3 ms·
Inside of a container (with user namespacing enabled), you won't have the full 32-bit range, and this must all work inside of containers; I'm not sure about oth
by LukeShu 8y ago
Inside of a container (with user namespacing enabled), you won't have the full 32-bit range, and this must all work inside of containers; I'm not sure about other container managers off the top of my head, but systemd-npawn only gives containers a 16-bit subrange.
- cryptonector 8y agoThe container UID namespaces should be the same size, damnit. (That is how it is in Solaris/Illumos zones...)
- LukeShu 8y agoLinux user namespaces work as a 1-to-1 mapping of UIDs. Every UID in the container has to map to a UID on the host, so the UID range of the container is necessarily smaller than the UID range of the host (unless of course the map is the identity, but then what's the point of having a separate namespace?). Maybe that is bad design, but if it is: it's Linux's fault, not systemd's.