PSA: tools/dev_container is now using rootless podman

94 views
Skip to first unread message

Dennis Kempin

unread,
Apr 13, 2023, 12:42:02 PM4/13/23
to crosvm-...@chromium.org, crosvm-core
Hi all,

we are finally able to make the switch to use rootless podman containers for development by default.

`tools/dev_container` will now use podman if it is installed. If you do not have podman installed, please do so. A simple `apt install podman` will do on most debian-ish systems.

Using podman, we no longer rely on privileged docker containers running as root, which comes with all kinds of security concerns.

Please let me know if you encounter any issues with the new container.

Thank you,
Dennis

Dennis Kempin

unread,
Apr 13, 2023, 1:34:56 PM4/13/23
to crosvm-...@chromium.org, crosvm-core
Podman needs to be set up to run rootless, which does not seem to be fully set up on all distributions.

Specifically, glinux does not automatically set up subuids. I will add some logic to our dev container tooling to automate this. 

In the meantime, please follow the rootless setup guide. Or in summary:
```
sudo usermod --add-subuids 500000-565535 --add-subgids 500000-565535 $USER
podman system migrate
```

Thank you!
Dennis
Reply all
Reply to author
Forward
0 new messages