You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
If you run some containers using userns=auto on your system distrobox will break the ability for these to run using keep-id. This isn't good if you're running services that are suppose to be isolated securely from each other on the same account.
For example, if you have an application podman container running a service you don't want it to share any user namespace UIDs with the host or any of the distrobox containers.
Describe the solution you'd like
Passing the podman flag size:65536 to the keep-id such as --userns keep-id:size=1024 will only claim 65536 UIDs and allow userns=auto containers to run.
Describe alternatives you've considered
Having podman use something like --userns=auto:gidmapping=1000:0:1,uidmapping=1000:0:1,size=65536 instead of keep-id would also work, but claim more UIDs for each container.
Additional context
One easy way to do this is to amend the existing code like this:
# Use keep-id only if going rootless.
if [ "${rootful}" -eq 0 ]; then
result_command="${result_command}
--userns keep-id"
fi
# Add :size=65536 if possible
if podman run --rm --userns=keep-id:size=65536 ${container_image} /bin/true 2>/dev/null || [ "$?" -eq 127 ] ; then
result_command="${result_command}:size=65536"
fi
I have tested this with podman with the containers/podman#24882 PR that has been merged and things still seem to work.
A caveat here is that you need to re-create your distroboxes, but that is required with any solution to this.
The text was updated successfully, but these errors were encountered:
Is your feature request related to a problem? Please describe.
If you run some containers using userns=auto on your system distrobox will break the ability for these to run using keep-id. This isn't good if you're running services that are suppose to be isolated securely from each other on the same account.
For example, if you have an application podman container running a service you don't want it to share any user namespace UIDs with the host or any of the distrobox containers.
Describe the solution you'd like
Passing the podman flag size:65536 to the keep-id such as
--userns keep-id:size=1024
will only claim 65536 UIDs and allow userns=auto containers to run.Describe alternatives you've considered
Having podman use something like
--userns=auto:gidmapping=1000:0:1,uidmapping=1000:0:1,size=65536
instead of keep-id would also work, but claim more UIDs for each container.Additional context
One easy way to do this is to amend the existing code like this:
I have tested this with podman with the containers/podman#24882 PR that has been merged and things still seem to work.
A caveat here is that you need to re-create your distroboxes, but that is required with any solution to this.
The text was updated successfully, but these errors were encountered: