Skip to content

Conversation

@fkerem
Copy link
Member

@fkerem fkerem commented Jun 23, 2025

This PR enhances the setup.sh script by checking for the required SUID bits on /usr/bin/newuidmap and /usr/bin/newgidmap. These permissions are necessary for rootless Podman containers to function properly when using user namespaces.

Rootless Podman requires the newuidmap and newgidmap binaries to have the SetUID bit enabled so that unprivileged users can map UID/GID ranges during container startup.

Without this, SPRING services relying on rootless containers may fail silently or exhibit permission-related issues.

Changelog:

  • Checks whether both binaries have the correct SUID bit using [ -u FILE ].
  • If not set:
    • Prompts the user to fix the issue with sudo chmod u+s.
    • Exits if the user declines, ensuring misconfigured environments don’t proceed.

@fkerem
Copy link
Member Author

fkerem commented Jun 24, 2025

In Digital Ocean's Fedora 41, this doesn't work. This was the solution instead:

sudo chmod u-s /usr/bin/new[gu]idmap
sudo setcap cap_setuid+eip /usr/bin/newuidmap
sudo setcap cap_setgid+eip /usr/bin/newgidmap

I'll create a PR to update the readme.

@fkerem fkerem closed this Jun 24, 2025
@fkerem
Copy link
Member Author

fkerem commented Jun 24, 2025

This can now be merged as well. An alternative solution for Fedora 41+ is documented in the Troubleshooting section of README.md as part of PR #4 .

@fkerem fkerem reopened this Jun 24, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant