Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Suggestion] Support userns=auto compatibility #1655

Open
Jookia opened this issue Jan 9, 2025 · 0 comments
Open

[Suggestion] Support userns=auto compatibility #1655

Jookia opened this issue Jan 9, 2025 · 0 comments
Labels
enhancement New feature or request

Comments

@Jookia
Copy link

Jookia commented Jan 9, 2025

Is your feature request related to a problem? Please describe.

If you run some containers using userns=auto on your system distrobox will break the ability for these to run using keep-id. This isn't good if you're running services that are suppose to be isolated securely from each other on the same account.

For example, if you have an application podman container running a service you don't want it to share any user namespace UIDs with the host or any of the distrobox containers.

Describe the solution you'd like

Passing the podman flag size:65536 to the keep-id such as --userns keep-id:size=1024 will only claim 65536 UIDs and allow userns=auto containers to run.

Describe alternatives you've considered

Having podman use something like --userns=auto:gidmapping=1000:0:1,uidmapping=1000:0:1,size=65536 instead of keep-id would also work, but claim more UIDs for each container.

Additional context

One easy way to do this is to amend the existing code like this:

			# Use keep-id only if going rootless.
			if [ "${rootful}" -eq 0 ]; then
				result_command="${result_command}
					--userns keep-id"
			fi

			# Add :size=65536 if possible
			if podman run --rm --userns=keep-id:size=65536 ${container_image} /bin/true 2>/dev/null || [ "$?" -eq 127 ] ; then
				result_command="${result_command}:size=65536"
			fi

I have tested this with podman with the containers/podman#24882 PR that has been merged and things still seem to work.

A caveat here is that you need to re-create your distroboxes, but that is required with any solution to this.

@Jookia Jookia added the enhancement New feature or request label Jan 9, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant