https://bugzilla.redhat.com/show_bug.cgi?id=2333529
--- Comment #7 from Gregory Lee Bartholomew gregory.lee.bartholomew@gmail.com ---
I think if host system already installed sssd-2.10 and ownership was already updated, then upgrade withing container probably will not fail.
I was able to work around other bug that was preventing me from updating the host server. However, the situation is not resolved when updating the container. It turns out that the sssd user has different UIDs on the host system versus in the container. Consequently, SSSD is not working in the container when /var/lib/sss/mc and /var/lib/sss/pipes are bind-mounted from the host.
[root@container ~]# mount | grep sss root/0 on /var/lib/sss/mc type zfs (ro,relatime,seclabel,xattr,noacl,casesensitive) root/0 on /var/lib/sss/pipes type zfs (ro,relatime,seclabel,xattr,noacl,casesensitive)
[root@container ~]# ls -ld /var/lib/sss/{mc,pipes} drwxrwxr-x. 2 unbound radvd 6 Dec 24 12:20 /var/lib/sss/mc drwxrwxr-x. 3 unbound radvd 7 Dec 24 12:20 /var/lib/sss/pipes
[root@container ~]# getent passwd sssd sssd:x:942:395:User for sssd:/run/sssd:/sbin/nologin
[root@host ~]# getent passwd sssd sssd:x:986:982:User for sssd:/run/sssd/:/sbin/nologin
I think it is supposed to be possible to bind mount the /var/lib/sss/pipes and /var/lib/sss/mc directories from the host to the container and run just the sssd client in the container.