Ensure single UID is used inside containers #69
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
henriquesimoes
commented
Jul 29, 2024
henriquesimoes
force-pushed
the
single-uid
branch
from
6ec1dbe
to
2264890
Compare
henriquesimoes
force-pushed
the
single-uid
branch
from
2264890
to
af58003
Compare
ericonr
reviewed
Aug 23, 2024
henriquesimoes
force-pushed
the
single-uid
branch
2 times, most recently
from
33fffe0
to
2d3636d
Compare
ericonr
approved these changes
Aug 27, 2024
APT uses a _apt user by default for handling its files in the filesystem. When subuid and subgid are not set, most APT command will fail, since setgroups, setegid and seteuid syscalls will not succeed. Disable APT sandbox as it is not strictly required inside containers.
IOC containers do not require multiple users, and thus they are commonly deployed without subuid and subgid to avoid creating files in volumes mapped to the host filesystem with a uid/gid not possible to be handled by its user outside the namespace. However, this breaks APT default configuration due to its sandbox user `_apt`. Disable its sandbox so that we can use APT in such deployment environments.
henriquesimoes
force-pushed
the
single-uid
branch
from
2d3636d
to
fa37769
Compare
ericonr
approved these changes
Aug 27, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
APT is one of the applications that assume multiple effective UIDs exist, so that it can sandbox itself. When running with
ignore_chown_errorsoption enabled (see podman(1)), this will lead tosetgroups,seteuidandsetguidsyscalls to fail, breaking most ofaptcommands.Ensure that a single UID is used inside the containers, both at base build image (without
/etc/set{u,g}idsettings) and IOC runtime, especially allowing one to properly use apt.