Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add new --userns flag --userns=sync-id #15294

Closed
rhatdan opened this issue Aug 11, 2022 · 5 comments · Fixed by #15389
Closed

Add new --userns flag --userns=sync-id #15294

rhatdan opened this issue Aug 11, 2022 · 5 comments · Fixed by #15389
Assignees
@giuseppe
Labels
locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments.

Comments

@rhatdan
Copy link
Member

rhatdan commented Aug 11, 2022 •
edited

Basically currently we default in rootless users UID to root user.
--userns=keep-id maps your UID outside of container to UID inside of container.
--userns=keep-id-app would map your UID to the default UID of the app run within the container.

Meaning

$ podman run --user=1234 --userns=sync-id fedora cat /proc/self/uid_map
         0          1           1233
      1234       0           1
      1235       1235     62269

IE On the host my UID 3267 ends up getting mapped to UID 1234 inside of the container.

The benefit of this is it would fix issues like

#15292
@rhatdan rhatdan mentioned this issue Aug 16, 2022
Closed
@rhatdan rhatdan changed the title Add new --userns flag --userns=keep-id-app Add new --userns flag --userns=sync-id Aug 16, 2022
@rhatdan
Copy link
Member Author

rhatdan commented Aug 16, 2022

What do you think of --userns=sync-id?

@rhatdan
Copy link
Member Author

rhatdan commented Aug 16, 2022

I linked a use case on a MAC that we are hitting now, where a container wants to create files on a volume that do not match the UID of the user running Podman. It is failing since the :U is not allowed on a mac file system.
Similar issue would happen if you used an NFS directory mounted into a container from a rootless user. That ran with a non root user uid.

@mheon
Copy link
Member

mheon commented Aug 17, 2022

I suggested this a while back, but there has been a general lack of interest. No objection to adding it.

@rhatdan
Copy link
Member Author

rhatdan commented Aug 17, 2022

Well I guess I did not pay attention to you. :^(

giuseppe added a commit to giuseppe/libpod that referenced this issue Aug 19, 2022
@giuseppe
podman: add uid and gid options to keep-id
c8f30fc 
add two new options to the keep-id user namespace option:

- uid: allow to override the UID used inside the container.
- gid: allow to override the GID used inside the container.

For example, the following command will map the rootless user (that
has UID=0 inside the rootless user namespace) to the UID=11 inside the
container user namespace:

$ podman run --userns=keep-id:uid=11 --rm -ti  fedora cat /proc/self/uid_map
         0          1         11
        11          0          1
        12         12      65525

Closes: containers#15294

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
@giuseppe giuseppe mentioned this issue Aug 19, 2022
Merged
@giuseppe
Copy link
Member

it is not a complete solution but I've opened a PR to add the uid and gid options to keep-id: #15389

Solving the problem in a completely automatic way would require more steps.

We need to mount the container storage to parse the /etc/passwd for resolving --user directives, but we currently mount the storage after we know the namespace mappings. For supporting something like --userns=sync-id, we would need to mount the container image twice: first to parse the /etc/passwd file, then with the correct mappings we picked for the user namespace.

giuseppe added a commit to giuseppe/libpod that referenced this issue Aug 19, 2022
@giuseppe
podman: add uid and gid options to keep-id
3521582 
add two new options to the keep-id user namespace option:

- uid: allow to override the UID used inside the container.
- gid: allow to override the GID used inside the container.

For example, the following command will map the rootless user (that
has UID=0 inside the rootless user namespace) to the UID=11 inside the
container user namespace:

$ podman run --userns=keep-id:uid=11 --rm -ti  fedora cat /proc/self/uid_map
         0          1         11
        11          0          1
        12         12      65525

Closes: containers#15294

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
giuseppe added a commit to giuseppe/libpod that referenced this issue Aug 19, 2022
@giuseppe
podman: add uid and gid options to keep-id
f466619 
add two new options to the keep-id user namespace option:

- uid: allow to override the UID used inside the container.
- gid: allow to override the GID used inside the container.

For example, the following command will map the rootless user (that
has UID=0 inside the rootless user namespace) to the UID=11 inside the
container user namespace:

$ podman run --userns=keep-id:uid=11 --rm -ti  fedora cat /proc/self/uid_map
         0          1         11
        11          0          1
        12         12      65525

Closes: containers#15294

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
giuseppe added a commit to giuseppe/libpod that referenced this issue Aug 19, 2022
@giuseppe
podman: add uid and gid options to keep-id
d342bf7 
add two new options to the keep-id user namespace option:

- uid: allow to override the UID used inside the container.
- gid: allow to override the GID used inside the container.

For example, the following command will map the rootless user (that
has UID=0 inside the rootless user namespace) to the UID=11 inside the
container user namespace:

$ podman run --userns=keep-id:uid=11 --rm -ti  fedora cat /proc/self/uid_map
         0          1         11
        11          0          1
        12         12      65525

Closes: containers#15294

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
giuseppe added a commit to giuseppe/libpod that referenced this issue Aug 22, 2022
@giuseppe
podman: add uid and gid options to keep-id
995d0a1 
add two new options to the keep-id user namespace option:

- uid: allow to override the UID used inside the container.
- gid: allow to override the GID used inside the container.

For example, the following command will map the rootless user (that
has UID=0 inside the rootless user namespace) to the UID=11 inside the
container user namespace:

$ podman run --userns=keep-id:uid=11 --rm -ti  fedora cat /proc/self/uid_map
         0          1         11
        11          0          1
        12         12      65525

Closes: containers#15294

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
giuseppe added a commit to giuseppe/libpod that referenced this issue Aug 24, 2022
@giuseppe
podman: add uid and gid options to keep-id
9d83bf1 
add two new options to the keep-id user namespace option:

- uid: allow to override the UID used inside the container.
- gid: allow to override the GID used inside the container.

For example, the following command will map the rootless user (that
has UID=0 inside the rootless user namespace) to the UID=11 inside the
container user namespace:

$ podman run --userns=keep-id:uid=11 --rm -ti  fedora cat /proc/self/uid_map
         0          1         11
        11          0          1
        12         12      65525

Closes: containers#15294

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
giuseppe added a commit to giuseppe/libpod that referenced this issue Aug 30, 2022
@giuseppe
podman: add uid and gid options to keep-id
e015c9e 
add two new options to the keep-id user namespace option:

- uid: allow to override the UID used inside the container.
- gid: allow to override the GID used inside the container.

For example, the following command will map the rootless user (that
has UID=0 inside the rootless user namespace) to the UID=11 inside the
container user namespace:

$ podman run --userns=keep-id:uid=11 --rm -ti  fedora cat /proc/self/uid_map
         0          1         11
        11          0          1
        12         12      65525

Closes: containers#15294

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
@github-actions github-actions bot added the locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. label Sep 17, 2023
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Sep 17, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@giuseppe giuseppe

Labels
locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments.
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

podman: add uid and gid options to keep-id giuseppe/libpod
3 participants
@giuseppe @rhatdan @mheon