5.17. Configuring pre-execution hooks in Podman

• Have to be root-owned and not writable.
• Have to be located in the /usr/libexec/podman/pre-exec-hooks and /etc/containers/pre-exec-hooks directories.
• Execute in sequentially and alphanumeric order.
• If all plugin scripts return zero value, then the podman command is executed.
• If any of the plugin scripts return a non-zero value, it indicates a failure. The podman command exits and returns the non-zero value of the first-failed script.

• Red Hat recommends to use the following naming convention to execute the scripts in the correct order: DDD_name.lang, where:

  • The DDD is the decimal number indicating the order of script execution. Use one or two leading zeros if necessary.
  • The name is the name of the plugin script.
  • The lang (optional) is the file extension for the given programming language. For example, the name of the plugin script can be: 001-check-groups.sh.

Prerequisites

• The container-tools meta-package is installed.

Procedure

• Create the script plugin named 001-check-groups.sh. For example:

  #!/bin/bash
  if id -nG "$USER" 2> /dev/null | grep -qw "$GROUP" 2> /dev/null ; then
      exit 0
  else
      exit 1
  fi

  • The script checks if a user is in a specified group.
  • The USER and GROUP are environment variables set by Podman.
  • Exit code provided by the 001-check-groups.sh script would be provided to the podman binary.
  • The podman command exits and returns the non-zero value of the first-failed script.

Verification

• Check if the 001-check-groups.sh script works correctly:

  $ podman run image
  ...

  If the user is not in the correct group, the following error appears:

  external preexec hook /etc/containers/pre-exec-hooks/001-check-groups.sh failed