opencontainers / opencontainers/image-spec

Should containers inherits the group/gid from the image configuration?

Open
#741 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
4.5k
Forks
891
Avg merge
27d 2h
Merged PRs (30d)
1

Description

From https://github.com/opencontainers/image-spec/blob/master/config.md#properties

User string, OPTIONAL

The username or UID which is a platform-specific structure that allows specific control over which user 
the process run as. This acts as a default value to use when the value is not specified when creating a 
container. For Linux based systems, all of the following are valid: user, uid, user:group, uid:gid, 
uid:group, user:gid. If group/gid is not specified, the default group and supplementary groups of the 
given user/uid in /etc/passwd from the container are applied.

the scenario is simple, what happens in the following case:

User 1000:100

and the container runtime just specifies to run the container as user 3000? Should it inherit the group from the image configuration? it shoiuld run the container as 3000:100. Right now, in docker for instance, that's not the case, it'll end up running 3000:0 (0 being a default).

/cc @simo5 @vbatts
xref https://github.com/openshift/origin/issues/8618

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the linked OCI image-spec config.md section and the referenced OpenShift issue. Compare the stated User value semantics with Docker's behavior for a runtime user override. Done means the inheritance question has a decided, documented specification outcome; no repository file or test is named in the issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker
Domain
infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.