[FEATURE REQUEST]: --userns=auto for build

[lukasmrtvy]

Description

Would be great to have a feature parity with podman run and implement support for --userns=auto flag for buildah. Thanks

[flouthoc]

@lukasmrtvy Thanks for creating the issue. I'll take a look at this. It would we nice if RFE also contains a small gist about the actual use-case which you are trying with build containers by running in unique user ns.

[lukasmrtvy]

Use case:

• building and running third-party content on a single machine ( without any additional isolation/abstraction ), typically it can be a workflow scheduler/executor that runs arbitrary code from multiple users

Workaround:

• running buildah in podman like podman run --userns=auto --isolation=chroot ... can probably do the trick but it could be a complex task to solve, as it involves exporting and reusing tar artifact

Does it make sense?

Thanks

[flouthoc]

@lukasmrtvy Sure thanks for sharing and makes sense to me :)

[lukasmrtvy]

I am trying this implementation in Podman 4.2.0. Seems its working via CLI, but API call does not work.

Dockerfile

cat << EOF > Dockerfile
FROM alpine
RUN cat /proc/self/uid_map
EOF

Works correctly via CLI

podman build -t test --userns=auto .

Does not work via API

tar -czf context.tar.gz Dockerfile
curl -s --unix-socket /run/podman/podman.sock -X POST  -H "Content-Type:application/tar"  --data-binary "@context.tar.gz"   'http://d/v4.2.0/libpod/build?userns=auto'

[flouthoc]

@lukasmrtvy ackd.

[flouthoc]

This is a bug i think happening because IDMappingOptions ( https://github.com/containers/buildah/blob/main/define/build.go#L220 ) is not wired to API end , so this must be implemented at bindings end and must be processed and supplied to API end here https://github.com/containers/podman/blob/main/pkg/api/handlers/compat/images_build.go#L603

I'm assigning this issue to my self.