[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: giuseppe

The full list of commands accepted by this bot can be found here.

The pull request process is described here

LGTM

How should this be integrated in to newer projects like distrobox? A version check to see if podman is > 5.3.1? Othersize size is undefined.

I'm going to test this this weekend and try to integrate it in to distrobox to see if this works for my use case. I'll report back if it's a good solution for this problem.

How should this be integrated in to newer projects like distrobox? A version check to see if podman is > 5.3.1? Othersize size is undefined.

personally I don't like version checks, it is error prone and it won't work if we backport the feature to older releases.

You could just run a simple container with that option and see if it works podman run --rm --userns=keep-id:size=1 $IMG /bin/true, or if it fails with Error: unknown option specified: "size"

How should this be integrated in to newer projects like distrobox? A version check to see if podman is > 5.3.1? Othersize size is undefined.

personally I don't like version checks, it is error prone and it won't work if we backport the feature to older releases.

You could just run a simple container with that option and see if it works podman run --rm --userns=keep-id:size=1 $IMG /bin/true, or if it fails with Error: unknown option specified: "size"

even better if you specify the correct size you plan to use, so the image is copied and chowned only once

Okay, thanks for the advice. I guess follow-up question is whether this will cause each container to have a different set of UIDs if I've never run --userns=auto before? It's a bit confusing how these interact.

Okay, thanks for the advice. I guess follow-up question is whether this will cause each container to have a different set of UIDs if I've never run --userns=auto before? It's a bit confusing how these interact.

keep-id will keep using a static mapping, the size argument just makes sure it won't use all the available IDs, so that some of them can be used for auto containers

Good news: I have tested this with a modified distrobox and it works well! I can now run my userns=auto containers AND userns=keep-id:size=65536 distroboxes on my machine.

Bad news: I started looking at how to use this in distrobox. I can't guarantee 'podman run --rm --userns=keep-id:size=65336 $IMG /bin/true' will work as I can't guarantee the image will have /bin/true or really any specific binary. Would it be safe to take exit code 127 as success in this case?

My current code looks like this:

			# Add :size=65536 if possible
			if podman run --rm --userns=keep-id:size=65536 ${container_image} /bin/true 2>/dev/null || [ "$?" -eq 127 ] ; then
				result_command="${result_command}:size=65536"
			fi

Edit: This works perfectly fine, but it seems a little non-ideal.

would be enough to just create the container without running it? podman create instead of podman run