From 1939135e4c895ac1421079b2188e21b86c01440c Mon Sep 17 00:00:00 2001 From: Frank Date: Tue, 1 Sep 2026 22:36:43 -0700 Subject: [PATCH] =?UTF-8?q?quadlet:=20UsernsMode=3D=20is=20compose=20synta?= =?UTF-8?q?x=20=E2=80=94=20use=20the=20v1=20key=20UserNS=3Dhost?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit podman 5.7 podman-user-generator on dankserver hard-fails the whole unit on the unknown key ('unsupported key UsernsMode in group Container'), so the first cutover attempt masked the native unit and then found no plex.service at all. Swap both units to UserNS=host (same --userns=host flag), update the ownership-contract seam test to pin the exact key, and correct both docs. Pin the seam: the v1 generator rejects unknown Container keys silently at deploy distance — the test now pins UserNS=, not the misspelled alias. --- dankserver/plex/quadlet/plex.container | 3 +-- dankserver/tautulli/quadlet/tautulli.container | 3 +-- serverAppConfigs-docs/Dankserver/Plex.md | 2 +- serverAppConfigs-docs/Dankserver/Tautulli.md | 2 +- tests/dankserver_quadlet.bats | 10 +++++----- 5 files changed, 9 insertions(+), 11 deletions(-) diff --git a/dankserver/plex/quadlet/plex.container b/dankserver/plex/quadlet/plex.container index e1e243d..6f61e82 100644 --- a/dankserver/plex/quadlet/plex.container +++ b/dankserver/plex/quadlet/plex.container @@ -6,8 +6,7 @@ Wants=network-online.target [Container] Image=lscr.io/linuxserver/plex:1.43.3.10896-cb3ebc72d-ls322 ContainerName=plex -Network=dankserver_appnet:alias=plex -UsernsMode=host +UserNS=host Environment=PUID=997 Environment=PGID=984 Environment=TZ=America/Los_Angeles diff --git a/dankserver/tautulli/quadlet/tautulli.container b/dankserver/tautulli/quadlet/tautulli.container index 10c8ed2..653cf13 100644 --- a/dankserver/tautulli/quadlet/tautulli.container +++ b/dankserver/tautulli/quadlet/tautulli.container @@ -5,9 +5,8 @@ Wants=network-online.target [Container] Image=lscr.io/linuxserver/tautulli:v2.18.1-ls242 -ContainerName=tautulli +UserNS=host Network=dankserver_appnet:alias=tautulli -UsernsMode=host Environment=PUID=1000 Environment=PGID=1000 Environment=TZ=America/Los_Angeles diff --git a/serverAppConfigs-docs/Dankserver/Plex.md b/serverAppConfigs-docs/Dankserver/Plex.md index 3988067..a4c1bd9 100644 --- a/serverAppConfigs-docs/Dankserver/Plex.md +++ b/serverAppConfigs-docs/Dankserver/Plex.md @@ -18,7 +18,7 @@ public traffic can be fronted by Caddy like every other vhost. | Image | `lscr.io/linuxserver/plex:1.43.3.10896-cb3ebc72d-ls322` (pinned; verified == the ghcr `latest` manifest digest at pin time) | | Data root | `/var/lib/plexmediaserver` bind-mounted **in place** as `/config` (RW) — the migration moved zero bytes | | Media | `/mnt/entropy` mounted at the same absolute path **read-only** — every library path in the PMS database stayed valid, zero re-scan | -| Identity | `UsernsMode=host` + `PUID=997 PGID=984` — container writes land owned 997:984, byte-compatible with the former native unit | +| Identity | `UserNS=host` (quadlet key for `--userns=host`) + `PUID=997 PGID=984` — container writes land owned 997:984, byte-compatible with the former native unit | | Port | `32400/tcp` published on `0.0.0.0` — zero client reconfiguration | | Network | `dankserver_appnet`, alias `plex`; Tautulli reaches it at `http://plex:32400` | | GPU | none by decision — CPU decode only; the RTX 3090 stays dedicated to `frank-default-small` | diff --git a/serverAppConfigs-docs/Dankserver/Tautulli.md b/serverAppConfigs-docs/Dankserver/Tautulli.md index c10604e..390d8cf 100644 --- a/serverAppConfigs-docs/Dankserver/Tautulli.md +++ b/serverAppConfigs-docs/Dankserver/Tautulli.md @@ -16,7 +16,7 @@ it; it talks to PMS over the appnet at `http://plex:32400`). | Runtime | podman quadlet, `tautulli.service` (user manager) — migrated from snap `snap.tautulli.tautulli.service` | | Image | `lscr.io/linuxserver/tautulli:v2.18.1-ls242` (pinned; verified == the ghcr `latest` manifest digest at pin time) | | Data root | `/home/dank/Containers/tautulli` bind-mounted as `/config` (fresh at cutover — the snap's `/var/snap/tautulli/common` was empty) | -| Identity | `UsernsMode=host` + `PUID=1000 PGID=1000` | +| Identity | `UserNS=host` (quadlet key for `--userns=host`) + `PUID=1000 PGID=1000` | | Port | `8181/tcp` published on `0.0.0.0` | | Network | `dankserver_appnet`, alias `tautulli` | | PMS URL | `http://plex:32400` — seeded into `config.ini` by the deployer on first start | diff --git a/tests/dankserver_quadlet.bats b/tests/dankserver_quadlet.bats index e4dc226..93e5a5e 100755 --- a/tests/dankserver_quadlet.bats +++ b/tests/dankserver_quadlet.bats @@ -67,14 +67,14 @@ load helpers grep -q '^PublishPort=8181:8181$' "$REPO_ROOT/dankserver/tautulli/quadlet/tautulli.container" || return 1 } -@test "plex keeps the native unit's identity (userns=host, PUID=997, PGID=984)" { +@test "plex keeps the native unit's identity (UserNS=host, PUID=997, PGID=984)" { # Zero-chown ownership contract: /var/lib/plexmediaserver is bind-mounted # in place, so every file the container writes must land owned 997:984 — - # byte-identical to the former plexmediaserver.service identity. If the - # v1 generator ever drops UsernsMode=, files appear as the rootless - # subuid and the migration invariant is broken; pin both keys. + # byte-identical to the former plexmediaserver.service identity. UserNS= + # is the quadlet v1 key (UsernsMode= is compose syntax and the generator + # hard-fails the whole unit on it); pin the exact keys. unit="$REPO_ROOT/dankserver/plex/quadlet/plex.container" - grep -q '^UsernsMode=host$' "$unit" || return 1 + grep -q '^UserNS=host$' "$unit" || return 1 grep -q '^Environment=PUID=997$' "$unit" || return 1 grep -q '^Environment=PGID=984$' "$unit" || return 1 }