rootless podman run --device /dev/fuse:/dev/fuse1 is broken.

[rhatdan]

$ podman run --device /tmp/fuse:/dev/fuse1 fedora ls -l /dev/fuse1
Error: cannot stat /tmp/fuse:/dev/fuse1: stat /tmp/fuse: no such file or directory
[dwalsh@localhost libpod]$ ./bin/podman run --device /dev/fuse:/dev/fuse1 fedora ls -l /dev/fuse1
Error: time="2019-08-29T07:32:02-04:00" level=warning msg="exit status 1"
time="2019-08-29T07:32:02-04:00" level=error msg="container_linux.go:346: starting container process caused \"process_linux.go:446: container init caused \\\"rootfs_linux.go:70: creating device nodes caused \\\\\\\"no such file or directory\\\\\\\"\\\"\"\n"
container_linux.go:346: starting container process caused "process_linux.go:446: container init caused \"rootfs_linux.go:70: creating device nodes caused \\\"no such file or directory\\\"\"": OCI runtime command not found error

Looks like when their is a rename operation code attempts to create a device node rather then just setting up a bind mount from the host.

[rhatdan]

Did a quick scan of the code to find out how this works in rootless mode, and so far have not found it.

[giuseppe]

in the OCI config file it is converted to:

    "devices": [
      {
        "path": "/dev/fuse1",
        "type": "c",
        "major": 10,
        "minor": 229,
        "fileMode": 8630,
        "uid": 65534,
        "gid": 65534
      }
    ]

the OCI runtime should try to list all the devices to find the correct bind mount.

I think it is safer to fix it in Podman, and when running in rootless mode automatically create the bind mount instead of the device.

[rhatdan]

Yes, we have a similar issue with BUILDAH_ISOLATION=chroot.

[giuseppe]

opened a PR: #3909