OverlayFS mount works weird when accessed from within the unprivileged user namespace. Best to be explained in example:~# uname -aLinux host 4.1.0-1-amd64 #1 SMP Debian 4.1.3-1 (2015-08-03) x86_64 GNU/Linux~# runuser - test -c iduid=2000(test) gid=2000(test) groups=2000(test)~# cat /etc/subuid /etc/subgid | grep testtest:200000:65536test:200000:65536~# cd ~test/home/test# mkdir -p upper/test1 lower/test2 target target.work/home/test# chown -R test:test upper lower target target.work/home/test# mount -t overlay -o lowerdir=lower,upperdir=upper,workdir=target.work overlay target/home/test# mount | grep testoverlay on /home/test/target type overlay (rw,relatime,lowerdir=lower,upperdir=upper,workdir=target.work)Overlay is mounted and works as expected:/home/test# runuser - test~$ cd target~/target$ ls -ltotal 8drwxr-xr-x 2 test test 4096 Sep 15 13:50 test1drwxr-xr-x 2 test test 4096 Sep 15 13:50 test2~/target$ mkdir test3~/target$ mkdir test2/test2-3~/target$ mkdir test1/test1-3Lets try unprivileged user namespace now~/target$ ^D/home/test/target# cd ../home/test# umount target/home/test# rm -rf upper lower target target.work/home/test# mkdir -p upper/test1 lower/test2 target target.work/home/test# chown -R 200000:200000 upper lower target target.work/home/test# mount -t overlay -o lowerdir=lower,upperdir=upper,workdir=target.work overlay target/home/test# mount | grep testoverlay on /home/test/target type overlay (rw,relatime,lowerdir=lower,upperdir=upper,workdir=target.work)Make sure that unprivileged namespaces are allowed:/home/test# sysctl -w kernel.unprivileged_userns_clone=1Okay, lets try it:/home/test# runuser - test~$ lxc-usernsexec -m u:0:200000:65536 -m g:0:200000:65536 -m u:65536:2000:1 -m g:65536:2000:1 -- /bin/bash~# cd target~/target# ls -ltotal 8drwxr-xr-x 2 root root 4096 Sep 15 13:57 test1drwxr-xr-x 2 root root 4096 Sep 15 13:57 test2So far so good. ~/target# mkdir test3~/target# mkdir test2/test2-3~/target# mkdir test1/test1-3mkdir: cannot create directory 'test1/test1-3': Permission deniedAnd this is where it gets broken. Aufs works fine in the same scenario (except for debian 4.1 kernel doesn't support aufs anymore).Is there any way to make it working?
OverlayFS doesn't work with unprivileged user namespace
linux;containers;overlayfs
I think this is because target.work/work on mount belongs to root. Could you try to chown that dir after mount?However I found simpler reproduction case, we just need dir which is in lower, but not in upper:# from usermkdir -p upper lower/test2 target target.work# from rootmount -t overlay -o lowerdir=lower,upperdir=upper,workdir=target.work overlay target# from user againunshare -Ur touch target/test2/1If I insert chown user:user target.work/work after mount then all works okay. Not sure if we should think about this as overlayfs bug or feature :)