You can mount s3 on podman volumes!

[WesselAtWork]

s3fs + podman

I noticed with the podman.volume that you can set arguments and options for an fs mount !

Which means you can mount s3 with s3fs as a podman volume!

Should make this so much simpler then trying to mount it inside the container.

(Required) Reading

• FAQ
• Cache

Cli

BUCKET="some-bucket"
PATH="some/path"
AWS_REGION=your-region-here

sudo dnf install s3fs-fuse
aws s3api put-object --bucket $S3_BUCKET -key $PATH
podman volume create s3fs-volume -o type=fuse.s3fs -o device=${YOUR_S3_BUCKET}:/${PATH} -o o=iam_role,listobjectsv2,use_xattr,endpoint=${AWS_REGION}
# Use iam_role option if you are inside a ec2

Systemd

s3fs.volume

[Service]
CacheDirectory=s3fs
ExecStartPre=/usr/local/bin/aws s3api put-object --bucket ${S3_BUCKET} --key ${PATH}

[Volume]
Device=${S3_BUCKET}:/${PATH}
Type=fuse.s3fs
VolumeName=s3fs-volume
Options=iam_role,endpoint=eu-west-1,use_xattr,listobjectsv2,use_cache=${CACHE_DIRECTORY}

Options

option	note	optional?	recomended?
iam_role	set for ec2	-	-
profile=your-profile	use for your user/creds	-	-
endpoint=aq-central-1	needs to be set	no [ :( ]	-
use_xattr	important for :z/:Z mount options	yesn't	yes
listobjectsv2	remove if you experience issues (performance questionable)	yes	yesn't
use_cache=/var/cache/s3fs	be careful with this, it will grow UNBOUNDED	yes	yes
del_cache	deletes the cache dir on startup and shutdown	yes	no
compat_dir	fixes some problems sometimes	yes	no
umask=0000	forces the permission bits (default seems to be 0027)	yes	no
mp_umask=0000	use with allow_other	yes	no
allow_other	fuser option that allows unrestricted access to files	yes	no*

Using

podman run -v s3fs-volume:/s3:z --rm -it docker.io/alpine
   cd /s3
   echo "Hello From podman!" > hello.txt
   ls
#  hello.txt
   exit
aws s3 cp ${S3_BUCKET}/${PATH}/hello.txt -
"Hello From podman!"

Other users inside of containers

The above example works because the volume is mounted as the user and inside alpine root = user in the host.

If you tried:

podman run --entrypoint /bin/ash --user nginx:nginx --rm -v s3fs-volume:/s3:z,U -it docker.io/nginx:alpine
  ls /s3
# ls: /s3: Permission denied

What gives! As root you see the directory, but as anyone else it doesn't even exist!

The reason is because in FUSE-land you need to allow others to access your mount.

Technically even root isn't supposed to be able to see your mount if you don't specify allow_root !
Again: in this case root is actually your user, so it can see into the mount on the host.
If you think about it, a FUSE mount might have used credentials controlled outside of the system, not even root should be able to see inside, because there is no way to know if root is allowed to see it.

Now Try with allow_other:

podman volume create s3fs-volume-other -o type=fuse.s3fs -o device=${YOUR_S3_BUCKET}:/${PATH} -o o=iam_role,listobjectsv2,use_xattr,endpoint=${AWS_REGION},allow_other

podman run --entrypoint /bin/ash --user nginx:nginx --rm -v s3fs-volume-other:/s3:z,U -it docker.io/nginx:alpine
  ls /s3
# hello.txt
  exit

[rhatdan]

This would be nice to add to the podman volume create man page?

[WesselAtWork]

Be my guest!

[WesselAtWork]

Oh my apologies, I misinterpreted your request!

I can take a look at it when my schedule clear a bit.

[rhatdan]

Yes I am always trying to get others to do work. :^)

[WesselAtWork]

Opened #21620 for now.

[eriksjolund]

I tried out --user without using allow_other on a local minio S3 service.
It worked fine when I passed --user $(id -u):$(id -g) --userns keep-id:uid=$(id -u),gid=$(id -g)

Podman was built from the main branch (git commit 4304e10).
I'll update with more information later.