Permission Issues with VSCode Dev Containers

[CrosleyZack]

I am trying to improve and generalize my develop setup with Dev Containers + Podman + Test Containers. I am running into some permission issues though. Specifically, running test container tests in a simple example I get a permissions error in the container. It does create the container successfully, but podman logs ... shows error:

chmod: /var/lib/postgresql/data: Operation not permitted
chmod: /var/run/postgresql: Operation not permitted
The files belonging to this database system will be owned by user "crosleyzack".
This user must also own the server process.

The database cluster will be initialized with locale "en_US.utf8".
The default database encoding has accordingly been set to "UTF8".
The default text search configuration will be set to "english".

Data page checksums are disabled.

initdb: error: could not change permissions of directory "/var/lib/postgresql/data": Operation not permitted
fixing permissions on existing directory /var/lib/postgresql/data ... %

This example worked without dev containers, but dev containers supposedly inherits your user UID and GID, so the permissions errors are strange. I have tried explicitly setting userns and privileged with no success.
The output of podman inspect shows:

               "IDMappings": {
                    "UidMap": [
                         "0:1:1000",
                         "1000:0:1",
                         "1001:1001:64536"
                    ],
                    "GidMap": [
                         "0:1:1000",
                         "1000:0:1",
                         "1001:1001:64536"
                    ]
               },

which looks like the route issue

[eriksjolund]

Your example uses the container image postgres:17-alpine
https://github.com/CrosleyZack/dev_setup_example/blob/985e4ef21cd047aaa19117fd06b5dee39bfe7f36/main_test.go#L81

I analysed that image with the following commands:

1. Log in as a unprivileged user to Fedora CoreOS
2. podman pull docker.io/library/postgres:17-alpine
3. podman run --rm --name test -d -e POSTGRES_PASSWORD=foobar docker.io/library/postgres:17-alpine
4. Run command

   podman exec test ls -ldn /var/lib/postgresql/data
   

   The following output is shown

   drwx------   19 70       70            4096 Jun 22 08:55 /var/lib/postgresql/data
   

   result: UID is 70 and GID is 70

Maybe it would start to work if you pass the argument --userns=keep-id:uid=70,gid=70 in your program?

Here are two examples where a local directory is bind-mounted.

Example 1: change ownership of the directory beforehand

1. Run commands

   podman unshare mkdir ~/dir
   podman unshare chown 70:70 ~/dir
   podman unshare chmod 700 ~/dir
   podman run --rm  --name test2 \
      -d \
      -v ./dir:/var/lib/postgresql/data \
      -e POSTGRES_PASSWORD=foobar \
         docker.io/library/postgres:17-alpine
   

2. Run command

   podman logs test2 2>&1 | grep "database system is ready to accept connections"
   

   The following output is shown

   2025-06-22 09:03:41.829 UTC [35] LOG:  database system is ready to accept connections
   2025-06-22 09:03:42.083 UTC [1] LOG:  database system is ready to accept connections
   

Example 2: use --userns=keep-id:uid=70,gid=70

1. Run commands

   podman unshare mkdir ~/dir
   podman unshare chmod 700 ~/dir
   podman run --rm  --name test2 \
      --userns keep-id:uid=70,gid=70 \
      -d \
      -v ./dir:/var/lib/postgresql/data \
      -e POSTGRES_PASSWORD=foobar \
         docker.io/library/postgres:17-alpine
   

2. Run command

   podman logs test2 2>&1 | grep "database system is ready to accept connections"
   

   The following output is shown

   2025-06-22 09:15:53.581 UTC [35] LOG:  database system is ready to accept connections
   2025-06-22 09:15:53.599 UTC [1] LOG:  database system is ready to accept connections
   

Another thing:

Maybe you need to specify

  ProviderType: tc.ProviderPodman,

?

https://github.com/testcontainers/testcontainers-go/blob/main/docs/system_requirements/using_podman.md