fix(podman): create managed workspace volumes owned by the workload identity

Podman now creates the managed /sandbox volume with uid/gid options for the
resolved workload identity, so the workload starts directly as that
identity. This fixes rootful sandboxes whose image USER or policy
run_as_user could not write to a root-owned /sandbox, and removes the
root-then-drop workspace chown start path.

Resource admission accepts the managed workspace volume when its options
match the workload container's final identity, or are empty for volumes
created by older gateways. The channel volume still requires empty options.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

Author: matthewgrossman

crates/openshell-driver-podman/README.md

@@ -43,7 +43,8 @@ stopped Podman container does not populate nested named volumes. Restart restore
 only the channel bootstrap into the existing channel volume, preserving the
 workspace. The workload starts before the supervisor so its user namespace exists
 when the supervisor joins it; a stopped supervisor resolves that namespace again
-on its next start.
+on its next start. The driver creates the managed workspace volume owned by
+the workload's final UID and GID, so the workload never starts as root.
 
 The runtime must pass the sandbox's unprivileged enforcement probe, including
 nested seccomp notification and Landlock. Unsupported runtime defaults fail

crates/openshell-driver-podman/src/client.rs

@@ -166,6 +166,8 @@ pub struct PortBinding {
 pub struct ContainerConfig {
     #[serde(default)]
     pub labels: HashMap<String, String>,
+    #[serde(default)]
+    pub user: String,
 }
 
 /// Immutable image metadata needed to bind OCI identity inspection to launch.
@@ -187,6 +189,25 @@ pub struct ImageConfig {
     pub env: Vec<String>,
 }
 
+/// Whether a driver-owned volume has exactly the options `OpenShell` creates it
+/// with: none, or `uid`/`gid` for `owner`. Podman records the parsed `UID` and
+/// `GID` next to the raw `o` option.
+pub fn volume_options_match_owner(
+    options: &HashMap<String, String>,
+    owner: Option<(u32, u32)>,
+) -> bool {
+    let Some((uid, gid)) = owner else {
+        return options.is_empty();
+    };
+    options.get("o").map(String::as_str) == Some(format!("uid={uid},gid={gid}").as_str())
+        && options.iter().all(|(key, value)| match key.as_str() {
+            "o" => true,
+            "UID" => *value == uid.to_string(),
+            "GID" => *value == gid.to_string(),
+            _ => false,
+        })
+}
+
 /// A container summary returned by the list API.
 #[derive(Debug, Clone, serde::Deserialize)]
 #[serde(rename_all = "PascalCase")]
@@ -701,12 +722,18 @@ impl PodmanClient {
     // ── Volume operations ────────────────────────────────────────────────
 
     /// Never adopt an unrelated existing volume on a private provisioning path.
+    ///
+    /// With `owner`, Podman creates the volume root owned by that UID and GID,
+    /// so a non-root workload can use it without a privileged chown.
     pub(crate) async fn create_owned_volume(
         &self,
         name: &str,
         sandbox_id: &str,
         workspace: &str,
+        owner: Option<(u32, u32)>,
     ) -> Result<(), PodmanApiError> {
+        let owned_as_requested =
+            |options: &HashMap<String, String>| volume_options_match_owner(options, owner);
         let labels = HashMap::from([
             (
                 openshell_core::driver_utils::LABEL_SANDBOX_ID.to_string(),
@@ -720,7 +747,7 @@ impl PodmanClient {
         match self.inspect_volume(name).await {
             Ok(existing) => {
                 if existing.driver != "local"
-                    || !existing.options.is_empty()
+                    || !owned_as_requested(&existing.options)
                     || existing.labels.as_ref() != Some(&labels)
                 {
                     return Err(PodmanApiError::InvalidInput(
@@ -732,14 +759,15 @@ impl PodmanClient {
             Err(PodmanApiError::NotFound(_)) => {}
             Err(error) => return Err(error),
         }
-        self.create_ignore_conflict(
-            "/libpod/volumes/create",
-            &serde_json::json!({"Name":name,"Driver":"local","Labels":labels}),
-        )
-        .await?;
+        let mut body = serde_json::json!({"Name":name,"Driver":"local","Labels":labels});
+        if let Some((uid, gid)) = owner {
+            body["Options"] = serde_json::json!({ "o": format!("uid={uid},gid={gid}") });
+        }
+        self.create_ignore_conflict("/libpod/volumes/create", &body)
+            .await?;
         let created = self.inspect_volume(name).await?;
         if created.driver != "local"
-            || !created.options.is_empty()
+            || !owned_as_requested(&created.options)
             || created.labels.as_ref() != Some(&labels)
         {
             return Err(PodmanApiError::InvalidInput(
@@ -1157,6 +1185,42 @@ mod tests {
         let _ = std::fs::remove_file(socket_path);
     }
 
+    #[tokio::test]
+    async fn create_owned_volume_verifies_requested_owner() {
+        let labels =
+            r#"{"openshell.ai/sandbox-id":"sandbox-1","openshell.ai/sandbox-workspace":"team-a"}"#;
+        for (options, accepted) in [
+            (
+                r#"{"o":"uid=1234,gid=1235","UID":"1234","GID":"1235"}"#,
+                true,
+            ),
+            (r#"{"o":"uid=1234,gid=1235"}"#, true),
+            (r#"{"o":"uid=1234,gid=1235","UID":"0","GID":"1235"}"#, false),
+            (r#"{"o":"uid=1234,gid=1235","device":"/srv/work"}"#, false),
+            ("{}", false),
+        ] {
+            let (socket_path, _, handle) = spawn_podman_stub(
+                "owned-volume",
+                vec![
+                    StubResponse::new(StatusCode::NOT_FOUND, ""),
+                    StubResponse::new(StatusCode::CREATED, "{}"),
+                    StubResponse::new(
+                        StatusCode::OK,
+                        format!(
+                            r#"{{"Name":"work","Driver":"local","Options":{options},"Labels":{labels}}}"#
+                        ),
+                    ),
+                ],
+            );
+            let result = PodmanClient::new(socket_path.clone())
+                .create_owned_volume("work", "sandbox-1", "team-a", Some((1234, 1235)))
+                .await;
+            assert_eq!(result.is_ok(), accepted, "options {options}: {result:?}");
+            handle.await.expect("stub task should finish");
+            let _ = std::fs::remove_file(socket_path);
+        }
+    }
+
     #[tokio::test]
     async fn inspect_image_reads_immutable_id_and_oci_user() {
         let (socket_path, request_log, handle) = spawn_podman_stub(

crates/openshell-driver-podman/src/container.rs

@@ -1454,8 +1454,6 @@ pub struct IsolationSpecInput<'a> {
     pub supervisor_bin: Option<&'a Path>,
     pub tls_secrets: Option<&'a [String; 3]>,
     pub identity: &'a openshell_isolation_interface::contract::ResolvedWorkloadIdentity,
-    /// Whether this workload is created by a rootless Podman service.
-    pub rootless: bool,
 }
 
 pub struct IsolationSpecs {
@@ -1507,44 +1505,19 @@ pub fn build_isolation_specs(
         .iter()
         .filter_map(|entry| entry.split_once('=').map(|(key, _)| key.to_string()))
         .collect();
-    if input.rootless || input.identity.source == "default" {
-        // Podman's archive endpoint leaves named-volume contents owned by
-        // container root for rootless services and for a rootful USER-less
-        // image's newly-created workspace. Start the trusted runtime as root
-        // only long enough to chown the workspace, then irreversibly drop to
-        // the resolved workload identity before reading bootstrap material or
-        // accepting a control connection.
-        workload.command = vec![
-            "launch-capability-free".into(),
-            input.identity.uid.to_string(),
-            input.identity.gid.to_string(),
-            crate::isolation::BOOTSTRAP_PATH.into(),
-            driver_mounts::DEFAULT_WORKSPACE_ROOT.into(),
-        ];
-        workload.user = "0:0".into();
-        workload.groups.clear();
-        workload.cap_drop = vec!["ALL".into()];
-        workload.cap_add = vec![
-            "CHOWN".into(),
-            "SETGID".into(),
-            "SETUID".into(),
-            "SETPCAP".into(),
-        ];
-    } else {
-        workload.command = vec![
-            "--bootstrap".into(),
-            crate::isolation::BOOTSTRAP_PATH.into(),
-        ];
-        workload.user.clone_from(&user);
-        workload.groups = input
-            .identity
-            .supplementary_gids
-            .iter()
-            .map(ToString::to_string)
-            .collect();
-        workload.cap_drop = vec!["ALL".into()];
-        workload.cap_add.clear();
-    }
+    workload.command = vec![
+        "--bootstrap".into(),
+        crate::isolation::BOOTSTRAP_PATH.into(),
+    ];
+    workload.user.clone_from(&user);
+    workload.groups = input
+        .identity
+        .supplementary_gids
+        .iter()
+        .map(ToString::to_string)
+        .collect();
+    workload.cap_drop = vec!["ALL".into()];
+    workload.cap_add.clear();
     workload.apparmor_profile = input
         .config
         .app_armor_profile
@@ -1842,29 +1815,21 @@ mod tests {
             supervisor_bin: None,
             tls_secrets: None,
             identity: &identity,
-            rootless: true,
         })
         .unwrap();
         for spec in [&specs.workload, &specs.supervisor] {
             assert_eq!(spec.cap_drop, vec!["ALL"]);
             assert!(spec.seccomp_profile_path.is_empty());
             assert!(spec.no_new_privileges);
         }
-        assert_eq!(specs.workload.user, "0:0");
-        assert!(specs.workload.groups.is_empty());
-        assert_eq!(
-            specs.workload.cap_add,
-            vec!["CHOWN", "SETGID", "SETUID", "SETPCAP"]
-        );
+        // The driver creates the managed workspace volume owned by the
+        // workload identity, so the workload never starts as root.
+        assert_eq!(specs.workload.user, "1000:1001");
+        assert_eq!(specs.workload.groups, vec!["2000"]);
+        assert!(specs.workload.cap_add.is_empty());
         assert_eq!(
             specs.workload.command,
-            vec![
-                "launch-capability-free",
-                "1000",
-                "1001",
-                crate::isolation::BOOTSTRAP_PATH,
-                driver_mounts::DEFAULT_WORKSPACE_ROOT,
-            ]
+            vec!["--bootstrap", crate::isolation::BOOTSTRAP_PATH]
         );
         assert_eq!(specs.supervisor.user, "1000:1001");
         assert_eq!(specs.supervisor.groups, vec!["2000"]);
@@ -1893,7 +1858,7 @@ mod tests {
                 "sha256:image".into(),
             )
             .unwrap();
-        let rootful_specs = build_isolation_specs(IsolationSpecInput {
+        let default_specs = build_isolation_specs(IsolationSpecInput {
             sandbox: &sandbox,
             config: &config,
             token_secret: Some("jwt"),
@@ -1906,19 +1871,13 @@ mod tests {
             supervisor_bin: None,
             tls_secrets: None,
             identity: &default_identity,
-            rootless: false,
         })
         .unwrap();
-        assert_eq!(rootful_specs.workload.user, "0:0");
+        assert_eq!(default_specs.workload.user, "1000:1000");
+        assert!(default_specs.workload.cap_add.is_empty());
         assert_eq!(
-            rootful_specs.workload.command,
-            vec![
-                "launch-capability-free",
-                "1000",
-                "1000",
-                crate::isolation::BOOTSTRAP_PATH,
-                driver_mounts::DEFAULT_WORKSPACE_ROOT,
-            ]
+            default_specs.workload.command,
+            vec!["--bootstrap", crate::isolation::BOOTSTRAP_PATH]
         );
         let workload_json = serde_json::to_string(&specs.workload).unwrap();
         assert!(workload_json.contains("\"apparmor_profile\":\"openshell-sandbox\""));