Systemd lightweight containers [LWN.net]

Systemd lightweight containers

Posted Feb 7, 2013 15:56 UTC (Thu) by nybble41 (subscriber, #55106)
In reply to: Systemd lightweight containers by mezcalero
Parent article: Systemd lightweight containers

> [UID namespace] support in file systems is really awkward (if you processes has multiple UIDs, but your file system only maintains one per file, how could that ever work?), so I kinda get the impression they create more problems than they solve.

I wouldn't expect that to be as difficult as you make it sound. The filesystem should see a single UID within its own namespace; if I mount a filesystem and then create a UID namespace mapping UID 0 to UID 1000, then a process with UID 0 inside the namespace and UID 1000 outside should appear to the filesystem as UID 1000. On the other hand, if I created the UID namespace first and then mounted the filesystem inside it, the filesystem should see UID 0, since the filesystem and the process are in the same UID namespace.

to post comments

Systemd lightweight containers

Posted Feb 7, 2013 21:55 UTC (Thu) by mezcalero (subscriber, #45103) [Link] (2 responses)

So, you boot your OS in your container, and it uses like a 50 different UIDs, because it runs various daemons unprivileged. And all these shall map to the same UID 1000 on the host, and the file system. Which component then knows how the files on disk map to those 50 different UIDs? How would that ever work?

Systemd lightweight containers

Posted Feb 7, 2013 22:20 UTC (Thu) by nybble41 (subscriber, #55106) [Link]

You make a good point. I think that you would need to map multiple container UIDs to multiple UIDs on the host if you want a filesystem mounted outside the container to keep them separate. IIRC the UID namespace code allows each container UID to map to a different host UID.

Mapping from container to host is always well-defined, but I'm not sure what the kernel does when the reverse translation is one-to-many. Most likely it just picks the first match, so all UID 1000 files would appear to be owned by root. (However, the permissions check should be performed using UID 1000 on the host side, in the filesystem's namespace, regardless of what the processes inside the container see.)

Systemd lightweight containers

Posted Feb 7, 2013 23:33 UTC (Thu) by zuki (subscriber, #41808) [Link]

Eric Biederman has a helper library which reserves a range of UIDs on the host and let's users use them (http://thread.gmane.org/gmane.linux.kernel.containers/25062). Afaicu, it is up to the user which UID means what.