How to copy a tmpfs volume after a container is exited?

[aconz2]

I'm interested in running tasks with podman on a diskless host. The tasks will produce output on stdout, stderr, and some number of output files, let's say under /out.

I was hoping something like this would have been possible, but it seems the tmpfs mount is destroyed before I can access it.

# ignoring stdout/stderr for now
podman run --name test1 --mount=type=tmpfs,tmpfs-size=1M,destination=/out fedora bash -c 'yes > /out/foo'
podman cp test1:/out/ - > /tmp/test1.tar
tar -tf /tmp/test1.tar
# no foo inside
podman cp test1:/out/foo 
# Error: "/out/foo" could not be found on container test1: no such file or directory

I tried creating a volume thinking it might not get destroyed, but the error makes it seem like it might only work with xfs

podman volume create --opt type=tmpfs --opt device=tmpfs --opt o=size=1M mytmp
# Error: volume options size and inodes not supported. Filesystem does not support Project Quota

I then tried

sudo mkdir /mnt/mytmp
sudo mount -t tmpfs -o size=1M tmpfs /mnt/mytmp
sudo chown $USER /mnt/mytmp/
podman run --volume=/mnt/mytmp:/run/out:Z fedora bash -c 'yes > /out/foo'
# we can also capture stdout/stderr to the same volume with
podman run --volume=/mnt/mytmp:/run/out:Z fedora bash -c 'yes > /out/foo' > /out/stdout 2> /out/stderr
stat /mnt/mytmp/foo # success!
# do whatever we want
sudo umount /mnt/mytmp

which works, but that means dealing with keeping track of mounts, ensuring they are not reused (or clearing on reuse). If I do have to go that way, I'm also not sure what approach to do so as non-root (I need to look into how podman does this).

Is there another option or approach I'm missing?

[rhatdan]

Why not create a directory on /tmp and volume mount it into the container?
Never mind, answered before reading comment 3.

[rhatdan]

BTW, I think

podman volume create --opt type=tmpfs --opt device=tmpfs --opt o=size=1M mytmp
# Error: volume options size and inodes not supported. Filesystem does not support Project Quota

Should be supported. Open an issue.

[aconz2]

Thanks, opened #20449

[aconz2]

I'm testing out the new patch and can create a volume but files don't persist after container exit. I was thinking the podman volume create would mount the tmpfs and so it wouldn't be mounted and then umounted (and cleared) by podman/runtime.

podman volume create --opt type=tmpfs --opt device=tmpfs --opt o=size=1M mytmp
# mytmp
podman run -v mytmp:/out:z fedora bash -c 'echo hello > /out/message'
podman volume export mytmp | hexdump
# 0000000 0000 0000 0000 0000 0000 0000 0000 0000
# *
# 0000400

But now I see that podman does do the mount creation and umount (well it looks like actually mount does mount and podman does umount)

strace -Y -f -o strace.out podman run -v mytmp:/out:z fedora bash -c 'echo hello > /out/message'
grep mytmp strace.out | less
# 323035<mount> mount("tmpfs", "/home/user/.local/share/containers/storage/volumes/mytmp/_data", "tmpfs", 0, "size=1M" <unfinished ...>
# 323044<3> mount("/home/user/.local/share/containers/storage/volumes/mytmp/_data", "/proc/self/fd/8", 0x55f8b3b9216d, MS_NOSUID|MS_NODEV|MS_BIND|MS_REC, 0x55f8b41df770) = 0
# 323054<podman> umount2("/home/user/.local/share/containers/storage/volumes/mytmp/_data", MNT_DETACH <unfinished ...>

323044<3> is crun after execveat+clone (there was also 323042<3> crun which is what conmon waits on.

Is the umount expected here?

[rhatdan]

Yes, podman always mounts and unmounts the tmpfs volumes.

[aconz2]

Here's one way to achieve this by using podman in podman assuming the desired task to run is [podman run] fedora bash -c "echo hello; echo goodbye > /out/message" (something which outputs stdout and a file). Here mycontainers is a local dir to cache the inner images, but then we overlay a tmpfs onto /var/lib/containers/storage/libpod to isolate the inner podman from knowing about any other containers being run with that cache dir (since we do a podman container inspect). Maybe there's a nicer way to do that. We mount a subdirectory /out/task:/out in the inner podman call so that /out/{stdout,stderr,inspect} don't conflict with whatever the task produces, which will be in /out/task/... in the final tar. Also not sure of the implications of --privileged here and how painful more advanced things to pass through would be, but it's a start.

podman run --privileged --rm \
       --volume=./mycontainers:/var/lib/containers \
       --mount=type=tmpfs,tmpfs-size=1M,destination=/var/lib/containers/storage/libpod \
       --mount=type=tmpfs,tmpfs-size=1M,destination=/out \
       quay.io/podman/stable \
       sh -c 'mkdir /out/task; podman run --volume=/out/task:/out fedora bash -c "echo hello; echo goodbye > /out/message" > /out/stdout 2> /out/stderr; podman container inspect --latest > /out/inspect; tar cf - /out' \
       | hexdump -C