No volumes mounted and yes, it’s using the podman backend. Just double checked it wasn’t using the docker one.

OK now this would make some sense but would definitely be a bit of a show stopper for me. I’ll give it a try though.

Edit: Unfortunately this didn’t solve the issue. I thought it did for a minute, but it was the browser cache I think auto-filling the correct result.

I think I have uids set up, but I’m not positive they’re set up correctly.

Here’s an example of /etc/subuid for example, with it a bit anonymised for my specific user setup:

core:524288:65536
syncthing:589824:65536
userA:655360:65536
userB:720896:65536
userC:786432:65536

Syncthing in this case isn’t running any podman containers, all sharing is done bare-metal. userA is working, but userB and userC do look like they’re configured “correctly” at first glance. podman system info seems to be outputting the results above

  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1101
      size: 1
    - container_id: 1
      host_id: 786432
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1101
      size: 1
    - container_id: 1
      host_id: 786432
      size: 65536

Note: The user in question here is uid 1101, another new user I created for testing purposes.

I mean, I might be wrong, but this only changes the mapping right? In the case that user broke containment, I would assume that they would have the user id of the user that’s running the process?

Granted this is all in theory so I’m not sure exactly – that might be a perfectly reasonable way to do it.

As far as I understand, it should as it’s embedded inside the actual image file and not mounted.

I’m having other strange behaviour on non-1000 uid accounts. For example, running docker.io/library/httpd using the podman examples page on an account that isn’t userid 1000 will create an issue where it complains that libgcc_0 isn’t installed. This works flawlessly on the uid 1000 user.

It does make me think that something needs to be configured for non-uid 1000 users on podman. This is not replicable on arch linux on my raspberry pi, fwiw.

Uh oh, looks like someone’s AI company is running out of money and needs people back on Twitter. 😭

It does, but it seems like it’s still a bit of an afterthought. But it’s getting better.

Still tho, podman is fine and I like the project as an alternative to docker.

Rich kids. The worst type as they’re also the least likely to get meaningfully punished.

This was always a catch and kill project.

One step away from being relocated to their actual destination: the bin.

Nvidia is only begging because they didn’t realise that putting out a free product that essentially makes most work redundant would bite them in the ass as it would mean less people able to buy their products.

Oh, and because they’re worried about what happens when they start charging the companies who fired everyone the real price of the AI service they’re currently providing for free.

Where do people who use kobo readers buy their ebooks? Is there a reliable non Amazon e-reader shop that sells from free books? (Besides humble store)

I had always heard “binary blob” said when it came to opaque code, but I see that blob is what is used to describe unexplained binary data as a whole in database lingo, so I’m willing to say your usage of it is probably more correct than mine here, assuming the binary data isn’t an actual program (afaik there’s no elf-file like characteristics but who knows.). 😇

It’s a bit strange that this code requires a binary blob to verify, I think people who want to experiment with this should take some caution as it could be an exploit-in-an-exploit (user is highlighting a real exploit, but also trying to take advantage of people testing by effectively installing a back-door.) I won’t say that’s happening for sure, but take running this yourself with extreme caution.