namespaces: allow configuring keep-id userns size

[giuseppe]

Introduce a new option "size" to configure the maximum size of the user namespace configured by keep-id.

Closes: #24837

Now --userns=keep-id supports a new option `size` to configure the size of the user namespace

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: giuseppe

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [giuseppe]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[rhatdan]

LGTM

[Jookia]

How should this be integrated in to newer projects like distrobox? A version check to see if podman is > 5.3.1? Othersize size is undefined.

[Jookia]

I'm going to test this this weekend and try to integrate it in to distrobox to see if this works for my use case. I'll report back if it's a good solution for this problem.

[giuseppe]

How should this be integrated in to newer projects like distrobox? A version check to see if podman is > 5.3.1? Othersize size is undefined.

personally I don't like version checks, it is error prone and it won't work if we backport the feature to older releases.

You could just run a simple container with that option and see if it works podman run --rm --userns=keep-id:size=1 $IMG /bin/true, or if it fails with Error: unknown option specified: "size"

[giuseppe]

How should this be integrated in to newer projects like distrobox? A version check to see if podman is > 5.3.1? Othersize size is undefined.

personally I don't like version checks, it is error prone and it won't work if we backport the feature to older releases.

You could just run a simple container with that option and see if it works podman run --rm --userns=keep-id:size=1 $IMG /bin/true, or if it fails with Error: unknown option specified: "size"

even better if you specify the correct size you plan to use, so the image is copied and chowned only once

[Jookia]

Okay, thanks for the advice. I guess follow-up question is whether this will cause each container to have a different set of UIDs if I've never run --userns=auto before? It's a bit confusing how these interact.

[giuseppe]

Okay, thanks for the advice. I guess follow-up question is whether this will cause each container to have a different set of UIDs if I've never run --userns=auto before? It's a bit confusing how these interact.

keep-id will keep using a static mapping, the size argument just makes sure it won't use all the available IDs, so that some of them can be used for auto containers

[Jookia]

Good news: I have tested this with a modified distrobox and it works well! I can now run my userns=auto containers AND userns=keep-id:size=65536 distroboxes on my machine.

Bad news: I started looking at how to use this in distrobox. I can't guarantee 'podman run --rm --userns=keep-id:size=65336 $IMG /bin/true' will work as I can't guarantee the image will have /bin/true or really any specific binary. Would it be safe to take exit code 127 as success in this case?

My current code looks like this:

			# Add :size=65536 if possible
			if podman run --rm --userns=keep-id:size=65536 ${container_image} /bin/true 2>/dev/null || [ "$?" -eq 127 ] ; then
				result_command="${result_command}:size=65536"
			fi

Edit: This works perfectly fine, but it seems a little non-ideal.

[giuseppe]

would be enough to just create the container without running it? podman create instead of podman run

[Jookia]

Running this on a regular podman doesn't error: ``` podman create archlinux --userns=keep-id:size=65536 ``` Despite no size argument being implemented.

…

On Sat, Dec 21, 2024 at 11:06:00PM -0800, Giuseppe Scrivano wrote: would be enough to just create the container without running it? `podman create` instead of `podman run` -- Reply to this email directly or view it on GitHub: #24882 (comment) You are receiving this because you commented. Message ID: ***@***.***>