mirror of
https://github.com/containers/podman.git
synced 2025-06-01 17:17:47 +08:00
72382a12a7
simplify the rootless implementation to use a single user namespace for all the running containers. This makes the rootless implementation behave more like root Podman, where each container is created in the host environment. There are multiple advantages to it: 1) much simpler implementation as there is only one namespace to join. 2) we can join namespaces owned by different containers. 3) commands like ps won't be limited to what container they can access as previously we either had access to the storage from a new namespace or access to /proc when running from the host. 4) rootless varlink works. 5) there are only two ways to enter in a namespace, either by creating a new one if no containers are running or joining the existing one from any container. Containers created by older Podman versions must be restarted. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
34 lines
1.2 KiB
Go
34 lines
1.2 KiB
Go
// +build !linux
|
|
|
|
package rootless
|
|
|
|
import (
|
|
"github.com/pkg/errors"
|
|
)
|
|
|
|
// IsRootless returns false on all non-linux platforms
|
|
func IsRootless() bool {
|
|
return false
|
|
}
|
|
|
|
// BecomeRootInUserNS re-exec podman in a new userNS. It returns whether podman was re-executed
|
|
// into a new user namespace and the return code from the re-executed podman process.
|
|
// If podman was re-executed the caller needs to propagate the error code returned by the child
|
|
// process. It is a convenience function for BecomeRootInUserNSWithOpts with a default configuration.
|
|
func BecomeRootInUserNS() (bool, int, error) {
|
|
return false, -1, errors.New("this function is not supported on this os")
|
|
}
|
|
|
|
// GetRootlessUID returns the UID of the user in the parent userNS
|
|
func GetRootlessUID() int {
|
|
return -1
|
|
}
|
|
|
|
// JoinUserAndMountNS re-exec podman in a new userNS and join the user and mount
|
|
// namespace of the specified PID without looking up its parent. Useful to join directly
|
|
// the conmon process. It is a convenience function for JoinUserAndMountNSWithOpts
|
|
// with a default configuration.
|
|
func JoinUserAndMountNS(pid uint) (bool, int, error) {
|
|
return false, -1, errors.New("this function is not supported on this os")
|
|
}
|