fix(nb): give podman its subuid mapping inside Steam's FHS sandbox #247

Merged

dominik.polakovics merged 1 commit from fix/nb-steam-fhs-subuid into main

2026-08-01 14:02:44 +02:00

dominik.polakovics commented

2026-08-01 13:58:37 +02:00

Owner

Follow-up to #246, from actually testing the thing that PR left open: whether
rootless podman works inside Steam's FHS sandbox, which decides whether the WoW
card's session.sh can bring the server up itself.

What the test showed

Running steam-run — the same bubblewrap FHS env Steam launches children in:

podman on PATH: /run/current-system/sw/bin/podman
newuidmap:      /run/wrappers/bin/newuidmap
/etc/subuid:    MISSING
/etc/containers: MISSING
level=error msg="cannot find UID/GID for user dominik: open /etc/subuid: no such file or directory"
level=warning msg="Using rootless single mapping into the namespace..."
rootless=true driver=overlay

So podman is reachable in there — /run is bind-mounted, so
/run/current-system/sw/bin/podman resolves, and my earlier idea of adding it
to programs.steam.extraPackages was unnecessary (and would have built podman
for i686 into the bargain).

The real problem is narrower: buildFHSEnv synthesises /etc from a fixed
etcBindEntries list that includes passwd, group and shadow but omits
subuid and subgid. podman does not fail on that — it degrades silently,
warning Using rootless single mapping into the namespace and mapping uid 1000
alone.

That is fatal for this card specifically. Its image store and database carry
userns-mapped ownership — mysqld runs as uid 999 in the container, which lands
on host 100998 — so under a single mapping those files are unreachable and the
server cannot start.

The fix

steam accepts extraBwrapArgs as a package argument (by-name/st/steam/package.nix:10),
and the NixOS module's apply only overrides extraEnv, extraLibraries and
extraPkgs, so an override composes cleanly rather than being clobbered.
/etc/containers comes along for policy.json and registries.conf, which
podman wants for any image operation.

This keeps the card's own design intact — session.sh runs unmodified as the
Steam launch wrapper, no server split needed.

Testing

scripts/test-configuration nb passes. The runtime check is to re-run the
steam-run probe after deploy and confirm /etc/subuid is present and the
single-mapping warning is gone.

Follow-up to #246, from actually testing the thing that PR left open: whether rootless podman works inside Steam's FHS sandbox, which decides whether the WoW card's `session.sh` can bring the server up itself. ### What the test showed Running `steam-run` — the same bubblewrap FHS env Steam launches children in: ``` podman on PATH: /run/current-system/sw/bin/podman newuidmap: /run/wrappers/bin/newuidmap /etc/subuid: MISSING /etc/containers: MISSING level=error msg="cannot find UID/GID for user dominik: open /etc/subuid: no such file or directory" level=warning msg="Using rootless single mapping into the namespace..." rootless=true driver=overlay ``` So podman is reachable in there — `/run` is bind-mounted, so `/run/current-system/sw/bin/podman` resolves, and my earlier idea of adding it to `programs.steam.extraPackages` was unnecessary (and would have built podman for i686 into the bargain). The real problem is narrower: `buildFHSEnv` synthesises `/etc` from a fixed `etcBindEntries` list that includes `passwd`, `group` and `shadow` but omits `subuid` and `subgid`. podman does not fail on that — it **degrades silently**, warning `Using rootless single mapping into the namespace` and mapping uid 1000 alone. That is fatal for this card specifically. Its image store and database carry userns-mapped ownership — mysqld runs as uid 999 in the container, which lands on host `100998` — so under a single mapping those files are unreachable and the server cannot start. ### The fix `steam` accepts `extraBwrapArgs` as a package argument (`by-name/st/steam/package.nix:10`), and the NixOS module's `apply` only overrides `extraEnv`, `extraLibraries` and `extraPkgs`, so an override composes cleanly rather than being clobbered. `/etc/containers` comes along for `policy.json` and `registries.conf`, which podman wants for any image operation. This keeps the card's own design intact — `session.sh` runs unmodified as the Steam launch wrapper, no server split needed. ### Testing `scripts/test-configuration nb` passes. The runtime check is to re-run the `steam-run` probe after deploy and confirm `/etc/subuid` is present and the single-mapping warning is gone.

dominik.polakovics added 1 commit

2026-08-01 13:58:37 +02:00

fix(nb): give podman its subuid mapping inside Steam's FHS sandbox 653588dd41

The portable WoW card's Steam launch wrapper brings its AzerothCore containers
up itself, and Steam runs it inside a bubblewrap namespace every child process
inherits. podman is already reachable in there — /run is bind-mounted, so
/run/current-system/sw/bin/podman resolves — but buildFHSEnv synthesises /etc
from a fixed etcBindEntries list that includes passwd, group and shadow and
omits subuid and subgid.

Without them podman cannot find its mapping. It does not fail: it warns "Using
rootless single mapping into the namespace" and maps uid 1000 alone. The card's
image store and database carry userns-mapped ownership — mysqld runs as uid 999
inside the container, which lands on host 100998 — so under a single mapping
those files are unreachable and the server cannot start.

steam takes extraBwrapArgs as a package argument, and the NixOS module's apply
only overrides extraEnv, extraLibraries and extraPkgs, so it composes cleanly.
/etc/containers comes along for policy.json and registries.conf.

dominik.polakovics merged commit 1464686820 into main

2026-08-01 14:02:44 +02:00

dominik.polakovics deleted branch fix/nb-steam-fhs-subuid

2026-08-01 14:02:44 +02:00

dominik.polakovics referenced this pull request from a commit

2026-08-01 14:02:45 +02:00

Merge pull request 'fix(nb): give podman its subuid mapping inside Steam's FHS sandbox' (#247) from fix/nb-steam-fhs-subuid into main

dominik.polakovics referenced this pull request

2026-08-01 14:26:01 +02:00

feat(nb): run the WoW card's AzerothCore server as user units #248