[RFC] runc cli: --rootless flag idiosyncrasies

Open
#2,645 2 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Stale
Tech stack
go
Domain
cli

Research direction

Start by comparing the global runc help output with runc spec --help and trace how each --rootless flag is defined and applied to the affected commands. The work is done when maintainers agree on consistent flag semantics, deprecation warnings, and the eventual removal plan described in the proposal.

Written by the indexing model from the issue text.

Description

While looking into https://github.com/opencontainers/runc/issues/2639 I found out we have two --rootless flags with different meaning:

  1. Global flag, documented in runc help as
   --rootless value    ignore cgroup permission errors ('true', 'false', or 'auto') (default: "auto")
  1. A flag specific to spec, documented in runc spec --help as
   --rootless                generate a configuration for a rootless container

The problem here is non-uniform syntax:

  1. The first (global) option applies (I guess) to create, run, exec and update), the second applies to spec.

  2. The second option is true boolean, meaning that specifying --rootless is equivalent to --rootless=true. This is what I would expect. The first option is "bool-or-auto" meaning that specifying --rootless is equivalent to no option, and to actually enable rootless mode one has to use --rootless=true.

Both items are confusing, second is more.

Proposal

I think we can do the following to rectify this:

  1. Deprecate the local --rootless flag for runc spec, adding a warning that the global one should be used.

  2. Make the global --rootless equivalent to --rootless=yes, and warn that using --rootless=auto is deprecated (as it is "auto" without specifying any option).

  3. Eventually remove the local --rootless and the global --rootless=auto.

@AkihiroSuda @cyphar @mrunalp what do you think?

Dominant language
Go
Stars
13.5k
Forks
2.3k
Avg merge
2d 8h
Merged PRs (30d)
30

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from opencontainers/runc

All issues in opencontainers/runc

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.