5:32 a.m.
On 8/4/23 11:16, Chris Evich wrote:
On 8/4/23 08:17, Daniel Walsh wrote:
> Rootful Podman looks for the user "containers" in /etc/subuid and
> /etc/subgid files and then divides the range of UIDs/GIDs in defined,
> containers/storage records the used UID ranges.
>
> With rootless, we sub-divide the users range.
Right, and I see `podman pod create` also supports passing
`--userns=auto`, so then all containers in that pod will have the same
user namespace "view" for shared volumes.
But now I'm questioning if podman really is "smart" enough to allocate
the same rootless "sub-range" (from a single big entry) every time.
Including across create/remove/create cycles for pods, containers, and
volumes.
Getting back to the suggestion for Mark's architecture (one user,
managing tens of pods/apps, while maintaining "defense in depth" as
much as possible). It would be really, really, really important for
the pods and/or containers to always grab the same "sub-range" when
using `--userns=auto`. Even if the pod or container is removed and
re-created (for example, maybe some option needs changing).
There is no guarantee that if you recreate the Pod/container that it
will get the same user namespace. If you want to guarantee this, you
would need to allocate the USERNS yourself. And isolate the range from
the range that podman users for --userns=auto, if you are using these
containers simultaneous.
Podman is not that sophisticated when it picks its range. I believe it
just looks sequentially through the list of unusers UIDs/GIDs and picks
the next available range.
Though maybe (again) I'm misunderstanding how `--userns=auto` is
suppose to work. It sounds like maybe the "sub-range" allocation is
somehow persisted along with the shared volume data? So preserving
the volume metadata then becomes incredibly important (unless you
enjoy lots of manual-chown-labor).
---
Chris Evich (he/him), RHCA III
Senior Quality Assurance Engineer
If there's a "hard-way", I'm the first one to implement it.
_______________________________________________
Podman mailing list -- podman(a)lists.podman.io
To unsubscribe send an email to podman-leave(a)lists.podman.io