Add user namespace support

[Random-Liu]

We should support node level user namespace after kubernetes/kubernetes#64005 is merged.

It shouldn't be hard for containerd given that all these happen on the client side, and there is already existing util function for per container user namespace remapping. https://github.com/containerd/containerd/blob/129167132c5e0dbd1b031badae201a432d1bd681/container_opts_unix.go#L149

[Random-Liu]

The kubernetes PR is punted to 1.12. Let's punt, too.

[mikebrow]

I saw.. :(

[shuyingliang]

Hello, we're currently evaluating to use containerd/crio, crio has host-level user namespaces ready, we're wondering the timeline or plan of cri-containerd can have any level of user namespaces support?

In addition, regarding user namespaces performance issue: the performance overhead of chowning is significant (1s v.s. N>=7 mins in our use case), any plan to improve user namespaces performance?

Given most organizations taking long time to upgrade kernel (>=4.19) to be able to use metacopy=on feature, to improve container security adoption, we are thinking about whether we can enable disable chowning or enable the option to what files/directories to skip to chown? This is feasible because files/directories in the image are world-readable, and users usually have the images built with permissions of 755 to be able to execute at runtime, there is really no need to mutate the image with shifting uid/gid when user namespaces is enabled, before shiftfs support in...

Any thoughts? Thanks for sharing!

[alban]

Hi! We (@alban @mauriciovasquezbernal @rata) are working on implementing user namespaces support in containerd/cri. At the moment, we have a working proof-of-concept based on Kubernetes 1.17 and containerd/cri 1.3 (kinvolk#1). Once ready and rebased on master, we can make a proper PR.

[mikebrow]

Hi! We (@alban @mauriciovasquezbernal @rata) are working on implementing user namespaces support in containerd/cri. At the moment, we have a working proof-of-concept based on Kubernetes 1.17 and containerd/cri 1.3 (kinvolk#1). Once ready and rebased on master, we can make a proper PR.

Excellent, interested to see your POC. If I remember right from the June 9 sig-node call.. Vince?? took the task to open a new kep to replace the now very old node level user namespace issue that was written pre-kep process.

[vbatts]

@mikebrow more-or-less I did 😸 . I was a conversation to see what the next step needed will be, and the answer was a KEP.

[alban]

Excellent, interested to see your POC

@mikebrow The links to the POC are the following:

• github.com/kinvolk/cri/pull/1
• github.com/kinvolk/kubernetes/pull/3