erabo/spiegel_podman
1
0
Fork 0
mirror of https://github.com/podman-container-tools/podman.git synced 2026-09-24 08:37:55 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

pkg/specgen: allow pasta when running inside userns

Browse source 
pasta doesn't switch to nobody when we already run in a userns so we can
use it there. The unshare package checks the same condition and returns
true even if uid 0 in this case so we can directly call this.

ref https://github.com/containers/podman/issues/17840#issuecomment-2343251014

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This commit is contained in:
Paul Holzinger 2024-09-16 11:39:57 +02:00
parent 24c911841c
commit 91dbd6dc33
No known key found for this signature in database
GPG key ID: EB145DD938A3CAF2
1 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
pkg/specgen/namespaces.go
View file

@ -11,9 +11,9 @@ import (
"github.com/containers/common/pkg/cgroups"
"github.com/containers/podman/v5/libpod/define"
"github.com/containers/podman/v5/pkg/namespaces"
"github.com/containers/podman/v5/pkg/rootless"
"github.com/containers/podman/v5/pkg/util"
"github.com/containers/storage/pkg/fileutils"
"github.com/containers/storage/pkg/unshare"
storageTypes "github.com/containers/storage/types"
spec "github.com/opencontainers/runtime-spec/specs-go"
"github.com/opencontainers/runtime-tools/generate"
@ -160,10 +160,15 @@ func validateNetNS(n *Namespace) error {
case Slirp:
break
case Pasta:
if rootless.IsRootless() {
// Check if we run rootless/in a userns. Do not use rootless.IsRootless() here.
// Pasta switches to nobody when running as root which causes it to fail while
// opening the netns owned by root. However when pasta is already in a userns
// it doesn't switch to nobody so it works there.
// https://github.com/containers/podman/issues/17840
if unshare.IsRootless() {
break
}
return fmt.Errorf("pasta networking is only supported for rootless mode")
return fmt.Errorf("pasta networking is only supported for rootless mode or when inside a nested userns")
case "", Default, Host, Path, FromContainer, FromPod, Private, NoNetwork, Bridge:
break
default: