89luca89 / 89luca89/distrobox

[Suggestion] Support userns=auto compatibility

オープン
#1,655 コメント 0 件 リアクション 2 件 担当者 0 名 GitHub で見る
enhancement
主要言語
Go
スター
13k
フォーク
541
平均マージ
20時間 47分
マージ済み PR(30日)
4

説明

**Is your feature request related to a problem? Please describe.**

If you run some containers using userns=auto on your system distrobox will break the ability for these to run using keep-id. This isn't good if you're running services that are suppose to be isolated securely from each other on the same account.

For example, if you have an application podman container running a service you don't want it to share any user namespace UIDs with the host or any of the distrobox containers.

**Describe the solution you'd like**

Passing the podman flag size:65536 to the keep-id such as ```--userns keep-id:size=1024``` will only claim 65536 UIDs and allow userns=auto containers to run.

**Describe alternatives you've considered**

Having podman use something like ```--userns=auto:gidmapping=1000:0:1,uidmapping=1000:0:1,size=65536``` instead of keep-id would also work, but claim more UIDs for each container.

**Additional context**

One easy way to do this is to amend the existing code like this:

```
# Use keep-id only if going rootless.
if [ "${rootful}" -eq 0 ]; then
result_command="${result_command}
--userns keep-id"
fi

# Add :size=65536 if possible
if podman run --rm --userns=keep-id:size=65536 ${container_image} /bin/true 2>/dev/null || [ "$?" -eq 127 ] ; then
result_command="${result_command}:size=65536"
fi
```

I have tested this with podman with the https://github.com/containers/podman/pull/24882 PR that has been merged and things still seem to work.

A caveat here is that you need to re-create your distroboxes, but that is required with any solution to this.

コントリビューションガイド

コントリビューションガイドを開く

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。