Machine-scope installation (ALLUSERS=1) writes PATH to installing user's HKCU instead of system PATH

[AlexVF26]

Issue Description

For a machine-scope installation (ALLUSERS=1), the installer should add the Podman installation directory to the system PATH: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\Path
so that Podman is available for all users on the device, but Instead, the PATH entry is written to: HKCU\Environment\Path

Steps to reproduce the issue

Steps to reproduce the issue

1. Install Podman MSI in System Context as machine-wide installation: msiexec /i podman-installer-windows-amd64.msi ALLUSERS=1
2. Try to run podman info as different user - it will fail.

Describe the results you received

Observed behavior

• Podman installed to C:\Program Files\Podman
• MSI_Log: WriteEnvironmentStrings action completed successfully
• MSI_Log: EnvEntriesComponent was installed (Action: Local)
• No PATH update in HKLM system environment
• PATH update found in the installing user's HKCU environment

Impact
This affects enterprise deployments (Intune, MECM/SCCM, EPM, installations as SYSTEM, etc.), where Podman is installed successfully but is not available in PATH for end users without additional remediation.

Describe the results you expected

For a machine-scope installation (ALLUSERS=1), the installer should add the Podman installation directory to the system PATH: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\Path so that Podman is available for all users on the device.

podman info output

If you are unable to run podman info for any reason, please provide the podman version, operating system and its version and the architecture you are running.

Podman in a container

No

Privileged Or Rootless

None

Upstream Latest Release

Yes

Additional environment details

Additional environment details

Additional information

Additional information like issue happens only occasionally or issue happens with a particular architecture or on a particular setting

[Honny1]

PTAL @l0rd

[l0rd]

@AlexVF26 thank you for reporting this. I am going to provide a fix. Do you know if that used to work with the old Podman installer?

[AlexVF26]

@l0rd: Unfortunately not, because we used the 5.8.x EXE Installer, which seems to behave a bit different and adds the Podman installation directory to the system PATH correctly. But for the 6.0.1 release I didn't saw the EXE Installer and used the MSI first time.

[l0rd]

Yes, the MSI installer is multi-scope and replaces the EXE installer (machine-scope only). We have been releasing both for a few releases and have decided to stop releasing the EXE with 6.0.

Thank you for the quick answer. I am going to have a look at the EXE code to see how we can use that mechanism when the new installer is run in machine-scope mode.

[AlexVF26]

@l0rd : I inspected the embedded MSI in the 5.8.5 EXE installer and found the difference:

5.8.5 podman.msi: Table Environment: UpdatePath =-*PATH
6.0.1 podman.msi: Table Environment: UpdatePath =-PATH

Im not an MSI Author and Im not sure if just adding the * is the cleanest way to mitigate this, but that works.

[AlexVF26]

Yes, the MSI installer is multi-scope and replaces the EXE installer (machine-scope only).

Thanks for the clarification. That makes sense now that the new MSI is intended to support both per-user and per-machine installations.
Based on my testing, simply changing the Environment table entry from =-PATH to =-*PATH would not be sufficient, as that would always target the machine PATH and potentially break user-scope installations.

[l0rd]

@AlexVF26 I have submitted a PR to address this #29169

It would be helpful if you could test the updated MSI installer. But you need to build it first: https://github.com/podman-container-tools/podman/blob/main/build_windows.md#build-the-windows-installer. Absolutely not mandatory (I have added an automated test that verifies that HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\Path is updated).