sudo /usr/local/bin/buildkitd &

INFO[2024-01-17T23:05:15+09:00] auto snapshotter: using overlayfs
WARN[2024-01-17T23:05:15+09:00] using host network as the default
INFO[2024-01-17T23:05:15+09:00] found worker "icepdj7khuiltkpxu75ft0k9w", labels=map[org.mobyproject.buildkit.worker.executor:oci org.mobyproject.buildkit.worker.hostname:k3s-prd-agent-a org.mobyproject.buildkit.worker.network:host org.mobyproject.buildkit.worker.oci.process-mode:sandbox org.mobyproject.buildkit.worker.selinux.enabled:false org.mobyproject.buildkit.worker.snapshotter:overlayfs], platforms=[linux/arm64 linux/arm/v7 linux/arm/v6]
WARN[2024-01-17T23:05:15+09:00] skipping containerd worker, as "/run/containerd/containerd.sock" does not exist
INFO[2024-01-17T23:05:15+09:00] found 1 workers, default="icepdj7khuiltkpxu75ft0k9w"
WARN[2024-01-17T23:05:15+09:00] currently, only the default worker can be used.
INFO[2024-01-17T23:05:15+09:00] running server on /run/buildkit/buildkitd.sock

error: failed to solve: failed to compute cache key: mount callback failed on /var/lib/containerd/tmpmounts/containerd-mount2455064670: failed to Lchown "/var/lib/containerd/tmpmounts/containerd-mount2455064670/etc/gshadow" for UID 0, GID 42: lchown /var/lib/containerd/tmpmounts/containerd-mount2455064670/etc/gshadow: operation not permitted: unknown

Why doesn’t Podman support storage on NFS?
The use case that does not work well is having the container image store reside on an NFS mount point.
ンテナイメージをNFS上に置くのは良くないらしい。

The NFS protocol has no concept of user namespaces and has no way to know that the process running as UID 1000 is in one.
The NFS server also has no way of knowing that the client process has DAC_OVERRIDE for the user namespace and that UID 100059 is mapped into the same user namespace.
In other words, the chance of this information being known by NFS is slim at best.

NFSサーバ側はクライアント側で DAC_OVERRIDE しようとしているかなど分からない(NFSはサポートしていない機能なので仕方がない)

Mar  6 00:39:00 marie-ms7817 systemd[1055]: Started libcontainer container d1b514a134af96a15f5062afe042fd8654d91b2be4bef27f9af5865e29d2cad7.
Mar  6 00:40:30 marie-ms7817 kernel: [ 7375.140738] audit: type=1400 audit(1709653230.078:103): apparmor="DENIED" operation="change_onexec" class="file" info="label not found" error=-2 profile="unconfined" name="nerdctl-default" pid=54813 comm="aa-exec"

sudo aa-status

#include <tunables/global>

profile nerdctl-default flags=(attach_disconnected,mediate_deleted) {
    / r,
    /dev/tty rw,
    /dev/pts/** w,
    /dev/null rw,
    /etc/.ro*/ld.so.cache r,
    /etc/ld.so.cache r,
    /etc/locale.alias r,
    /etc/nsswitch.conf r,
    /etc/passwd r,
    /mnt/append-disk/containerd/** rwk,
    /proc/ r,
    /proc/** r,
    /sys/devices/system/** r,
    /sys/kernel/mm/transparent_hugepage/hpage_pmd_size r,
    /usr/bin/** rix,
    /usr/lib/locale/locale-archive r,
    /usr/lib/x86_64-linux-gnu/** rm,
    /usr/lib/locale/** r,
    /usr/share/terminfo/** r,
    /var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/** rwk,
    /var/lib/containerd/** rwk,
    owner /** rwix,
    network,
    ptrace (read, readby) peer=nerdctl-default,
    signal (receive) peer=nerdctl-default,
    signal (receive) peer=unconfined,
    signal (send) peer=nerdctl-default,
    signal (send) set=kill peer=unconfined,
}