Allow appending shared namespace to pod (something like --share +pid)

[markkrj]

Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)

/kind feature

Description

Add option to allow appending shared namespace to pod

Steps to reproduce the issue:

1. podman pod create --name test --share pid

2. podman pod inspect test --format '{{join .SharedNamespaces ","}}'

Describe the results you received:

pid

Describe the results you expected:

uts,pid,ipc,net

Additional information you deem important (e.g. issue happens only occasionally):

Output of podman version:

Client:       Podman Engine
Version:      4.0.0-dev
API Version:  4.0.0-dev
Go Version:   go1.17.8
Git Commit:   f4d6e8777213880204ccbce92201c47c74b33036-dirty
Built:        Fri Mar  4 12:26:16 2022
OS/Arch:      linux/amd64

Would something like this be acceptable?

diff --git a/cmd/podman/pods/create.go b/cmd/podman/pods/create.go
index ab3a6d578..28c61aae5 100644
--- a/cmd/podman/pods/create.go
+++ b/cmd/podman/pods/create.go
@@ -155,6 +155,9 @@ func create(cmd *cobra.Command, args []string) error {
                if strings.Contains(share, "cgroup") && shareParent {
                        return errors.Wrapf(define.ErrInvalidArg, "cannot define the pod as the cgroup parent at the same time as joining the infra container's cgroupNS")
                }
+               if strings.HasPrefix(share, "+") {
+                       share = strings.Join([]string{specgen.DefaultKernelNamespaces, strings.TrimPrefix(share, "+")}, ",")
+               }
                createOptions.Share = strings.Split(share, ",")
                createOptions.ShareParent = &shareParent
                if cmd.Flag("infra-command").Changed {

Or maybe add a new flag --add-share/--share-add

[markkrj]

@mheon if you think that patch is OK, I can open a PR for it (plus docs)...

[mheon]

Sure, looks fine

[Luap99]

Maybe also add support for -pid to remove a namespace from the default list.

[giuseppe]

would something like podman pod create --name test --share +pid,+uts work too?

[markkrj]

would something like podman pod create --name test --share +pid,+uts work too?

With my patch (above), or you are proposing such behavior?

With patch above, that would fail, as it would strip only leading '+' from --share... but --share +pid,uts would work, even though, uts is already in default shares, so it is not needed. Only namespaces missing from --share are cgroup and pid, but (IIUC) cgroup is inherited from pod, so only pid would be needed.

[giuseppe]

yes I was proposing something more generic

[github-actions]

A friendly reminder that this issue had no activity for 30 days.

[rhatdan]

@markkrj Did you continue to work on this. I think it is a good idea, are you going to open a PR?

[github-actions]

A friendly reminder that this issue had no activity for 30 days.