SIGN IN SIGN UP
containers / podman UNCLAIMED

Podman: A tool for managing OCI containers and pods.

0 0 0 Go

Fix userns=auto failures in rootless mode

This commit fixes three related issues that prevented userns=auto from
working correctly in rootless containers:

1. Fix setgroups() error with userns=auto
   When using userns=auto, supplementary GIDs from the container image
   were being passed to setgroups() before user namespace mappings were
   allocated by storage, causing EINVAL errors. Added a check in
   container_internal_common.go to skip supplementary groups when
   AutoUserNs is enabled but GIDMap isn't populated yet.

2. Fix ID mapping allocation bug in storage.go
   CreateContainerStorage was returning empty UID/GID mappings from the
   input options parameter instead of the allocated mappings from the
   storage container object, causing containers to fail with "readlink:
   No such file or directory" errors. Changed the return statement to
   use container.UIDMap and container.GIDMap.

3. Add workaround for containers/storage v1.51.0 bug
   The vendored storage library has a bug in parseMountedFiles where
   groupFile path is incorrectly used as a directory path. Set an
   explicit Size=65536 in AutoUserNsOpts to bypass the buggy code path.

With these fixes, all userns=auto tests in 170-run-userns.bats now pass
in rootless mode.

Signed-off-by: Lokesh Mandvekar <[email protected]>
L
Lokesh Mandvekar committed
ca1a0db4e76e554292549279bc4d978c781cf29a
Parent: 141e6cd