rootless: allow single ID mappings #2604
Conversation
openshift-ci-robot
added
the
approved
print an error if there is any failure pulling an image. Signed-off-by: Giuseppe Scrivano <[email protected]>
giuseppe
force-pushed
the
allow-single-mappings
branch
from
49018a3 to
3a1bc26
Compare
giuseppe
force-pushed
the
allow-single-mappings
branch
2 times, most recently
from
71bbfc8 to
360beae
Compare
| @@ -237,46 +220,15 @@ func BecomeRootInUserNS() (bool, int, error) { | |||
| return false, -1, errors.Errorf("cannot re-exec process") | |||
| } | |||
|
|
|||
| allowSingleIDMapping := os.Getenv("PODMAN_ALLOW_SINGLE_ID_MAPPING_IN_USERNS") != "" | |||
|
|
|||
| var uids, gids []idtools.IDMap | |||
| username := os.Getenv("USER") | |||
| if username == "" { | |||
| user, err := user.LookupId(fmt.Sprintf("%d", os.Getuid())) | |||
There was a problem hiding this comment.
I'm going back and forth so I'll throw it up for consideration. Any value to doing a logru.debugf here and after line 231 to show the error that was hit?
There was a problem hiding this comment.
that means the UID we are running with is not present in the users DB. I don't think it should matter, but I can add a Debugf if that can help
|
One question for cosideration, otherwise LGTM |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: giuseppe, jamescassell The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
we were playing safe and not allowed any container to have less than 65536 mappings. There are a couple of reasons to change it: - it blocked libpod to work in an environment where newuidmap/newgidmap are not available, or not configured. - not allowed to use different partitions of subuids, where each user has less than 65536 ids available. Hopefully this change in containers/storage: containers/storage#303 will make error clearers if there are not enough IDs for the image that is being used. Closes: containers#1651 Signed-off-by: Giuseppe Scrivano <[email protected]>
giuseppe
force-pushed
the
allow-single-mappings
branch
from
360beae to
af3e734
Compare
|
@jamescassell does the PR work for you? @TomSweeneyRedHat Pushed a new version with the Debugf statement |
|
LGTM |
|
/lgtm |
github-actions
bot
added
the
locked - please file new issue/PR
we were playing safe and not allowed any container to have less than 65536 mappings. There are a couple of reasons to change it:
it blocked libpod to work in an environment where newuidmap/newgidmap are not available, or not configured.
not allowed to use different partitions of subuids, where each user has less than 65536 ids available.
Hopefully this change in containers/storage:
containers/storage#303
will make error clearers if there are not enough IDs for the image that is being used.
Closes: #1651
Signed-off-by: Giuseppe Scrivano [email protected]