What needs to be configured for a user to execute rootless Podman commands without using SSH?

Solution Verified - Updated -

Environment

  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux 10
  • podman executed as a non-root user

Issue

  • When using podman as a rootless user, typically that user must have gained access to the system via ssh in order to ensure all the correct settings and variables are in place for podman to execute properly under that user.
  • When using ssh to log in as a user, rootless podman commands work fine, however when using su or su - myuser, I get errors when running podman commands.
  • What settings must be enabled to ensure that a user does not need to use ssh to gain access to a system, but can still execute rootless podman commands?
  • Rootless podman commands fail with Error: could not get runtime: cannot re-exec process

Resolution

  • It is currently not supported by Red Hat to use rootless podman via another other means than using ssh to access the user you intend to execute podman as. Using su or su - is not a currently supported mechanism of rootless podman.
  • The following steps show a completely unsupported method of working around this, and as every user environment has the potential to be different, cannot be guaranteed to work or even troubleshot by Red Hat Support at this time.
  • Red Hat evaluated this request in RFE 1996757 and while we recognize that it is a valid request, we do not expect this to be implemented in the product in the foreseeable future. This is due to other priorities for the product and not a reflection of the request itself.

Unsupported Method of Allowing Rootless Users to Use Podman without SSH

Steps to configure rootless podman without requiring ssh

  • As the root user on the host, ensure session lingering is enabled for the user you intend to run rootless podman commands as (replacing $USER with your existing user's login):

    # loginctl enable-linger $UID

  • As the rootless user, ensure that upon login the XDG_RUNTIME_DIR environment variable is configured and points to your intended runroot directory for podman is. For example, using the default XDG_RUNTIME_DIR of /run/user/$UID, the following command could be executed to set this value at login time:

    $ echo "export XDG_RUNTIME_DIR=/run/user/$UID" >> ~/.bashrc

  • If you intend to use a different runroot for your rootless user's podman instance, adjust the path of the XDG_RUNTIME_DIR as needed and ensure it is set properly upon login.

  • As the rootless user, ensure that upon login it is possible for the user to access a dbus session by having the DBUS_SESSION_BUS_ADDRESS set to the proper path.

    • For a user with a UID of 1000, the proper path would be:
    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus

Root Cause

  • At this moment in time, the only expected working method of accessing podman commands as a rootless user is via using ssh, either directly to the system or to localhost.
  • When using ssh to log in to a host, quite a few variables are automatically configured as well as some additional systemd configurations.
  • When using su or su - to log in to a host, these values must be manually configured for rootless podman to function properly.

Diagnostic Steps

  • It is first best to log in via ssh to the host, including if it is just ssh localhost, to ensure that rootless podman can be properly executed and works as expected prior to seeing if su works.

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments