Giuseppe Scrivano <gscrivan@redhat.com> wrote:

...

On 9/7/22 06:02, Rudolf Vesely via Podman wrote:

...

Hello Everybody,

I often run containers with the following mapping:

podman run --uidmap 0:1:1000 --gidmap 0:1:1000 --uidmap 1000:0:1 --gidmap 1000:0:1 --uidmap 1001:1002:64535 --gidmap 1001:1002:64535 --name foo -it localhost/bar bash

The reason is that "bar" image is build from containerfile that has user "foobar" and that user is configured to run processes ("USER foobar" in the containerfile) in containers run from the image.

The mapping above makes sure that foobar user has same ID in the container host as the user that runs containers on that host (my user account).

Could you please tell me is it possible to specify such uidmap/gidmap in Pod yaml?

I tried to run a container with the given uidmap/gidmap in a Pod and then "podman generate kube abc" but that didn't give me any extra properties that would configure uidmap/gidmap.

Thank you.

Kind regards,

Rudolf Vesely _______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io

I don't believe this mapping is possible yet in Kubernetes. Giuseppe is the one who would know the current state of User Namespace support in Kube.

user namespace support will be in Kubernetes 1.25 but it won't be possible to specify the mappings. It will only possible to specify that the pod will run in a distinct user namespace. The implementation is similar to our --userns=auto:size=65536 option.

We will want to plug that, although we probably want a different size when used in rootless mode as 65536 will consume all the available IDs.

Hi Giuseppe and Dan, Thank you very much for the fast response. Unfortunately "--userns=auto" is not the same as "--uidmap 0:1:1000 --gidmap 0:1:1000 --uidmap 1000:0:1 --gidmap 1000:0:1 --uidmap 1001:1002:64535 --gidmap 1001:1002:64535". I would be OK with a smaller size (8k instead of 64k) but I've just tested: id uid=16385(myuser) gid=16385(myuser) groups=16385(myuser) mkdir --mode=777 ~/this podman run --userns=auto:size=65536 --name test -v ~/this:/somewhere -d localhost/my-image podman exec test id uid=1000(user) gid=1000(user) groups=1000(user) podman exec test touch /somewhere/abcdef ls -l ~/this -rw-r--r-- 1 297608 297608 0 Sep 8 10:49 abcdef If I run it with the mapping above, the file would be owned by "myuser". So not possible but that's OK. Thank you. Kind regards, Rudolf Vesely