mirror of
https://github.com/podman-container-tools/podman.git
synced 2026-09-10 17:47:52 +00:00
c56c2fc5f8
Allow the `idmap` volume option to be combined with the overlay `O` option, e.g. `-v /src:/mnt:O,idmap` or `-v myvol:/mnt:O,idmap`. Previously any option other than `U`, `upperdir` and `workdir` combined with `O` was rejected. The parser in GenVolumeMounts now accepts `idmap` alongside `O` and rejects the first disallowed option instead of counting flags. The mappings from the container's user namespace are threaded onto the generated overlay mount so the runtime idmaps it. This is done for both the anonymous/host-path overlay volumes and the named-volume overlay path, which are handled by separate code. When a volume is idmapped the runtime shifts the mount so that on-disk IDs map identically into the container, so the overlay backing dirs (contentDir, upperdir, workdir) must be owned by real root (0) rather than the host IDs the container root maps to; otherwise they surface as the overflow ID inside the container and are inaccessible. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> |
||
|---|---|---|
| .. | ||
| generate | ||
| container_validate.go | ||
| namespaces.go | ||
| namespaces_test.go | ||
| pod_validate.go | ||
| podspecgen.go | ||
| resources_freebsd.go | ||
| resources_linux.go | ||
| specgen.go | ||
| specgen_local.go | ||
| specgen_remote.go | ||
| specgen_test.go | ||
| utils.go | ||
| utils_linux.go | ||
| volumes.go | ||
| volumes_linux_test.go | ||
| volumes_windows_test.go | ||
| winpath.go | ||
| winpath_linux.go | ||
| winpath_unsupported.go | ||
| winpath_windows.go | ||