Systemd lightweight containers [LWN.net]

Systemd lightweight containers

Posted Feb 7, 2013 21:55 UTC (Thu) by mezcalero (subscriber, #45103)
In reply to: Systemd lightweight containers by nybble41
Parent article: Systemd lightweight containers

So, you boot your OS in your container, and it uses like a 50 different UIDs, because it runs various daemons unprivileged. And all these shall map to the same UID 1000 on the host, and the file system. Which component then knows how the files on disk map to those 50 different UIDs? How would that ever work?

to post comments

Systemd lightweight containers

Posted Feb 7, 2013 22:20 UTC (Thu) by nybble41 (subscriber, #55106) [Link]

You make a good point. I think that you would need to map multiple container UIDs to multiple UIDs on the host if you want a filesystem mounted outside the container to keep them separate. IIRC the UID namespace code allows each container UID to map to a different host UID.

Mapping from container to host is always well-defined, but I'm not sure what the kernel does when the reverse translation is one-to-many. Most likely it just picks the first match, so all UID 1000 files would appear to be owned by root. (However, the permissions check should be performed using UID 1000 on the host side, in the filesystem's namespace, regardless of what the processes inside the container see.)

Systemd lightweight containers

Posted Feb 7, 2013 23:33 UTC (Thu) by zuki (subscriber, #41808) [Link]

Eric Biederman has a helper library which reserves a range of UIDs on the host and let's users use them (http://thread.gmane.org/gmane.linux.kernel.containers/25062). Afaicu, it is up to the user which UID means what.