opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-08-06 11:32:07 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #18601 from giuseppe/block-PODMAN_USERNS-and---pod

Browse Source 
run: block PODMAN_USERNS and --pod
This commit is contained in:
OpenShift Merge Robot
2023-05-17 14:15:53 -04:00
committed by GitHub
parent 61fac1c12b 192ad70e98
commit ae66ad4265
3 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/source/markdown/options/userns.container.md
View File

@ -4,7 +4,7 @@
####> are applicable to all of those. ####> are applicable to all of those.
#### **--userns**=*mode* #### **--userns**=*mode*
Set the user namespace mode for the container. It defaults to the **PODMAN_USERNS** environment variable. An empty value ("") means user namespaces are disabled unless an explicit mapping is set with the **--uidmap** and **--gidmap** options. Set the user namespace mode for the container. It defaults to the **PODMAN_USERNS** environment variable unless `--pod` is specified. An empty value ("") means user namespaces are disabled unless an explicit mapping is set with the **--uidmap** and **--gidmap** options.
This option is incompatible with **--gidmap**, **--uidmap**, **--subuidname** and **--subgidname**. This option is incompatible with **--gidmap**, **--uidmap**, **--subuidname** and **--subgidname**.

6
pkg/specgenutil/specgen.go
View File

@ -220,9 +220,9 @@ func setNamespaces(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions)
return err return err
} }
} }
userns := os.Getenv("PODMAN_USERNS") userns := c.UserNS
if c.UserNS != "" { if userns == "" && c.Pod == "" {
userns = c.UserNS userns = os.Getenv("PODMAN_USERNS")
} }
// userns must be treated differently // userns must be treated differently
if userns != "" { if userns != "" {

5
test/e2e/run_userns_test.go
View File

@ -395,6 +395,11 @@ var _ = Describe("Podman UserNS support", func() {
inspect.WaitWithDefaultTimeout() inspect.WaitWithDefaultTimeout()
Expect(inspect.OutputToString()).To(Not(Equal("<nil>"))) Expect(inspect.OutputToString()).To(Not(Equal("<nil>")))
// --pod should work.
result = podmanTest.Podman([]string{"create", "--pod=new:new-pod", ALPINE, "true"})
result.WaitWithDefaultTimeout()
Expect(result).Should(Exit(0))
if IsRemote() { if IsRemote() {
podmanTest.RestartRemoteService() podmanTest.RestartRemoteService()
} }