opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-08-06 11:32:07 +08:00
Code Issues Packages Projects Releases Wiki Activity

[CI:DOCS] Better document the default value of --userns

Browse Source 
Better document which value `podman run --userns` has if no default
value is specified. Also improve documentation of "host" being an alias
for "".

Fixes #15764

Signed-off-by: Philipp Wagner <phw@ibm.com>
This commit is contained in:
Philipp Wagner
2023-07-03 17:01:56 +02:00
committed by Ashley Cui
parent e4c38e7191
commit 924bc70550
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
docs/source/markdown/options/userns.container.md
View File

@ -4,7 +4,14 @@
####> are applicable to all of those.
#### **--userns**=*mode*
Set the user namespace mode for the container. It defaults to the **PODMAN_USERNS** environment variable unless `--pod` is specified. An empty value ("") means user namespaces are disabled unless an explicit mapping is set with the **--uidmap** and **--gidmap** options.
Set the user namespace mode for the container.
If `--userns` is not set the default value is determined as follows.
- If `--pod` is set, `--userns` is ignored and the user namespace of the pod is used.
- If the environment variable **PODMAN_USERNS** is set its value is used.
- Otherwise, `--userns=host` is assumed.
`--userns=""` (i.e., an empty string) is an alias for `--userns=host`.
This option is incompatible with **--gidmap**, **--uidmap**, **--subuidname** and **--subgidname**.
@ -40,7 +47,7 @@ Using `--userns=auto` when starting new containers does not work as long as any
**container:**_id_: join the user namespace of the specified container.
**host**: run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user (default).
**host** or **""** (empty string): run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user.
**keep-id**: creates a user namespace where the current user's UID:GID are mapped to the same values in the container. For containers created by root, the current mapping is created into a new user namespace.