nestybox / nestybox/sysbox

Sysbox doesn't seem to follow /etc/subuid when running a container

Open
#740 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

question
Dominant language
Shell
Stars
3.9k
Forks
230
Avg merge
7h 48m
Merged PRs (30d)
3

Description

Hi all,

I'm running Sysbox 0.6.2 release with docker locally.
I'm currently trying to increase /etc/subuid subordinate range for sysbox, since I want to try to run Podman inside system container.

Linux version:

$ uname -a
Linux mdev 6.2.0-35-generic #35~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Fri Oct  6 10:23:26 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

Output of /etc/subuid and /etc/subgid

$ cat /etc/subuid
mdev:100000:65539
sysbox:165539:100000
$ cat /etc/subgid
mdev:100000:65539
sysbox:165539:100000

When running docker container with following command:
$ docker run --runtime=sysbox-runc -it --rm --name=podman podman:v1

And executing inside the container:

podman@173ac4d31d89:/$ cat /proc/self/uid_map
         0     165539      65536

Is this expected or there's something on my part here which I didn't understand correctly how it works?
Should the given range inside container when cat /proc/self/uid_map be 100000 instead of 65536?
I've read docs and it says that with sysbox-mgr is possible to change this available range, but I couldn't find the right option for it.

Thanks!

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with sysbox-mgr's handling of the host /etc/subuid and /etc/subgid ranges, then compare those values with the container's /proc/self/uid_map output. Determine whether the 65,536-ID mapping is expected and document or identify the configuration needed to use the requested range for Podman inside the container.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, linux
Domain
infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.