containers.podman.podman_unshare become – Run tasks using podman unshare¶
Note
This become plugin is part of the containers.podman collection (version 1.15.4).
It is not included in ansible-core
.
To check whether it is installed, run ansible-galaxy collection list
.
To install it, use: ansible-galaxy collection install containers.podman
.
To use it in a playbook, specify: containers.podman.podman_unshare
.
New in containers.podman 1.9.0
Synopsis¶
This become plugins allows your remote/login user to execute commands in its container user namespace. Official documentation: https://docs.podman.io/en/latest/markdown/podman-unshare.1.html
Parameters¶
Parameter |
Comments |
---|---|
Sudo executable Default: Configuration:
|
|
Password to pass to sudo Configuration:
|
|
User you ‘become’ to execute the task (‘root’ is not a valid value here). Configuration:
|
Examples¶
- name: checking uid of file 'foo'
ansible.builtin.stat:
path: "{{ test_dir }}/foo"
register: foo
- ansible.builtin.debug:
var: foo.stat.uid
# The output shows that it's owned by the login user
# ok: [test_host] => {
# "foo.stat.uid": "1003"
# }
- name: mounting the file to an unprivileged container and modifying its owner
containers.podman.podman_container:
name: chmod_foo
image: alpine
rm: true
volume:
- "{{ test_dir }}:/opt/test:z"
command: chown 1000 /opt/test/foo
# Now the file 'foo' is owned by the container uid 1000,
# which is mapped to something completaly different on the host.
# It creates a situation when the file is unaccessible to the host user (uid 1003)
# Running stat again, debug output will be like this:
# ok: [test_host] => {
# "foo.stat.uid": "328679"
# }
- name: running stat in modified user namespace
become_method: containers.podman.podman_unshare
become: true
ansible.builtin.stat:
path: "{{ test_dir }}/foo"
register: foo
# By gathering file stats with podman_ushare
# we can see the uid set in the container:
# ok: [test_host] => {
# "foo.stat.uid": "1000"
# }
- name: resetting file ownership with podman unshare
become_method: containers.podman.podman_unshare
become: true
ansible.builtin.file:
state: file
path: "{{ test_dir }}/foo"
owner: 0 # in a modified user namespace host uid is mapped to 0
# If we run stat and debug with 'become: false',
# we can see that the file is ours again:
# ok: [test_host] => {
# "foo.stat.uid": "1003"
# }
Authors¶
Janos Gerzson (@grzs)
Hint
Configuration entries for each entry type have a low to high priority order. For example, a variable that is lower in the list will override a variable that is higher up.