rootless

package
v2.2.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Dec 7, 2020 License: Apache-2.0 Imports: 20 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func BecomeRootInUserNS

func BecomeRootInUserNS(pausePid string) (bool, int, error)

BecomeRootInUserNS re-exec podman in a new userNS. It returns whether podman was re-executed into a new user namespace and the return code from the re-executed podman process. If podman was re-executed the caller needs to propagate the error code returned by the child process.

func ConfigurationMatches

func ConfigurationMatches() (bool, error)

ConfigurationMatches checks whether the additional uids/gids configured for the user match the current user namespace.

func GetAvailableGids added in v2.2.0

func GetAvailableGids() (int64, error)

GetAvailableGids returns how many GIDs are available in the current user namespace.

func GetConfiguredMappings

func GetConfiguredMappings() ([]idtools.IDMap, []idtools.IDMap, error)

GetConfiguredMappings returns the additional IDs configured for the current user.

func GetRootlessGID

func GetRootlessGID() int

GetRootlessGID returns the GID of the user in the parent userNS

func GetRootlessUID

func GetRootlessUID() int

GetRootlessUID returns the UID of the user in the parent userNS

func IsFdInherited

func IsFdInherited(fd int) bool

IsFdInherited checks whether the fd is opened and valid to use

func IsRootless

func IsRootless() bool

IsRootless tells us if we are running in rootless mode

func ReadMappingsProc

func ReadMappingsProc(path string) ([]idtools.IDMap, error)

ReadMappingsProc parses and returns the ID mappings at the specified path.

func TryJoinFromFilePaths

func TryJoinFromFilePaths(pausePidPath string, needNewNamespace bool, paths []string) (bool, int, error)

TryJoinFromFilePaths attempts to join the namespaces of the pid files in paths. This is useful when there are already running containers and we don't have a pause process yet. We can use the paths to the conmon processes to attempt joining their namespaces. If needNewNamespace is set, the file is read from a temporary user namespace, this is useful for containers that are running with a different uidmap and the unprivileged user has no way to read the file owned by the root in the container.

func TryJoinPauseProcess

func TryJoinPauseProcess(pausePidPath string) (bool, int, error)

TryJoinPauseProcess attempts to join the namespaces of the pause PID via TryJoinFromFilePaths. If joining fails, it attempts to delete the specified file.

Types

This section is empty.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL