podman: drop checking valid rootless UID

[giuseppe]

do not check whether the specified ID is valid in the user namespace.

crun handles this case[1], so the check in Podman prevents to get to
the OCI runtime at all.

$ podman run --user 10:0 --uidmap 0:0:1 --rm -ti fedora:33 sh -c 'id; cat /proc/self/uid_map'
uid=10(10) gid=0(root) groups=0(root),65534(nobody)
10 0 1

[1] containers/crun#556

Signed-off-by: Giuseppe Scrivano [email protected]

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: giuseppe

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [giuseppe]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[giuseppe]

/hold

let's hold it at least until containers/crun#556 is merged

[rhatdan]

What happens if you use runc?

[rhatdan]

crun is merged, this LGTM, but am concerned abour runc, do we need documentation on this feature only being available to crun?

[giuseppe]

What happens if you use runc?

you'll get an error from runc, similarly to what happens with older versions of crun. I think the error is quite clear that we don't need to catch it earlier:

Error: OCI runtime error: time="2020-12-11T16:20:14+01:00" level=error msg="container_linux.go:367: starting container process caused: setup user: cannot set uid to unmapped user in user namespace"

[rhatdan]

Great.

[umohnani8]

LGTM

[rhatdan]

/lgtm

[rhatdan]

/hold cancel