opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-12-11 17:27:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

podman: allow to specify the userns to join

Browse Source 
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Closes: #1145
Approved by: rhatdan
This commit is contained in:
Giuseppe Scrivano
2018-07-24 17:12:33 +02:00
committed by Atomic Bot
parent 41c7e43b4d
commit 819c807125
4 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
cmd/podman/create.go
View File

@@ -374,7 +374,7 @@ func parseCreateOpts(ctx context.Context, c *cli.Context, runtime *libpod.Runtim
} }
usernsMode := container.UsernsMode(c.String("userns")) usernsMode := container.UsernsMode(c.String("userns"))
if !usernsMode.Valid() { if !cc.IsNS(string(usernsMode)) && !usernsMode.Valid() {
return nil, errors.Errorf("--userns %q is not valid", c.String("userns")) return nil, errors.Errorf("--userns %q is not valid", c.String("userns"))
} }

1
docs/podman-create.1.md
View File

@@ -582,6 +582,7 @@ Without this argument the command will be run as root in the container.
Set the usernamespace mode for the container. The use of userns is disabled by default. Set the usernamespace mode for the container. The use of userns is disabled by default.
**host**: use the host usernamespace and enable all privileged options (e.g., `pid=host` or `--privileged`). **host**: use the host usernamespace and enable all privileged options (e.g., `pid=host` or `--privileged`).
**ns**: specify the usernamespace to use.
**--uts**=*host* **--uts**=*host*

1
docs/podman-run.1.md
View File

@@ -612,6 +612,7 @@ Without this argument the command will be run as root in the container.
Set the usernamespace mode for the container. The use of userns is disabled by default. Set the usernamespace mode for the container. The use of userns is disabled by default.
`host`: use the host usernamespace and enable all privileged options (e.g., `pid=host` or `--privileged`). `host`: use the host usernamespace and enable all privileged options (e.g., `pid=host` or `--privileged`).
`ns`: specify the usernamespace to use.
**--uts**=*host* **--uts**=*host*

8
pkg/spec/spec.go
View File

@@ -326,6 +326,14 @@ func addPidNS(config *CreateConfig, g *generate.Generator) error {
} }
func addUserNS(config *CreateConfig, g *generate.Generator) error { func addUserNS(config *CreateConfig, g *generate.Generator) error {
if IsNS(string(config.UsernsMode)) {
g.AddOrReplaceLinuxNamespace(spec.UserNamespace, NS(string(config.UsernsMode)))
// runc complains if no mapping is specified, even if we join another ns. So provide a dummy mapping
g.AddLinuxUIDMapping(uint32(0), uint32(0), uint32(1))
g.AddLinuxGIDMapping(uint32(0), uint32(0), uint32(1))
}
if (len(config.IDMappings.UIDMap) > 0 || len(config.IDMappings.GIDMap) > 0) && !config.UsernsMode.IsHost() { if (len(config.IDMappings.UIDMap) > 0 || len(config.IDMappings.GIDMap) > 0) && !config.UsernsMode.IsHost() {
g.AddOrReplaceLinuxNamespace(spec.UserNamespace, "") g.AddOrReplaceLinuxNamespace(spec.UserNamespace, "")
} }