This happened to me as well on microos

I can't reproduce this on my TW machine. I'm not familiar with distrobox, is

 % DBX_CONTAINER_MANAGER="podman" distrobox create foo
 % DBX_CONTAINER_MANAGER="podman" distrobox enter foo

a reasonable way of testing for the issue?

Upstream runc has integration tests for rootless containers, and as one of the upstream maintainers I develop runc on openSUSE and have not seen any issues using runc (1.2.0~rc1 or during its development) on openSUSE, so it seems more likely there is something about distrobox's configuration which started breaking with a newer runc version.

Reproducer from Aeon (ie Tumbleweed MicroOS):

DBX_CONTAINER_MANAGER="podman" distrobox create --image fedora:latest --name fedora -a "--runtime runc"

DBX_CONTAINER_MANAGER="podman" distrobox enter fedora


this will fail at "enter" command.

However:

distrobox rm -f fedora (to do the cleanup)


DBX_CONTAINER_MANAGER="podman" distrobox create --image fedora:latest --name fedora -a "--runtime crun"

DBX_CONTAINER_MANAGER="podman" distrobox enter fedora

will work nicely

I can reproduce that yes

This seems also (from a quick test) NOT related to selinux.

It seems like runc has some permission enforcement, probably related
to some breaking changes introduced upstream:

https://github.com/opencontainers/runc/commit/d4b670fca6d0ac606777376440ffe49686ce15f4

---

Will need to find a fix (in my upstream) because mounting /:/run/host is an integral part of distrobox, and likely of any toolbox implementation (be it MicroOS, CoreOS, Fedora and so on)

Can we link this ticket to an issue upstream?

After a further investigation, it seems it really is related to that breaking change

mounting as ":rslave" something that is :ro, will output that error

---

Changing the code for mounting the rootfs into this:

	for rootdir in /*; do
		if findmnt --notruncate --noheadings --list --output OPTIONS --target "${rootdir}" |
			tr ',' '\n' | grep -q "^ro$"; then

			result_command="${result_command}
				--volume ${rootdir}:/run/host/${rootdir}:ro,rslave"
		else
			result_command="${result_command}
				--volume ${rootdir}:/run/host/${rootdir}:rslave"
		fi
	done

Will indeed fix the problem as the different :ro mountpoints are correctly mounted as such:

--volume /bin:/run/host/bin:ro,rslave
--volume /boot:/run/host/boot:ro,rslave
--volume /dev:/run/host/dev:rslave
--volume /etc:/run/host/etc:rslave
--volume /home:/run/host/home:rslave
--volume /lib:/run/host/lib:ro,rslave
--volume /lib64:/run/host/lib64:ro,rslave
--volume /mnt:/run/host/mnt:ro,rslave
--volume /opt:/run/host/opt:rslave
--volume /proc:/run/host/proc:rslave
--volume /root:/run/host/root:rslave
--volume /run:/run/host/run:rslave
--volume /sbin:/run/host/sbin:ro,rslave
--volume /srv:/run/host/srv:rslave
--volume /sys:/run/host/sys:rslave
--volume /tmp:/run/host/tmp:rslave
--volume /usr:/run/host/usr:ro,rslave
--volume /var:/run/host/var:rslave

This is a fix that will be added on (my) upstream

Fixed in commit f031b8e8176c9c8a877389591c4732d2eeee78ea

Will be part of next release

Fix has been released
https://github.com/89luca89/distrobox/releases/tag/1.7.2.0

Any hints on when this fix will land on Tumbleweed?

(In reply to Luca Di Maio from comment #5)
> After a further investigation, it seems it really is related to that
> breaking change
> 
> mounting as ":rslave" something that is :ro, will output that error

runc treats propagation flags and mount options separately, this is odd. I'll see if I can come up with a test using runc directly (I don't know what podman is doing to the mount options before giving them to runc).

> ---
> 
> Changing the code for mounting the rootfs into this:
> 
> 	for rootdir in /*; do
> 		if findmnt --notruncate --noheadings --list --output OPTIONS --target
> "${rootdir}" |
> 			tr ',' '\n' | grep -q "^ro$"; then
> 
> 			result_command="${result_command}
> 				--volume ${rootdir}:/run/host/${rootdir}:ro,rslave"
> 		else
> 			result_command="${result_command}
> 				--volume ${rootdir}:/run/host/${rootdir}:rslave"
> 		fi
> 	done

rro,rslave might be a less painful way of doing this. runc 1.1.0 and later support this though it requires Linux 5.12.