feat(driver-podman): add per-sandbox user namespace mode#2141
Conversation
Add a `userns_mode` field to `PodmanSandboxDriverConfig` so each sandbox can independently select its user namespace mode via `--driver-config-json`. Accepts the same values as `podman run --userns`, e.g. "keep-id", "keep-id:uid=200,gid=210", "auto", "nomap", or "host". Empty (default) leaves Podman's default behavior unchanged. The `build_userns` helper reads from the per-sandbox driver config and parses the string into a libpod `Namespace` object, splitting on the first colon: the left side becomes `nsmode` and the right side becomes `value`. When unset or whitespace-only, the `userns` field is omitted from the container spec JSON so Podman uses its default (host namespace). Includes unit tests covering all parsing paths, whitespace trimming, and coexistence with mounts in driver config. Updates the driver README with usage examples. Signed-off-by: Florian Bergmann <bergmann.f@gmail.com>
bergmannf
requested review from
a team,
derekwaynecarr,
maxamillion and
mrunalp
as code owners
|
Should not be needed once #1959 is implemented. |
There was a problem hiding this comment.
Thanks for the contribution. I found two points I would like feedback on before approval:
-
[P1] Published docs place
userns_modein an unsupported gateway configuration block.docs/reference/gateway-config.mdx:283-286anddocs/reference/sandbox-compute-drivers.mdx:182-186tell users to setuserns_modeunder[openshell.drivers.podman]. The implementation adds it only to per-sandboxPodmanSandboxDriverConfig, whilePodmanComputeConfigusesdeny_unknown_fields. Uncommenting the documented TOML example should therefore fail gateway configuration parsing. Should these sections instead document the per-sandbox--driver-config-jsonform shown in the README? -
[P2] The UID mapping explanation appears reversed.
crates/openshell-driver-podman/src/container.rs:205-208sayskeep-id:uid=200,gid=210maps container UID 0 to host UID 200. Podman documents this as mapping the host user running Podman to UID 200/GID 210 inside the container. The serialization code looks correct, but the comment could cause future mount-permission or security misunderstandings.
Validation performed locally: cargo test -p openshell-driver-podman passed all 115 tests, including all 10 new userns-focused tests.
2 participants
Summary
Add support for selecting a per-sandbox Podman user namespace mode through driver config.
This feature is required if SELinux is active, but the user ID inside the sandbox container is not the same as the user ID of the user creating it. In that case reading a SELinux shared mount is possible, but writing is not, unless the keep-id map is supplied with the correct values inside the sandbox (e.g. in the default image it must use:
'{"podman":{"userns_mode": "keep-id:uid=998,gid=998"}})Related Issue
None
Changes
userns_modeto Podman sandbox driver config--userns-style values into the libpod namespace specTesting
mise run pre-commitpassesChecklist