I'm trying to design a podmod container that can run fuse inside, for example to use sshfs or run some appimages.

However I get errors:

fusermount: mount failed: Operation not permitted

Any idea what's wrong? I tried to use --device fuse and the host is running a recent kernel 5.4.77 (running NixOs)

My Dockerfile:

FROM ubuntu:latest
# podman3 has docker-compose
# But this may be more efficient: https://podman.io/blogs/2018/12/03/podman-runlabel.html
# Nope, can't find how to use $HOME
RUN apt update -y && apt install -y mesa-utils clinfo intel-opencl-icd ocl-icd-opencl-dev inetutils-ping sshfs
RUN apt install -y libglu1-mesa libgomp1 wget curl libsm6 libxrender1 libxext6
RUN apt install -y libxi6 libxrender1 libxrandr2 libxcursor1 libxinerama1
RUN apt-get install -y -qq --no-install-recommends \
    libglvnd0 \
    libgl1 \
    libglx0 \
    libegl1 \
    libxext6 \

Commands to run:

podman build -t myimage:latest -f Dockerfile
# TODO: check better solution than allowing everybody. +local?
xhost +
podman run -P -v /tmp/.X11-unix:/tmp/.X11-unix\
    -v $HOME/.Xauthority:/root/.Xauthority\
    --device /dev/snd\
    --device /dev/input\
    --device /dev/dri\
    --device /dev/fuse\
    -v /dev/shm:/dev/shm\
    --volume /etc/localtime:/etc/localtime:ro\
    -v /home:/home\
    -v /mnt:/mnt\
    -v /nix:/nix\
    -h $HOSTNAME\
    --rm -it  myimage:latest

Commands that fail and that are expected to work:

$ sshfs -v me@myhost:~/ /tmp/host
fusermount: mount failed: Operation not permitted

Second example:

$ cd /tmp
$ wget https://github.com/littleweeb/Desktop/releases/download/v0.4.0_linux/LittleWeeb-
$ chmod +x LittleWeeb-
$ ./LittleWeeb-
fusermount: mount failed: Operation not permitted

Some sanity checks inside the container:

$ ls -al /dev/fuse
crw-rw-rw- 1 nobody nogroup 10, 229 Dec 18 10:28 /dev/fuse

I tried to strace the sshfs and the first error I can see is on:

mount("me@myhost:~/", "/tmp/host", "fuse.sshfs", MS_NOSUID|MS_NODEV, "fd=3,rootmode=40000,user_id=0,gr"...) = -1 EPERM (Operation not permitted)

To use fuse, the user needs to be privileged. There a couple of options for granting the privilege: using setuid or using capabilities. I tried only the setuid way: the fusermount binary must be setuid root:

chown root:root $(which fusermount3)
sudo chmod u+s $(which fusermount3)
ls -l $(which fusermount3)
-rws--x--x 1 root root 39416 Apr 24 11:50 /home/acolin/gpref/usr/bin/fusermount3

The same issue arises with fuse installed inside Gentoo Prefix.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.