podman: add uid and gid options to keep-id #15389

giuseppe · 2022-08-19T13:19:41Z

add two new options to the keep-id user namespace option:

uid: allow to override the UID used inside the container.
gid: allow to override the GID used inside the container.

For example, the following command will map the rootless user (that
has UID=0 inside the rootless user namespace) to the UID=11 inside the
container user namespace:

$ podman run --userns=keep-id:uid=11 --rm -ti fedora cat /proc/self/uid_map
0 1 11
11 0 1
12 12 65525

Closes: #15294

Does this PR introduce a user-facing change?

The --userns=keep-id now supports the options `uid` and `gid` to override the IDs used inside the user namespace

openshift-ci · 2022-08-19T13:19:48Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: giuseppe

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [giuseppe]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

vrothberg · 2022-08-22T11:22:09Z

Rebasing will fix CI

rhatdan · 2022-08-22T20:17:33Z

I like the idea, but this makes a lot of assumptions around the user knowing the UID inside of the container to run with.

podman run --userns=keep-id:user ...

Would be nicer, but as you say, you would need to do a lot more diagnosing to figure this out if the container run as the mysql user.

TomSweeneyRedHat · 2022-08-23T02:33:00Z

Changes LGTM, but I"ll let @rhatdan give the final approval.

umohnani8 · 2022-08-23T15:21:29Z

changes LGTM

giuseppe · 2022-08-23T20:31:37Z

rebased, tests are green now

docs/source/markdown/podman-create.1.md.in

vrothberg

LGTM
@edsantiago PTAL

edsantiago

You went with the version from podman-create, which LGTM.

One change request, and lots of pointing-outs for those not running markdown-preprocess-review.

Thank you for doing this! This is one option that I could not do on my own.

edsantiago · 2022-08-24T10:54:21Z

docs/source/markdown/podman-run.1.md.in

-
-Podman allocates unique ranges of UIDs and GIDs from the `containers` subordinate user ids. The size of the ranges is based on the number of UIDs required in the image. The number of UIDs and GIDs can be overridden with the `size` option.
-
-The rootless option `--userns=keep-id` uses all the subuids and subgids of the user. Using `--userns=auto` when starting new containers will not work as long as any containers exist that were started with `--userns=keep-id`.


This line does not appear in any other file (podman-create, podman-kube-play) and was not selected for the final winner.

edsantiago · 2022-08-24T10:56:20Z

docs/source/markdown/options/userns.container.md

+
+Example: `containers:2147483647:2147483648`.
+
+Podman allocates unique ranges of UIDs and GIDs from the `containers` subordinate user ids. The size of the ranges is based on the number of UIDs required in the image. The number of UIDs and GIDs can be overridden with the `size` option. The `auto` options currently does not work in rootless mode


The final sentence ("auto options ... rootless mode") does not appear in the podman-run file. It does appear in podman-create and podman-kube-play and here (in the winner). Someone please confirm that it is applicable to podman-run also.

oh that is a mistake, it works in rootless mode. I'll drop it

edsantiago · 2022-08-24T10:58:15Z

docs/source/markdown/podman-kube-play.1.md.in

-
-**container:**_id_: join the user namespace of the specified container.
-
-**host**: create a new namespace for the container.


This text loses out. Someone please double-check that the new text is applicable to kube-play.

edsantiago · 2022-08-24T10:58:43Z

docs/source/markdown/options/userns.container.md

+
+**nomap**: creates a user namespace where the current rootless user's UID:GID are not mapped into the container. This option is not allowed for containers created by the root user.
+
+**ns:**_namespace_: run the container in the given existing user namespace.


Please change this to <<container|pod>>

this is the path to an existing namespace. It can have the form /proc/$PID/ns/user as well as a path on the file system which pins an existing user namespace.

I'm sorry, I don't understand how this addresses my request. I'll try to restate it in diff form:

- ...run the container in + ...run the <<container|pod>> in

Reason: you are including this new file in podman-kube-play, which talks in terms of pods, not containers.

I strongly encourage you to run hack/markdown-preprocess-review to verify your man-page changes. (Requires dnf install diffuse).

This is still not addressed in your latest push. Is that an oversight, or is it deliberate?

sorry, my fault. I misunderstood your comment earlier. I assumed it was about the _namespace_ bit.

I've fixed it now and pushed a new version.

docs/source/markdown/options/userns.container.md

edsantiago · 2022-08-24T11:28:19Z

bud test failure is the nasty 0x3c flake (which I haven't filed as an issue, because it's pretty obviously a bug with access.redhat.com). Restarted, even though PR might need one more resubmit.

edsantiago · 2022-08-29T16:44:37Z

ping, this is awaiting input from a userns expert. Please see the questions I've raised in the man page.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

add two new options to the keep-id user namespace option: - uid: allow to override the UID used inside the container. - gid: allow to override the GID used inside the container. For example, the following command will map the rootless user (that has UID=0 inside the rootless user namespace) to the UID=11 inside the container user namespace: $ podman run --userns=keep-id:uid=11 --rm -ti fedora cat /proc/self/uid_map 0 1 11 11 0 1 12 12 65525 Closes: containers#15294 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

giuseppe · 2022-08-30T12:45:00Z

addressed the comments and pushed a new version

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

edsantiago · 2022-08-30T19:53:21Z

@vrothberg could you PTAL at this flake when you get in Wednesday? Ununtu rootless, and it looks like the recent RHEL7 conmon bug:

[+1081s] not ok 274 podman generate - systemd - basic
...
         # #/vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
         # #|     FAIL: state of service after systemctl stop
         # #| expected: = 'ActiveState=inactive'
         # #|   actual:   'ActiveState=failed'

rhatdan · 2022-08-31T12:27:09Z

/lgtm

openshift-ci bot added the do-not-merge/release-note-label-needed Enforce release-note requirement, even if just None label Aug 19, 2022

openshift-ci bot added approved Indicates a PR has been approved by an approver from all required OWNERS files. release-note and removed do-not-merge/release-note-label-needed Enforce release-note requirement, even if just None labels Aug 19, 2022

giuseppe mentioned this pull request Aug 19, 2022

Add new --userns flag --userns=sync-id #15294

Closed

giuseppe force-pushed the userns-map-user branch 3 times, most recently from f466619 to d342bf7 Compare August 19, 2022 15:26

giuseppe force-pushed the userns-map-user branch from d342bf7 to 995d0a1 Compare August 22, 2022 21:18

rhatdan reviewed Aug 23, 2022

View reviewed changes

docs/source/markdown/podman-create.1.md.in Outdated Show resolved Hide resolved

giuseppe force-pushed the userns-map-user branch from 995d0a1 to a4ba829 Compare August 24, 2022 09:59

vrothberg reviewed Aug 24, 2022

View reviewed changes

edsantiago reviewed Aug 24, 2022

View reviewed changes

giuseppe added 2 commits August 30, 2022 14:39

infra: remove dead code

cd62606

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

giuseppe force-pushed the userns-map-user branch from a4ba829 to 898b157 Compare August 30, 2022 12:44

docs: move userns options to separate file

8637548

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

giuseppe force-pushed the userns-map-user branch from 898b157 to 8637548 Compare August 30, 2022 13:12

openshift-ci bot assigned rhatdan Aug 31, 2022

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Aug 31, 2022

openshift-merge-robot merged commit 9b4dac4 into containers:main Aug 31, 2022

Hi-Angel mentioned this pull request Nov 16, 2022

Mounted volume changes user ID's of files #7052

Closed

github-actions bot added the locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. label Sep 20, 2023

github-actions bot locked as resolved and limited conversation to collaborators Sep 20, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

podman: add uid and gid options to keep-id #15389

podman: add uid and gid options to keep-id #15389

giuseppe commented Aug 19, 2022 •

edited

openshift-ci bot commented Aug 19, 2022

vrothberg commented Aug 22, 2022

rhatdan commented Aug 22, 2022

TomSweeneyRedHat commented Aug 23, 2022

umohnani8 commented Aug 23, 2022

giuseppe commented Aug 23, 2022

vrothberg left a comment

edsantiago left a comment

edsantiago Aug 24, 2022

edsantiago Aug 24, 2022

giuseppe Aug 30, 2022

edsantiago Aug 24, 2022

edsantiago Aug 24, 2022

giuseppe Aug 30, 2022

edsantiago Aug 30, 2022

edsantiago Aug 30, 2022

giuseppe Aug 30, 2022

edsantiago commented Aug 24, 2022

edsantiago commented Aug 29, 2022

giuseppe commented Aug 30, 2022

edsantiago commented Aug 30, 2022

rhatdan commented Aug 31, 2022


		Podman allocates unique ranges of UIDs and GIDs from the `containers` subordinate user ids. The size of the ranges is based on the number of UIDs required in the image. The number of UIDs and GIDs can be overridden with the `size` option.

		The rootless option `--userns=keep-id` uses all the subuids and subgids of the user. Using `--userns=auto` when starting new containers will not work as long as any containers exist that were started with `--userns=keep-id`.


		Example: `containers:2147483647:2147483648`.

		Podman allocates unique ranges of UIDs and GIDs from the `containers` subordinate user ids. The size of the ranges is based on the number of UIDs required in the image. The number of UIDs and GIDs can be overridden with the `size` option. The `auto` options currently does not work in rootless mode


		container:_id_: join the user namespace of the specified container.

		host: create a new namespace for the container.


		nomap: creates a user namespace where the current rootless user's UID:GID are not mapped into the container. This option is not allowed for containers created by the root user.

		ns:_namespace_: run the container in the given existing user namespace.

podman: add uid and gid options to keep-id #15389

podman: add uid and gid options to keep-id #15389

Conversation

giuseppe commented Aug 19, 2022 • edited

Does this PR introduce a user-facing change?

openshift-ci bot commented Aug 19, 2022

vrothberg commented Aug 22, 2022

rhatdan commented Aug 22, 2022

TomSweeneyRedHat commented Aug 23, 2022

umohnani8 commented Aug 23, 2022

giuseppe commented Aug 23, 2022

vrothberg left a comment

Choose a reason for hiding this comment

edsantiago left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

edsantiago commented Aug 24, 2022

edsantiago commented Aug 29, 2022

giuseppe commented Aug 30, 2022

edsantiago commented Aug 30, 2022

rhatdan commented Aug 31, 2022

giuseppe commented Aug 19, 2022 •

edited