dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

quadlet: drop the userns identity model — rootless cannot map uid 997

Browse Source 
Evidence from the failed first cutover: podman top shows container root
maps to dank (1000) under UserNS=host rootless (subuid range 100000:65536
cannot express 997), so PUID=997 fell back to root and PMS crash-looped on
write access to its 997:984-owned data root. Fleet model instead: PUID=0/
PGID=0 (container root = dank, same as jellyfin/copyparty data roots) and
deploy_plex chowns /var/lib/plexmediaserver to 1000:1000 inside the
first-cutover block. Zero bytes moved; rollback regains one chown -R
997:984 step, documented in Plex.md. Seam test pins PUID=0/PGID=0 and the
absence of any userns key.
This commit is contained in:
Frank
2026-09-01 22:46:00 -07:00
parent 1939135e4c
commit 58aa084d9c
6 changed files with 36 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/dankserver_quadlet.bats
+11 -9
View File
@@ -67,14 +67,16 @@ load helpers
grep -q '^PublishPort=8181:8181$' "$REPO_ROOT/dankserver/tautulli/quadlet/tautulli.container" || return 1
}
@test "plex keeps the native unit's identity (UserNS=host, PUID=997, PGID=984)" {
# Zero-chown ownership contract: /var/lib/plexmediaserver is bind-mounted
# in place, so every file the container writes must land owned 997:984 —
# byte-identical to the former plexmediaserver.service identity. UserNS=
# is the quadlet v1 key (UsernsMode= is compose syntax and the generator
# hard-fails the whole unit on it); pin the exact keys.
@test "plex runs the fleet identity model (PUID=0/PGID=0, no userns remap)" {
# Rootless podman cannot map the real host uid 997 (subuid range is
# 100000:65536), so the fleet model applies: container root maps to the
# dank user and the deployer chowns /var/lib/plexmediaserver to
# 1000:1000 on first cutover; rollback chowns back to 997:984. Pin both
# keys and the ABSENCE of any userns key — UsernsMode= is compose syntax
# (the v1 generator hard-fails the whole unit on it) and UserNS= would
# remap the container away from the fleet identity.
unit="$REPO_ROOT/dankserver/plex/quadlet/plex.container"
grep -q '^UserNS=host$' "$unit" || return 1
grep -q '^Environment=PUID=997$' "$unit" || return 1
grep -q '^Environment=PGID=984$' "$unit" || return 1
grep -q '^Environment=PUID=0$' "$unit" || return 1
grep -q '^Environment=PGID=0$' "$unit" || return 1
! grep -qE '^(UserNS|UsernsMode)=' "$unit" || return 1
}