Paul Holzinger d222a392cd rootless: support joining contianers that use host ns ...

The problem right now is that --ns contianer: syntax causes use to add
the namespace path to the spec which means the runtime will try to call
setns on that. This works fine for private namespaces but when the host
namspace is used by the container a rootless user is not allowed to
join that namespace so the setns call will return with permission
denied.

The fix is to effectively switch the container to the `host` mode
instead of `container:` when the mention container used the host ns. I
tried to fix this deep into the libpod call when we assign these
namespaces but the problem is that this does not work correctly because
these namespace require much more setup. Mainly different kind of mount
points to work correctly.

We already have similar work-arounds in place for pods because they also
need this.

For some reason this does not work with the user namespace, I don't know
why and I don't think it is really needed so I left this out just to get
at least the rest working. The original issue only reported this for the
network namespace.

Fixes #18027

Signed-off-by: Paul Holzinger <pholzing@redhat.com>

2023-04-25 15:21:31 +02:00

15 KiB

Raw Blame History

View Raw