Unable to start sql server with volume mounted

[aadithya96]

/kind bug

Description

I'm unable to start sql Server container when binding volumes. We are currently migrating from docker and we had docker containers running mssql before. I'm now trying to use the same files created in docker so that podman could be a drop-in replacement.
The container is up and running if the -v flag is not added.
I tried running the container as root user, pass the --security-opt label=disable: flag with no luck.
Also tried with the following compose file :

db:
image: 'mcr.microsoft.com/mssql/server:2017-latest'
container_name: 'mssql'
ports:
- '1433:1433'
environment:
SA_PASSWORD: 'YourNewStrong!Passw0rd'
ACCEPT_EULA: 'Y'
MSSQL_AGENT_ENABLED: 'true'
volumes:
- type: 'bind'
target: '/var/opt/mssql/data'
source: './sql_volume/data'

Error shown :

SQL Server 2017 will run as non-root by default.
This container is running as user root.
Your master database file is owned by nobody.
To learn more visit https://go.microsoft.com/fwlink/?linkid=2099216.
2022-11-18 12:23:29.59 Server      Microsoft SQL Server 2017 (RTM-CU31) (KB5016884) - 14.0.3456.2 (X64)
        Sep  2 2022 11:01:50
        Copyright (C) 2017 Microsoft Corporation
        Developer Edition (64-bit) on Linux (Ubuntu 18.04.6 LTS)
2022-11-18 12:23:29.59 Server      UTC adjustment: 0:00
2022-11-18 12:23:29.59 Server      (c) Microsoft Corporation.
2022-11-18 12:23:29.59 Server      All rights reserved.
2022-11-18 12:23:29.60 Server      Server process ID is 380.
2022-11-18 12:23:29.60 Server      Logging SQL Server messages in file '/var/opt/mssql/log/errorlog'.
2022-11-18 12:23:29.60 Server      Registry startup parameters:
         -d /var/opt/mssql/data/master.mdf
         -l /var/opt/mssql/data/mastlog.ldf
         -e /var/opt/mssql/log/errorlog
2022-11-18 12:23:29.61 Server      Error: 17113, Severity: 16, State: 1.
2022-11-18 12:23:29.61 Server      Error 5(Access is denied.) occurred while opening file '/var/opt/mssql/data/master.mdf' to obtain configuration information at startup. An invalid startup option might have caused the error. Verify your startup options, and correct or remove them if necessary.
exit code: 1

PS: First time trying out podman, TIA. Also, this will be for local dev purposes, so not much bothered about SELinux and security.

Steps to reproduce the issue:

1. Run podman run -ti --name mssql --network=host -e SA_PASSWORD='YourStrong!Passw0rd' -v .\sql_volume:/var/opt/mssql:Z -e ACCEPT_EULA=Y mcr.microsoft.com/mssql/server:2017-latest

Describe the results you received:
Container throws an error and exits.

Describe the results you expected:

Container should start without any errors

Additional information you deem important (e.g. issue happens only occasionally):

When passing the -v flag, there's a message saying : Your master database file is owned by nobody.
No such message is shown with -v, so, a permission issue I guess?

Output of podman version:

Client:       Podman Engine
Version:      4.3.0
API Version:  4.3.0
Go Version:   go1.18.7
Git Commit:   ad42af94903ce4f3c3cd0693e4e17e4286bf094b
Built:        Wed Oct 19 23:23:21 2022
OS/Arch:      windows/amd64

Server:       Podman Engine
Version:      4.2.1
API Version:  4.2.1
Go Version:   go1.18.5
Built:        Thu Sep  8 01:28:19 2022
OS/Arch:      linux/amd64

Output of podman info:

host:
  arch: amd64
  buildahVersion: 1.27.0
  cgroupControllers: []
  cgroupManager: cgroupfs
  cgroupVersion: v1
  conmon:
    package: conmon-2.1.4-3.fc36.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.4, commit: '
  cpuUtilization:
    idlePercent: 99.65
    systemPercent: 0.17
    userPercent: 0.18
  cpus: 8
  distribution:
    distribution: fedora
    variant: container
    version: "36"
  eventLogger: journald
  hostname: LAP-2180
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
  kernel: 5.10.102.1-microsoft-standard-WSL2
  linkmode: dynamic
  logDriver: journald
  memFree: 2029023232
  memTotal: 4113612800
  networkBackend: netavark
  ociRuntime:
    name: crun
    package: crun-1.6-2.fc36.x86_64
    path: /usr/bin/crun
    version: |-
      crun version 1.6
      commit: 18cf2efbb8feb2b2f20e316520e0fd0b6c41ef4d
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL
  os: linux
  remoteSocket:
    exists: true
    path: /run/user/1000/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: true
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.2.0-0.2.beta.0.fc36.x86_64
    version: |-
      slirp4netns version 1.2.0-beta.0
      commit: 477db14a24ff1a3de3a705e51ca2c4c1fe3dda64
      libslirp: 4.6.1
      SLIRP_CONFIG_VERSION_MAX: 3
      libseccomp: 2.5.3
  swapFree: 8577064960
  swapTotal: 8589934592
  uptime: 2h 35m 36.00s (Approximately 0.08 days)
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  volume:
  - local
registries:
  search:
  - registry.fedoraproject.org
  - registry.access.redhat.com
  - docker.io
  - quay.io
store:
  configFile: /home/user/.config/containers/storage.conf
  containerStore:
    number: 2
    paused: 0
    running: 0
    stopped: 2
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /home/user/.local/share/containers/storage
  graphRootAllocated: 269490393088
  graphRootUsed: 5408636928
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 4
  runRoot: /run/user/1000/containers
  volumePath: /home/user/.local/share/containers/storage/volumes
version:
  APIVersion: 4.2.1
  Built: 1662580699
  BuiltTime: Thu Sep  8 01:28:19 2022
  GitCommit: ""
  GoVersion: go1.18.5
  Os: linux
  OsArch: linux/amd64
  Version: 4.2.1

Have you tested with the latest version of Podman and have you checked the Podman Troubleshooting Guide? (https://github.com/containers/podman/blob/main/troubleshooting.md)

Yes/No

Additional environment details (AWS, VirtualBox, physical, etc.):
Running on Windows 11 21H2 (Builld 22000.1281)

[rhatdan]

If you change your target to

target: '/var/opt/mssql/data:Z,U'

Does this fix the problem.

[rhatdan]

Those options will change the SELinux labels and UIDs of the volume to match the SELinux and User within the container.

[aadithya96]

Oh wow, that worked. I'll go jump off a cliff now. You're a life saver. Thanks.

[aadithya96]

On another note, is there anything that could be preventing me from connecting to the sql server instance on 'localhost'? It works fine with 127.0.0.1.
Only udl is able to connect at localhost.

[mghaoui-interpulse]

On my machine, localhost translates to ::1: an ipv6 address and podman seems to default to an ipv4 network.