Option to use UIDs only once

[mbien]

Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)

/kind feature

Description

Currently users of the same UID are always mapped to the same user on the host. User foo (UID 5) of imageA would be the same user as user bar (UID 5) of imageB. Since UIDs are given out sequentially, its fairly common that two arbitrary images would end up with users with the same ID.

When using bind mounts it might be desirable to chown the folders to unique UIDs (before starting the container), so that namespace separation can be maintained on the filesystem level too.

Podman could help to keep track of UIDs used in running containers and (optionally) make sure that every ID is only used once . Analog to the way how PIDs on the host work basically.

[vrothberg]

@rhatdan PTAL

[vrothberg]

To the best of my knowledge, we don't have a way to do that yet. A challenge is to keep track of which IDs are used where and when.

[mbien]

to give more context: i am currently doing something like this before starting the container:

UID_INSIDE=$(podman run --name UID_probe --rm foo-image /usr/bin/id -u)
podman unshare chown -R $UID_INSIDE volumes

podman run --pod foo-pod --name foo\
 --rm\
 -v $VOLUMES/data:$CONTAINER/data\
 foo-image

[rhatdan]

So you would like something like

podman run --pod foo-pod --name foo\
 --rm\
 -v $VOLUMES/data:$CONTAINER/data:UID=$UID_INSIDE\
 foo-image

Where the volume would get chowned to match the UID_inside mapped to the user namespace, Similar to what we do with :Z and :z?

[mbien]

So you would like something like

podman run --pod foo-pod --name foo\
 --rm\
 -v $VOLUMES/data:$CONTAINER/data:UID=$UID_INSIDE\
 foo-image

Where the volume would get chowned to match the UID_inside mapped to the user namespace, Similar to what we do with :Z and :z?

This would be convenient since it eliminates the first step (or parts of it, since i would still have to query the UID_INSIDE somehow first).

However, the reason for this feature request is the fact that many containers (of arbitrary images) will end up having the same UID_INSIDE, which would not separate the namespace on the filesystem level if bind-mounts are used, unless podman learns to give out mapped UIDs only once somehow.

[rhatdan]

But I am not even sure that this is what people want. They might have volumes that they want to share between containers and want the UIDs to be the same. I don't see a way for podman to necessarily know the UID of the container unless it is specified in the image. IE default for the container.

podman run --pod foo-pod --name foo\
 --rm\
 -v $VOLUMES/data:$CONTAINER/data:U\
 foo-image

We have thought about chowning based on the UID of the volume. In this case if the container ran as the apache user then podman with chown the volume to match the appache User Based on the user namespace that you assigned.

I think we could get you partially what you want with a feature like this and then --userns=auto feature. Then each container would be run in a different user namespace. and would have different owners of the volume.

[mbien]

But I am not even sure that this is what people want. They might have volumes that they want to share between containers and want the UIDs to be the same. I don't see a way for podman to necessarily know the UID of the container unless it is specified in the image. IE default for the container.

podman run --pod foo-pod --name foo\
 --rm\
 -v $VOLUMES/data:$CONTAINER/data:U\
 foo-image

We have thought about chowning based on the UID of the volume. In this case if the container ran as the apache user then podman with chown the volume to match the appache User Based on the user namespace that you assigned.

you mean podman would look at the volume folder ownership on the inside and chown the folder on the outside so that it matches to the reverse-mapped user? Sounds super useful. +1

I think we could get you partially what you want with a feature like this and then --userns=auto feature. Then each container would be run in a different user namespace. and would have different owners of the volume.

If i understand that correctly its pretty much exactly what i want :) Reminds me a little bit on systemd's DynamicUser=yes

The :U addition combined with --userns=auto would also allow me to start the container with a single podman command as a bonus.

[rhatdan]

Interested in opening a PR?

[mbien]

who? me? I am only here to ask nicely :)

I am fairly new to podman and asked on the IRC channel if something like this would be possible with podman when @vrothberg suggested to me to open this issue.

[rhatdan]

Sure we always ask.

We are looking for people to fix code, maybe someone else will grab this. Or we will get a core maintainer on it.

[EduardoVega]

@rhatdan I would like to help on this one.

[TomSweeneyRedHat]

@EduardoVega Thanks for volunteering! I've just assigned the issue to you and have added the "In Progress" label to the issue.

[rhatdan]

@EduardoVega Any progress on this?

[EduardoVega]

@rhatdan Hi. I should be able to send something today/tomorrow.

[github-actions]

A friendly reminder that this issue had no activity for 30 days.

[rhatdan]

This is still being worked on in buildah,

[github-actions]

A friendly reminder that this issue had no activity for 30 days.

[rhatdan]

Merged into Buildah, now being worked on in Podman.

[github-actions]

A friendly reminder that this issue had no activity for 30 days.

[rhatdan]

@EduardoVega Can you start working on getting the "U" into podman?

[EduardoVega]

@rhatdan I already got all the required changes into this PR #8349.