fstab mounts appear in podman unshare after reboot, but others don't

[arikw]

Description

After a system reboot, podman unshare shows fstab mounts, but subsequent non-fstab mounts do not appear. Additionally, attempting to unmount the existing fstab mounts within podman unshare fails.

Steps to Reproduce

1. Add a mount entry to /etc/fstab.
2. Reboot the system.
3. Run podman unshare mount and observe that the fstab mounts appear.
4. Perform additional mount operations (not via fstab).
5. Run podman unshare mount again and observe that these new mounts don't appear.
6. Attempt to unmount the fstab mounts inside podman unshare and notice the failure.

Expected Behavior

1. All mounts (including non-fstab mounts) should appear in podman unshare mount after reboot.
2. Unmounting the existing fstab mounts should work as expected.

Actual Behavior

• Only fstab mounts are shown after reboot.
• Non-fstab mounts do not appear.
• Unmounting fstab mounts inside podman unshare fails.

Version

• Podman: 5.3.2
• Kernel: 6.12.11-0-lts
• Distribution: Alpine Linux

Additional Information

host:
  arch: amd64
  buildahVersion: 1.38.1
  cgroupControllers:
  - cpuset
  - cpu
  - io
  - memory
  - hugetlb
  - pids
  cgroupManager: cgroupfs
  cgroupVersion: v2
  conmon:
    package: conmon-2.1.12-r0
    path: /usr/bin/conmon
    version: 'conmon version 2.1.12, commit: unknown'
  cpuUtilization:
    idlePercent: 99.35
    systemPercent: 0.36
    userPercent: 0.29
  cpus: 2
  databaseBackend: sqlite
  distribution:
    distribution: alpine
    version: 3.21.2
  eventLogger: file
  freeLocks: 2042
  hostname: localhost
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1001
      size: 1
    - container_id: 1
      host_id: 165536
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1001
      size: 1
    - container_id: 1
      host_id: 165536
      size: 65536
  kernel: 6.12.11-0-lts
  linkmode: dynamic
  logDriver: k8s-file
  memFree: 1619845120
  memTotal: 2073071616
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: aardvark-dns-1.13.1-r1
      path: /usr/libexec/podman/aardvark-dns
      version: aardvark-dns 1.13.1
    package: netavark-1.13.0-r1
    path: /usr/libexec/podman/netavark
    version: netavark 1.13.0
  ociRuntime:
    name: runc
    package: runc-1.2.2-r0
    path: /usr/bin/runc
    version: |-
      runc version 1.2.2
      commit: 7cb363254b69e10320360b63fb73e0ffb5da7bf2
      spec: 1.2.0
      go: go1.23.3
      libseccomp: 2.5.5
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt-2025.01.21-r0
    version: |
      pasta 2025_01_21.4f2c8e7
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /tmp/storage-run-1001/podman/podman.sock
  rootlessNetworkCmd: pasta
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /etc/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: false
  slirp4netns:
    executable: ""
    package: ""
    version: ""
  swapFree: 4143968256
  swapTotal: 4143968256
  uptime: 0h 39m 12.00s
  variant: ""
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - docker.io
store:
  configFile: /home/containeruser/.config/containers/storage.conf
  containerStore:
    number: 5
    paused: 0
    running: 0
    stopped: 5
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /home/containeruser/.local/share/containers/storage
  graphRootAllocated: 29246926848
  graphRootUsed: 5672333312
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Supports shifting: "false"
    Supports volatile: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 44
  runRoot: /tmp/storage-run-1001/containers
  transientStore: false
  volumePath: /home/containeruser/.local/share/containers/storage/volumes
version:
  APIVersion: 5.3.2
  Built: 1737597674
  BuiltTime: Thu Jan 23 04:01:14 2025
  GitCommit: ""
  GoVersion: go1.23.4
  Os: linux
  OsArch: linux/amd64
  Version: 5.3.2

Any insights would be appreciated.

[Luap99]

findmnt -R -o TARGET,PROPAGATION / if the mount propagtion is not shared the mounts will not be forwarded in the rootless podman mount namespace.

If you run the first rootless podman command it should even warn you if / is not shared

[arikw]

Thank you for your reply.

Here's additional information -

I can't really use findmnt, but I ran a similar command on the host:

localhost:~$ sudo cat /proc/self/mountinfo | grep cifs
38 27 0:30 / /mnt/smb/shared rw,relatime - cifs //192.168.1.100/shared rw,vers=3.0,sec=ntlmv2,cache=strict,username=podman,uid=1001,forceuid,gid=1001,forcegid,addr=192.168.1.100,file_mode=0700,dir_mode=0700,soft,nounix,serverino,mapposix,reparse=nfs,rsize=4194304,wsize=4194304,bsize=1048576,retrans=1,echo_interval=60,actimeo=1,closetimeo=1
36 27 0:30 / /mnt/tstmnt rw,relatime shared:2 - cifs //192.168.1.100/shared rw,vers=3.0,sec=ntlmv2,cache=strict,username=podman,uid=1001,forceuid,gid=1001,forcegid,addr=192.168.1.100,file_mode=0700,dir_mode=0700,soft,nounix,serverino,mapposix,reparse=nfs,rsize=4194304,wsize=4194304,bsize=1048576,retrans=1,echo_interval=60,actimeo=1,closetimeo=1

podman unshare:

/ $ cat /proc/self/mountinfo | grep cifs
59 42 0:30 / /mnt/smb/shared rw,relatime - cifs //192.168.1.100/shared rw,vers=3.0,sec=ntlmv2,cache=strict,username=podman,uid=1001,forceuid,gid=1001,forcegid,addr=192.168.1.100,file_mode=0700,dir_mode=0700,soft,nounix,serverino,mapposix,reparse=nfs,rsize=4194304,wsize=4194304,bsize=1048576,retrans=1,echo_interval=60,actimeo=1,closetimeo=1
/ $

/mnt/smb/shared exists on fstab and is visible inside podman unshare.
/mnt/tstmnt doesn't exist on fstab and isn't visible inside podman unshare.

Relevant fstab record:

localhost:~$ cat /etc/fstab | grep cifs
//192.168.1.100/shared /mnt/smb/shared cifs credentials=/home/containeruser/.smbcredentials,uid=1001,gid=1001,file_mode=0700,dir_mode=0700,vers=3.0,sec=ntlmv2 0 0

Manual mount:

localhost:~$ sudo mount -t cifs //192.168.1.100/shared /mnt/tstmnt/ -o credentials=/home/containeruser/.smbcredentials,uid=1001,gid=1001,file_mode=0700,dir_mode=0700,vers=3.0,sec=ntlmv2
localhost:~$ sudo mount --make-shared /mnt/tstmnt/

Permissions (on host):

localhost:~$ ls -ld /mnt/tstmnt/
drwx------    2 containeruser containeruser         0 Feb  1 22:26 /mnt/tstmnt/
localhost:~$ ls -ld /mnt/smb/shared/
drwx------    2 containeruser containeruser         0 Feb  1 22:26 /mnt/smb/shared/

The problam occurs also for regular mounts - it doesn't seem to be related to smb\cifs.

[arikw]

@Luap99 I'd really appreciate your thoughts on this

[arikw]

@rhatdan Any advice or direction you could provide would be greatly appreciated! Thanks in advance for your time and help!

[rhatdan]

Do a podman system migrate which will recreate the user namespace, then podman unshare should show the new mounts.

The first instance of podman for a rootless user, creates the user namespace and leaves a process inside of the user namespace. podman system migrate will remove the current user namespace and the next podman command will recreate it seeing the new mounts.