mirror of
https://github.com/podman-container-tools/podman.git
synced 2026-08-15 13:19:32 +00:00
84eff9ef3b
closes: #27411
Adjust SUB_UID and SUB_GID ranges to support running rootless Podman inside a rootless run Podman container.
Also add a test to verify the change and prevent regression.
By default, a new user is assigned the following sub-ID ranges:
SUB_UID_MIN=100000, SUB_GID_MIN=100000, SUB_UID_COUNT=65536, SUB_GID_COUNT=65536
This means the user’s sub-UID and sub-GID ranges are 100000–165535.
When the container is run rootless with the user defined below, ID mappings occur as follows:
- Container ID 0 (root) maps to user ID 1000 on the host (which is the user created below).
- Container IDs 1–65536 map to IDs 100000–165535 on host (the subid range previously mentioned).
If a new user is created inside this container (to build containers for example), it will
attempt to use the default sub-ID range (100000–165535). However, this exceeds the container’s
available ID mapping, since only IDs up to 65536 are mapped. This causes nested rootless Podman
to fail.
To enable container-in-container builds, the sub-ID ranges for the user must be large enough
to provide at least 65536 usable IDs. A minimum SUB_UID_COUNT and SUB_GID_COUNT of 165536 is
required, but 1,000,000 is used here to provide additional margin.
1,000,000 matches the subid range other machines are using, defined in [ignition.go](
|
||
|---|---|---|
| .. | ||
| annotations | ||
| api | ||
| auth | ||
| autoupdate | ||
| bindings | ||
| channel | ||
| checkpoint | ||
| copy | ||
| criu | ||
| ctime | ||
| domain | ||
| emulation | ||
| env | ||
| errorhandling | ||
| farm | ||
| fileserver | ||
| inspect | ||
| k8s.io | ||
| logiface | ||
| lookup | ||
| machine | ||
| namespaces | ||
| parallel | ||
| pidhandle | ||
| ps | ||
| rctl | ||
| rootless | ||
| seccomp | ||
| selinux | ||
| signal | ||
| specgen | ||
| specgenutil | ||
| specgenutilexternal | ||
| syncmap | ||
| systemd | ||
| terminal | ||
| trust | ||
| util | ||