Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Create /etc/subuid and /etc/subguid ranges based on (uid+1) * 100_000 #8

Open
ermo opened this issue Jul 2, 2024 · 0 comments
Open

Comments

@ermo
Copy link
Contributor

ermo commented Jul 2, 2024

Currently, the existing qol-assist implementation will give all users on a system get the same subuid and subgid ranges:

$ cat /etc/subuid
ermo:1000000:65536
lfs:1000000:65536
root:1000000:65536

$ cat /etc/subgid
ermo:1000000:65536
lfs:1000000:65536
root:1000000:65536

According to this page, user name spaces create mapping tables that look like this:

Host UID UserNS UID
1000 0
1_000_000 1
1_000_001 2
... ...
1_065_535 65536

Note how Host UIDs with the above files would imply that both namespaces owned/started by ermo and lfs users would nessarily share Host UIDs and Host GIDs with the above mapping tables; i.e. UserNS UID 1 in containers would all be owned by Host UID 1_000_000 on the system.

IFF the above is the correct interpretation, THEN it might make sense to update the qol-assist logic to instead adopt the following logic for creating user:starting_host_uid:range triplets:

If we define starting_host_uid = (UID+1) * 100_000, (if we assume that ermo is UID/GID 1000, lfs is UID/GID 1004 and root is UID/GID = 1) then we get the following, automagically generated /etc/subuid and /etc/subgid file contents:

$ cat /etc/subuid
ermo:10010000:65536
lfs:10050000:65536
root:100000:65536

$ cat /etc/subgid
ermo:10010000:65536
lfs:10040000:65536
root:100000:65536
@ermo ermo changed the title Create /etc/subuid and /etc/subguid ranges based on uid * 100_000 Create /etc/subuid and /etc/subguid ranges based on (uid+1) * 100_000 Jul 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant