From c271241945a5ecd5f23c849323486d502a65817e Mon Sep 17 00:00:00 2001 From: Mihai Petracovici Date: Fri, 17 Jul 2026 19:08:06 -0600 Subject: [PATCH] ephemeral run: propagate kvm group permissions to container Mounting /dev/kvm into the container is not sufficient when running through user mode podman on certain distributions. We should keep our host user group in the container to propogate the appropriate permissions for running VMs Signed-off-by: Mihai Petracovici --- crates/kit/src/run_ephemeral.rs | 3 +++ 1 file changed, 3 insertions(+) diff --git a/crates/kit/src/run_ephemeral.rs b/crates/kit/src/run_ephemeral.rs index 0f05b4195..8d7df96b1 100644 --- a/crates/kit/src/run_ephemeral.rs +++ b/crates/kit/src/run_ephemeral.rs @@ -822,6 +822,9 @@ fn prepare_run_command_with_temp( // Also needed for nested containers "--security-opt=seccomp=unconfined", "--security-opt=unmask=/proc/*", + // Devices like /dev/kvm with group access need those groups propagated to the + // container so commands in the container can use them + "--group-add=keep-groups", // This is a general hardening thing to do when running privileged "-v", "/sys:/sys:ro",