Add new --userns flag --userns=sync-id

[rhatdan]

Basically currently we default in rootless users UID to root user.
--userns=keep-id maps your UID outside of container to UID inside of container.
--userns=keep-id-app would map your UID to the default UID of the app run within the container.

Meaning

$ podman run --user=1234 --userns=sync-id fedora cat /proc/self/uid_map
         0          1           1233
      1234       0           1
      1235       1235     62269

IE On the host my UID 3267 ends up getting mapped to UID 1234 inside of the container.

The benefit of this is it would fix issues like

#15292

[rhatdan]

What do you think of --userns=sync-id?

[rhatdan]

I linked a use case on a MAC that we are hitting now, where a container wants to create files on a volume that do not match the UID of the user running Podman. It is failing since the :U is not allowed on a mac file system.
Similar issue would happen if you used an NFS directory mounted into a container from a rootless user. That ran with a non root user uid.

[mheon]

I suggested this a while back, but there has been a general lack of interest. No objection to adding it.

[rhatdan]

Well I guess I did not pay attention to you. :^(

[giuseppe]

it is not a complete solution but I've opened a PR to add the uid and gid options to keep-id: #15389

Solving the problem in a completely automatic way would require more steps.

We need to mount the container storage to parse the /etc/passwd for resolving --user directives, but we currently mount the storage after we know the namespace mappings. For supporting something like --userns=sync-id, we would need to mount the container image twice: first to parse the /etc/passwd file, then with the correct mappings we picked for the user namespace.