erabo/spiegel_podman
1
0
Fork 0
mirror of https://github.com/podman-container-tools/podman.git synced 2026-09-13 19:17:52 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
spiegel_podman/docs/source/markdown/options/userns.pod.md
Ed Santiago c9c2f644da markdown-preprocess: cross-reference where opts are used 
In each options/foo.md, keep a list of where the option is used.
This will be valuable to anyone making future edits, and to
those reviewing those edits.

This may be a controversial commit, because those crossref lists
are autogenerated as a side effect of the script that reads them.
It definitely violates POLA. And one day, some kind person will
reconcile (e.g.) --label, using it in more man pages, and maybe
forget to git-commit the rewritten file, and CI will fail.

I think this is a tough tradeoff, but worth doing. Without this,
it's much too easy for someone to change an option file in a way
that renders it inapplicable/misleading for some podman commands.

Signed-off-by: Ed Santiago <santiago@redhat.com>
2022-10-20 10:57:51 -06:00

1.9 KiB
Raw Blame History

####> This option file is used in: ####> podman pod clone, pod create ####> If you edit this file, make sure your changes ####> are applicable to all of those.

--userns=mode

Set the user namespace mode for all the containers in a pod. It defaults to the PODMAN_USERNS environment variable. An empty value ("") means user namespaces are disabled.

Rootless user --userns=Key mappings:

Key Host User Container User
"" $UID 0 (Default User account mapped to root user in container.)
keep-id $UID $UID (Map user account to same UID within container.)
auto $UID nil (Host User UID is not mapped into container.)
nomap $UID nil (Host User UID is not mapped into container.)

Valid mode values are:

  • auto[:OPTIONS,...]: automatically create a namespace. It is possible to specify these options to auto:

  • gidmapping=CONTAINER_GID:HOST_GID:SIZE to force a GID mapping to be present in the user namespace.

  • size=SIZE: to specify an explicit size for the automatic user namespace. e.g. --userns=auto:size=8192. If size is not specified, auto will estimate a size for the user namespace.

  • uidmapping=CONTAINER_UID:HOST_UID:SIZE to force a UID mapping to be present in the user namespace.

  • host: run in the user namespace of the caller. The processes running in the container will have the same privileges on the host as any other process launched by the calling user (default).

  • keep-id: creates a user namespace where the current rootless user's UID:GID are mapped to the same values in the container. This option is not allowed for containers created by the root user.

  • nomap: creates a user namespace where the current rootless user's UID:GID are not mapped into the container. This option is not allowed for containers created by the root user.