location of short-name-aliases.conf

[proutrc]

Hello,

I wanted to start this discussion to see if there is any way to control the short-name-aliases.conf file location. I work in an HPC environment in which $HOME is read-only from our compute nodes. When trying to build on these compute nodes, with Podman, we get errors like this:

"/autofs/nccs-svm1_home2/rprout/.config/.cache/containers/short-name-aliases.conf.lock": read-only file system

If I build on the login node, where $HOME is writable, I don't see this of course. But, often times we have builds that get killed by the cgroup limits on the login nodes. So, we try and build on the compute node but see the above issue where short-name-aliases.conf is RO from the compute node (due to it being in $HOME).

It is unclear to me if I can change the location of this file, as a rootless user. I wanted to start a discussion about this first, in case I am missing something, but it could require an issue to be opened.

We would really love to boost our ability to support rootless container builds, via Podman, on our HPC systems.

[mheon]

@vrothberg PTAL when you're back from PTO

[rhatdan]

I thought we had a fix for this.

sudo mount --bind -o ro /home/dwalsh/.config/.cache/containers/ /home/dwalsh/.config/.cache/containers/
$ podman -v
podman version 3.2.3
$ podman pull httpd
✔ docker.io/library/httpd:latest
Trying to pull docker.io/library/httpd:latest...
Getting image source signatures
Copying blob d74938eee980 done  
Copying blob 33847f680f63 done  
Copying blob a8c75048351a done  
Copying blob 763d74736d95 done  
Copying blob 963cfdce5a0c done  
Copying config bde40dcb22 done  
Writing manifest to image destination
Storing signatures
bde40dcb22a7a82392a45bcc7f191bb2f807d57711934d4eda869d3d649a3643
$ touch /home/dwalsh/.config/.cache/containers/short-name-aliases.conf
touch: cannot touch '/home/dwalsh/.config/.cache/containers/short-name-aliases.conf': Read-only file system

Seems to work with current podman?

[proutrc]

@rhatdan Thanks for pointing that out - we are running 3.0.0. We are working on an upgrade and will confirm.

[proutrc]

Here is what we see from our specific compute node, still seems to be an issue (now using Podman 3.2.3, as pointed out below):

bash-4.4$ jsrun -n1 podman --version
podman version 3.2.3

bash-4.4$ jsrun -n 1 touch $HOME/test.touch
touch: cannot touch '/ccs/home/rprout/test.touch': Read-only file system

bash-4.4$ jsrun -n 1 -n1 podman pull httpd
Warning, specify multiple instances of the same option to jsrun, take the last one
time="2021-08-11T14:23:45-04:00" level=error msg="cannot find UID/GID for user rprout: No subuid ranges found for user \"rprout\" in /etc/subuid - check rootless mode in man pages."
time="2021-08-11T14:23:45-04:00" level=warning msg="using rootless single mapping into the namespace. This might break some images. Check /etc/subuid and /etc/subgid for adding sub*ids"
Error: mkdir /ccs/home/rprout/.cache/containers: read-only file system
time="2021-08-11T14:23:45-04:00" level=error msg="failed to kill 1488176"

Although the complaint here different, in terms of mkdir here, but revolves around the RO issue. Maybe we are missing something else?

[proutrc]

Further update, which gets me to the original error around the shot-name-aliases.conf file.

If I do the initial pull from the login node, like so, it creates the intitial directory structure on $HIOME and works (we have RW on login node:

[[email protected] ~]$ podman pull docker.io/library/httpd:latest
Trying to pull docker.io/library/httpd:latest...
Getting image source signatures
Copying blob 02fb3ad84302 done  
Copying blob 1130517d52da done  
Copying blob fe5473a86ea6 done  
Copying blob 2bccf9377eb1 done  
Copying blob 1eb5c3f27827 done  
Copying config b7ef02c4d1 done  
Writing manifest to image destination
Storing signatures
b7ef02c4d14ad8f5aa1bef5bcd5e433c5a28b78ffa7989dfb95118d5d46dfd43

I then go back to the compute node attempt and see the original issue about short-name-aliases file:

bash-4.4$ jsrun -n1 podman pull httpd
time="2021-08-11T14:30:51-04:00" level=error msg="cannot find UID/GID for user rprout: No subuid ranges found for user \"rprout\" in /etc/subuid - check rootless mode in man pages."
time="2021-08-11T14:30:51-04:00" level=warning msg="using rootless single mapping into the namespace. This might break some images. Check /etc/subuid and /etc/subgid for adding sub*ids"
Error: error opening "/ccs/home/rprout/.cache/containers/short-name-aliases.conf.lock": read-only file system

[rhatdan]

If you set XDG_CACHE_HOME to some other directory, you should be able to move forward.

[rhatdan]

$ podman (codespell) $ podman pull nginx
Error: mkdir /home/dwalsh/.cache/containers: read-only file system
$  XDG_CACHE_HOME=/tmp/dan podman pull nginx
Trying to pull docker.io/library/nginx:latest...
Getting image source signatures
Copying blob 1f41b2f2bf94 skipped: already exists  
Copying blob 33847f680f63 skipped: already exists  
Copying blob dbb907d5159d skipped: already exists  
Copying blob b10cf527a02d skipped: already exists  
Copying blob c90b090c213b skipped: already exists  
Copying blob 8a268f30c42a [--------------------------------------] 0.0b / 0.0b
Copying config 08b152afcf done  
Writing manifest to image destination
Storing signatures
08b152afcfae220e9709f00767054b824361c742ea03a9fe936271ba520a0a4b

[rhatdan]

cat /tmp/dan/containers/short-name-aliases.conf*
[aliases]
nginx = "docker.io/library/nginx"

[rhatdan]

$ XDG_CACHE_HOME=/tmp/dan podman rmi nginx
Untagged: docker.io/library/nginx:latest
Deleted: 08b152afcfae220e9709f00767054b824361c742ea03a9fe936271ba520a0a4b

[proutrc]

Thanks @rhatdan that has me on the right track now. I was indeed overlooking something.