Running "podman build" for a very simple Dockerfile (inside a rootless container)... tries to make a ping call?

[castarco]

Hi. I'm running a rootless (although with the root user mapped inside) podman container... and, given the following Dockerfile placed inside the container:

FROM docker.io/ubuntu:24.04

RUN echo "hello world"

When I try to run the command

podman build . -t myimage:latest

I get this strange error message:

error running container: from /usr/bin/crun creating container for [/bin/sh -c echo "hello world"]: open `/proc/sys/net/ipv4/ping_group_range`: Read-only file system

which... I don't understand. I don't see how running echo "hello world" would require network capabilities (ping). I was expecting problems, but certainly not this.

For more context, I'm running the rootless container like this (I had different errors before I added these 3 capabilities and the --device option):

podman run --rm -ti --cap-add=sys_admin,mknod,net_admin --device=/dev/fuse myregistry/ubuntu:24.04 bash

Note: the pull operation for the FROM clause is successful.
Note 2: The same happens when using buildah instead of podman build.

[eriksjolund]

I tried

1. log in as an unprivileged user on Fedora 42
2. mkdir dir
3. cd dir
4. create file ~/dir/Containerfile containing

   FROM docker.io/ubuntu:24.04
   RUN echo "hello world"
   

5. Run command

   podman run -q --device /dev/fuse -v .:/src:z -w /src \
        --rm quay.io/buildah/stable bash -c 'buildah build -t test .'
   

   The following output is printed

   STEP 1/2: FROM docker.io/ubuntu:24.04
   Trying to pull docker.io/library/ubuntu:24.04...
   Getting image source signatures
   Copying blob sha256:4b3ffd8ccb5201a0fc03585952effb4ed2d1ea5e704d2e7330212fb8b16c86a3
   Copying config sha256:97bed23a34971024aa8d254abbe67b7168772340d1f494034773bc464e8dd5b6
   Writing manifest to image destination
   STEP 2/2: RUN echo "hello world"
   hello world
   COMMIT test
   Getting image source signatures
   Copying blob sha256:073ec47a8c22dcaa4d6e5758799ccefe2f9bde943685830b1bf6fd2395f5eabc
   Copying blob sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef
   Copying config sha256:9fd616cb9b05f032b106ecb4714bfaab13b6077e194b3d7aff94b661ea90cfa6
   Writing manifest to image destination
   --> 9fd616cb9b05
   Successfully tagged localhost/test:latest
   9fd616cb9b05f032b106ecb4714bfaab13b6077e194b3d7aff94b661ea90cfa6
   

   result: Building the container image succeeded

I'm not quite sure if this is the way to run buildah in a container but at least it works.

See also the instructions in
https://quay.io/repository/buildah/stable?tab=info

Mayb you could compare your container image myregistry/ubuntu:24.04 with quay.io/buildah/stable to see
how they differ?

Curious question, does it help if you use

FROM docker.io/ubuntu:24.04
RUN --network=none echo "hello world"

[castarco]

I still have to investigate many details of this whole ordeal, but passing the --network=none option to the RUN statement helped, I managed to create the image (without changing anything else).

I fear I might have unknowingly installed something untrustworthy in that image, I'll try again with the Ubuntu base image, without my extra tooling.

EDIT: what I said about shady software... doesn't make sense, that echo runs inside a base image without any changes on my side.

EDIT 2: While it can serve as a workaround for very simple cases... as soon as one needs to download anything from the Internet we cannot do that anymore, and it fails again because of that "something" that is trying to make ping calls.

EDIT 3: The image quay.io/buildah/stable works well for me as you mentioned. Although I'll have to keep looking to understand what makes it behave differently from mine when building OCI images, as I need the Debian/Ubuntu tooling.

[eriksjolund]

Although I'll have to keep looking to understand what makes it behave differently from mine when building OCI images, as I need the Debian/Ubuntu tooling.

It looks like quay.io/buildah/stable is built from the Containerfile
https://github.com/containers/image_build/blob/main/buildah/Containerfile