rootless

func BecomeRootInUserNS ¶

func BecomeRootInUserNS(pausePid string) (bool, int, error)

BecomeRootInUserNS re-exec podman in a new userNS. It returns whether podman was re-executed into a new user namespace and the return code from the re-executed podman process. If podman was re-executed the caller needs to propagate the error code returned by the child process.

func ConfigurationMatches ¶

func ConfigurationMatches() (bool, error)

ConfigurationMatches checks whether the additional uids/gids configured for the user match the current user namespace.

func GetConfiguredMappings ¶

func GetConfiguredMappings() ([]idtools.IDMap, []idtools.IDMap, error)

GetConfiguredMappings returns the additional IDs configured for the current user.

func GetRootlessGID ¶

func GetRootlessGID() int

GetRootlessGID returns the GID of the user in the parent userNS

func GetRootlessUID ¶

func GetRootlessUID() int

GetRootlessUID returns the UID of the user in the parent userNS

func IsRootless ¶

func IsRootless() bool

IsRootless tells us if we are running in rootless mode

func ReadMappingsProc ¶

func ReadMappingsProc(path string) ([]idtools.IDMap, error)

func TryJoinFromFilePaths ¶

func TryJoinFromFilePaths(pausePidPath string, needNewNamespace bool, paths []string) (bool, int, error)

TryJoinFromFilePaths attempts to join the namespaces of the pid files in paths. This is useful when there are already running containers and we don't have a pause process yet. We can use the paths to the conmon processes to attempt joining their namespaces. If needNewNamespace is set, the file is read from a temporary user namespace, this is useful for containers that are running with a different uidmap and the unprivileged user has no way to read the file owned by the root in the container.

func TryJoinPauseProcess ¶

func TryJoinPauseProcess(pausePidPath string) (bool, int, error)