opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-07-15 03:02:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

rootless: require subids to be present

Browse Source 
Most images won't work without multiple ids/gids.  Error out
immediately if there are no multiple ids available.

The error code when the user is not present in /etc/sub{g,u}id looks
like:

$ bin/podman run --rm -ti alpine echo hello
ERRO[0000] No subuid ranges found for user "gscrivano"

Closes: https://github.com/projectatomic/libpod/issues/1087

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Closes: #1097
Approved by: rhatdan
This commit is contained in:
Giuseppe Scrivano
2018-07-16 10:10:20 +02:00
committed by Atomic Bot
parent 06c546e88d
commit 6372c977ea
3 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/podman.1.md
View File

@ -158,6 +158,8 @@ Podman can also be used as non-root user. When podman runs in rootless mode, an
Containers created by a non-root user are not visible to other users and are not seen or managed by podman running as root.
It is required to have multiple uids/gids set for an user. Be sure the user is present in the files `/etc/subuid` and `/etc/subgid`.
Images are pulled under `XDG_DATA_HOME` when specified, otherwise in the home directory of the user under `.local/share/containers/storage`.
Currently it is not possible to create a network device, so rootless containers need to run in the host network namespace. If a rootless container creates a network namespace,

3
pkg/rootless/rootless_linux.go
View File

@ -104,6 +104,9 @@ func BecomeRootInUserNS() (bool, int, error) {
var uids, gids []idtools.IDMap
username := os.Getenv("USER")
mappings, err := idtools.NewIDMappings(username, username)
if err != nil && os.Getenv("PODMAN_ALLOW_SINGLE_ID_MAPPING_IN_USERNS") == "" {
return false, -1, err
}
if err == nil {
uids = mappings.UIDs()
gids = mappings.GIDs()

1
test/e2e/rootless_test.go
View File

@ -82,6 +82,7 @@ var _ = Describe("Podman rootless", func() {
env := os.Environ()
env = append(env, fmt.Sprintf("XDG_RUNTIME_DIR=%s", xdgRuntimeDir))
env = append(env, fmt.Sprintf("HOME=%s", home))
env = append(env, "PODMAN_ALLOW_SINGLE_ID_MAPPING_IN_USERNS=1")
cmd := podmanTest.PodmanAsUser([]string{"run", "--rootfs", mountPath, "echo", "hello"}, 1000, 1000, env)
cmd.WaitWithDefaultTimeout()
Expect(cmd.LineInOutputContains("hello")).To(BeTrue())