Separate SUBID range for auto user namespace mode

[kaivol]

Use case

I would like to run containers with auto and keep-id user namespace modes at the same time.
Currently, this is not possible, because "running a single container without using --userns=auto will use the entire range of UIDs".

Suggested solution

For this reason, I propose adding the possibility to reserve a part of the users SUBUID/SUBGID range for --userns=auto containers. If the corresponding option is configured,

• the SUBIDs for an auto container would be allocated from that range,
• and containers with other namespace modes would not use these SUBIDs.

---

Would something like that make sense, or am I missing a simple alternative?

[rhatdan]

@giuseppe WDYT?

[giuseppe]

I am against a global reservation as it will be too difficult to maintain for such a corner case.

But we could have a way to limit what IDs are usable with a user namespace, so you could do something like --userns=auto:min-uid=1000,max-uid=2000 and --userns=keep-id:min-id=0,max-id=2000.

Interested in opening a PR? :-)

[rhatdan]

I was thinking we could allow

--userns=auto:keep-id ...

Then the user namespace just gets wrapped around the users UID, so each container gets a separate user namespace which includes and defaults to the users UID.

[giuseppe]

that could be achieved with something like --user=$UID:$(id -g) --userns="auto:uidmapping=$UID:0:1,gidmapping=$(id -g):0:1"

[rhatdan]

@kaivol is this good enough for you?

[kaivol]

Yes, running all containers in auto mode should work for my current setup, not sure why I didn't think of that.

The only case that comes to mind in which this approach won't really work is if I want to use some of my SUBUIDs (other than my users ID) outside of a container (e.g., for bind mounts), as there is no way to make sure that the ID won't be accidentally used by the next userns=auto container.
For this scenario, an option as proposed by @giuseppe would be useful.
If I find time I will see if I can prepare a pull request.