Make podman ignore a container's exit code?

[badamowicz]

Hi all!
I know the question in the title sounds totally silly since it contradicts all container's philosophy as well as podman's philosophy. But let me explain what my use case is:
I am using Podman Security Bench for testing our images. Before starting the bench I'm setting up a test environment which contains exactly one image along with its associated container. And as long as the configured entrypoint in the image starts and keeps the container running, everythin is fine.
However, a lot of images won't start because of missing secrets, mounts or for some other reasons. For some images it is sufficient to start them with these (contradicting) podman arguments:

podman run --detach --interactive <image-url> &

or

podman run --detach --tty <image-url> &

But this does not work for all images for whatever reason. (We're having lots of images in our company and I couldn't really figure out what type of image works and which not.)
Another posibility is to set the entrypoint:

podman run --entrypoint='["tail", "-f", "/dev/null"]'" <image-url>

However we have some images totally stripped down so they don't even contain bash/tail.
So for this particular use case something like this

podman run --keep-running <image-url>

or

podman run --ignore-exit-code=true <image-url>

to keep the container in state Running no matter if the entrypoint fails or succeeds would be nice for this use case.
I couldn't find any reliable solution for this problem nowhere so far. That's why I started this dicussion here.
Looking forward to your feedback!
Thanks
Bernd

[Luap99]

I don't really understand "why" you have to keep containers running?

If the container process exits there is not much we can do. Showing the container as running even when it is not does not make sense.

[mheon]

This doesn't really make sense... when the first process in a PID namespace dies, the kernel tears down the entire PID namespace. As such it's not really possible to have a container that is "running" if the first PID dies.

[rhatdan]

Devils Advocate What about if run with --pid=host

[mheon]

Podman does not have any special handling for these containers. Given that we haven't had any issues over the last three years, I suspect runc/crun have some handling for this - maybe killing the PIDs in the cgroup when the container goes down? @giuseppe Am I completely off base here?

[badamowicz]

Agree with all your answers. A died process is simply a died process. My (little) hope was that you podman guys might have some kind of magic voodoo to help me out. ;-)
Also tried --pid=host but with no success.
Thanks a lot anyway!