3 ms·
There are trade-offs to using userns and many ppl don't like the current set of trade-offs. In addition changing a default like this is a breaking change. Admin
by cpuguy83 9y ago
There are trade-offs to using userns and many ppl don't like the current set of trade-offs. In addition changing a default like this is a breaking change.
Admins can enable userns by default in a daemon, but making it a hard-coded default is much more difficult.
It's not just a matter of enabling user ns. There is no support at the vfs layer for uid/gid mapping. This means in order to use it, images must be chowned with the remapped ID's.
Per-container mappings are not supported for this reason (it would require copying and chowning the entire image for each container mapping).
Do you care to qualify your statement about CRI-O?
- ecnahc515 9y agoI recall seeing some patches submitted to make it possible to pass an uid/gid offset to the mount syscall at one point when people were implementing usernamespaces for container runtimes like docker. So is this fixable without having to make every file system implement this feature, or is there something else holding back better support for doing uid shifting for use with user namespaces?
- cpuguy83 9y agoThat has not been accepted into the kernel. It's called "shiftfs", which basically let's you perform the uid/gid shift on mount.