Comments (12)
The behavior from runc:
$ runc run config.json
ERRO[0000] User namespaces enabled, but no uid mappings found.
User namespaces enabled, but no uid mappings found.
the runc error message is different than crun. runc is complaining about no mapping being present in the config.json
file. Instead crun behaves differently and it automatically tries to configure a user namespace for rootless containers (just today I've documented it: https://github.com/containers/crun/blob/master/crun.1.md#automatically-create-user-namespace).
Just to confirm it, is there any uidMapping specified in the config.json
you've provided to runc?
from crun.
I am using the stock config.json provided from "crun spec --rootless" extended with the "user" namespace to avoid the warning from "automatically-create-user-namespace". There is no uidMapping in config.json.
from crun.
thanks, so I confirm that error message in runc refers to the lack of uidMappings in the config.json
file.
from crun.
I will submit a PR for crun to report "rootless requires the user defined in /etc/subuid and /etc/subgid" when they are missing.
from crun.
Well crun will run fine without those entries.
from crun.
Please note that crun did not run fine on my system. Without those files, I got:
2019-11-08T13:14:26.000942292Z: mount 'devpts' to '/home/jpinto/tmp/rootfs/dev/pts': Invalid argument
from crun.
I'm also getting this
$ crun spec --rootless
$ crun --root /tmp/crun run mycontainerid
mount 'devpts' to '/home/somedude/mycontainer/rootfs/dev/pts': Invalid argument
Even after reading the documentation and the comments here it's still a bit hard to understand what this means and how it can be addressed. Can the documentation be slightly extended, or the error message more informative as suggested above?
crun --version
crun version 0.11.42-937e
commit: 937e642f846af78d8be0054d6a1c4626a42f1040
spec: 1.0.0
+SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +YAJL
Kernel: 5.4.6-arch3-1 (Arch Linux)
$ zcat /proc/config.gz | grep CONFIG_USER_NS=
CONFIG_USER_NS=y
$ cat /proc/sys/kernel/unprivileged_userns_clone
1
I guess these are needed, as they are for runc?
from crun.
the safest is probably to drop gid=5
when creating the configuration for a rootless user, so it works also when there are no multiple IDs available.
Would you like to open a PR to address it?
from crun.
Sure, one moment.
from crun.
the safest is probably to drop
gid=5
when creating the configuration for a rootless user, so it works also when there are no multiple IDs available.
I just came across this issue because I try to run a program in a rootless container that checks for devpts to be mounted with gid=5. 🙃
Shouldn't this only be dropped in case if there really are not multiple IDs available so it still resembles a regular system as close as possible?
from crun.
Shouldn't this only be dropped in case if there really are not multiple IDs available so it still resembles a regular system as close as possible?
are you referring to the config.json file generated by crun spec
? That file should be intended only as a template you can use to customize, it is definitely the crun caller (which in most cases is a container engine like Podman or Docker) to create the correct configuration. If you have multiple IDs available, you can skip the --rootless
flag :) I think the default config file works well for rootless users, just make sure to add a user namespace. If no mappings are specified, crun will assign the additional IDs specified for your user.
from crun.
Ah ok, then it is podman where I have to look at. Thanks for the explanations.
from crun.
Related Issues (20)
- what is the purpose and future of crun-wasm - asking for (a friend) Debian packaging :) ? HOT 5
- Different CRUN/RUNC cgroup hierarchy HOT 6
- weird seccomp caching bug, causes bud-runtime-flag test to flake HOT 4
- The flag `O_PATH` could be added in more places HOT 1
- Pod cannot be deleted due to missing container startup command when using crun HOT 8
- Cannot run any container if storage location is owned by a group that is not the users main group (rootless mode) HOT 5
- OCI runtime create failed: unknown version specified: unknown. HOT 2
- Systemd not supported on crun - s390x HOT 14
- Support for wasm-micro-runtime handler HOT 1
- Why fork the current process on create when libcrun_container_create() is called by python process? HOT 5
- can't see poststart running. HOT 1
- [Feature] Setup parent mount before pivot_root if on initramfs HOT 2
- read from the init process HOT 1
- Inconsistent Error Reporting: runc vs crun for Stopped Containers HOT 1
- [packit] Propose downstream failed for release 1.16 HOT 1
- crun 1.16: critest "[k8s.io] Container Mount Propagation runtime should support mount propagation [It] mount with 'rshared' should support propagation from host to container and vice versa" fails HOT 9
- Exec does not inherit values from the `config.json` HOT 3
- [packit] Propose downstream failed for release 1.16.1 HOT 1
- crun does not wait for tty to receive error message for short lived process HOT 1
- Feature: enhanced debug logging HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from crun.