[Suggestion] Support userns=auto compatibility
- 主要言語
- Go
- スター
- 13k
- フォーク
- 541
- 平均マージ
- 20時間 47分
- マージ済み PR(30日)
- 4
説明
**Is your feature request related to a problem? Please describe.**
If you run some containers using userns=auto on your system distrobox will break the ability for these to run using keep-id. This isn't good if you're running services that are suppose to be isolated securely from each other on the same account.
For example, if you have an application podman container running a service you don't want it to share any user namespace UIDs with the host or any of the distrobox containers.
**Describe the solution you'd like**
Passing the podman flag size:65536 to the keep-id such as ```--userns keep-id:size=1024``` will only claim 65536 UIDs and allow userns=auto containers to run.
**Describe alternatives you've considered**
Having podman use something like ```--userns=auto:gidmapping=1000:0:1,uidmapping=1000:0:1,size=65536``` instead of keep-id would also work, but claim more UIDs for each container.
**Additional context**
One easy way to do this is to amend the existing code like this:
```
# Use keep-id only if going rootless.
if [ "${rootful}" -eq 0 ]; then
result_command="${result_command}
--userns keep-id"
fi
# Add :size=65536 if possible
if podman run --rm --userns=keep-id:size=65536 ${container_image} /bin/true 2>/dev/null || [ "$?" -eq 127 ] ; then
result_command="${result_command}:size=65536"
fi
```
I have tested this with podman with the https://github.com/containers/podman/pull/24882 PR that has been merged and things still seem to work.
A caveat here is that you need to re-create your distroboxes, but that is required with any solution to this.
コントリビューションガイド
評価
この issue はまだ評価されていません。