Rootless podman export of a keep-id container shifts every file owner, exit 0

The issue lies with the way podman exports files from a rootless container created with --userns=keep-id. When the files are tarred during the export, their owner and group IDs are shifted by the container's ID mapping. This means that files that were previously owned by the container's user (UID 1000 in the example) appear in the exported tarball with owners UID 1, causing problems such as permissions errors when the exported tarball is imported and used in a new container.

For example, a note file created by the user inside the container would have its owner set to UID 1 in the exported tarball, preventing the user from writing to it upon importing the tarball. This issue impacts not only the user's home directory but also system files and setuid binaries, which are also affected by the shift in owners and groups.

The export process does not pass any ID mapping to the tar writer, which means the original owners and groups are not preserved. This behavior was present in podman version 5.4.2 and in the current main version, making it a consistent issue across different podman releases.

The problem is tricky to detect since the export command does not output any information about the file owners or IDs, and the man page does not mention user namespaces or ID mappings. The tarball itself appears to contain the correct files with their proper permission bits, but the owner and group columns in the `tar tv` list are incorrect.

To resolve this issue, the recommended solution is to use podman commit to create a new container image from the keep-id container. This new image will have the correct file ownerships, and exporting and importing this new image will result in the expected file permissions. The check-podman-export-idmap.sh script can be used to identify containers that are at risk of this issue.