-filesystem — Unraid
|
|
# never pivots to a real one during boot, the whole OS runs from RAM — and
|
|
# pivot_root(2) unconditionally rejects that as the "old root" (EINVAL).
|
|
# runc (what Docker uses) silently falls back to an MS_MOVE-based chroot
|
|
# in that situation; crun has no such fallback, only a --no-pivot flag on
|
|
# `create`/`run` with no config-file equivalent — so podman is pointed at
|
|
# a thin wrapper (installed by the unraid-podman package, see
|
|
# plugin/sbin/crun-no-pivot.sh) that injects it, instead of crun directly.
|
|
# Verified live: without this, every container fails with
|
|
# "crun: pivot_root: Invalid argument: OCI runtime error".
|
|
crun = ["/usr/local/sbin/crun-no-pivot.sh"]
|
|
|
|
[network]
|
|
# TODO: default subnet range distinct from Docker's docker0 range — see
|
|
# docs/ARCHITECTURE.md section 8.
|
|
#
|
|
# netavark >= 2.0 dropped its iptables firewall driver entirely — only
|
|
# nftables and firewalld remain (verified against the actual netavark
|
|
# binary; "iptables" is rejected with "Must provide a valid firewall
|
|
# backend"). firewalld needs systemd/dbus, which Unraid has neither of, so
|
|
# nftables (netavark's own default — explicit here so that stays true even
|
|
# if netavark's default ever changes) is the only viable driver. Unraid OS
|
|
# does not ship the `nft` binary this needs — see docs/ARCHITECTURE.md
|
|
# section 8 for how it's provisioned.
|
|
network_backend = "netavark"
|
|
firewall_driver = "nftables"
|