Podman Rootless

[andrewgdunn]

Was wondering if I can run this with podman rootless and access a USB DAC. In this case I've created a user to specifically manage music playback. I've added that user to the audio group on the host. I'm now trying to get the audio device to show up inside the container:

Host

[root@muckle ~]# setsebool -P container_use_devices=true

[root@muckle ~]# id tune
uid=3100(tune) gid=3100(tune) groups=3100(tune),63(audio)

[tune@muckle ~]$ lsusb | grep Schiit
Bus 003 Device 011: ID 30be:1000 Schiit Audio Schiit Bifrost 2 Unison USB

[tune@muckle ~]$ podman run --name=mpd --group-add keep-groups --privileged --device /dev/snd --env ALSA_OUTPUT_CREATE=yes giof71/mpd-alsa

Container

[tune@muckle ~]$ podman exec -it mpd /bin/bash

root@13d27d5741e6:/app/bin# lsusb 
Bus 004 Device 002: ID 05e3:0620 GenesysLogic USB3.1 Hub
Bus 004 Device 001: ID 1d6b:0003 Linux 5.14.0-388.el9.x86_64 xhci-hcd xHCI Host Controller
Bus 003 Device 005: ID 046d:c52b Logitech USB Receiver
Bus 003 Device 011: ID 30be:1000 Schiit Audio Schiit Bifrost 2 Unison USB
Bus 003 Device 004: ID 1a40:0101  USB 2.0 Hub
Bus 003 Device 003: ID 05e3:0610 GenesysLogic USB2.1 Hub
Bus 003 Device 002: ID 05e3:0608  USB2.0 Hub
Bus 003 Device 001: ID 1d6b:0002 Linux 5.14.0-388.el9.x86_64 xhci-hcd xHCI Host Controller
Bus 002 Device 001: ID 1d6b:0003 Linux 5.14.0-388.el9.x86_64 xhci-hcd xHCI Host Controller
Bus 001 Device 001: ID 1d6b:0002 Linux 5.14.0-388.el9.x86_64 xhci-hcd xHCI Host Controller
root@13d27d5741e6:/app/bin# aplay -l
aplay: device_list:274: no soundcards found...

[andrewgdunn]

Asking upstream as this could be an SELinux/rootless limitation: containers/podman#20875

[andrewgdunn]

I closed this issue upstream as I think it's working fine now.

[GioF71]

Hello, making my containers rootless (and/or compatible with podman) is something I was thinking, but I didn't try yet.
I will see if I can have a chance to work on this topic in the next few days and will let you know.
For sure in rootless mode, it must be granted by who runs the container that the user belongs to the audio group, so I need to somehow skip the parts which create the user based on PUID PGID and AUDIO_GID.

[GioF71]

Hello, some work has been done here. I am running successfully under docker with --user.
I will be creating a discussion later with a sample configuration.
I don't believe this will be enough for your issue but it should be a starting point.

Cheers

[GioF71]

See here for the latest changes, let me know if this helps.