Proof-of-concept: set up necessary idmappings for userns_mode=auto in Container.create() #499
+27
−0
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is a proof-of-concept commit to gather initial feedback.
This addresses the issue in #493, i.e., that passing
userns='auto'
to Container.create() results in the option being silently ignored.Before this patch,
podman-py
used to set up theuserns
API parameter when theuserns
parameter was given to Container.create(). However, upon investigation, it seems like the Podman service silently ignores the passeduserns
if parameteridmappings
is missing.This patch addresses this behaviour by setting up
idmappings
with neutral values (i.e., the values resulting in the same behaviour as the Podman client when called with --userns=auto without more specific options), while specifically retaining any explicit values passed by the user using the undocumented argumentidmappings
.I am looking for some feedback about this PR:
merge_dicts()
function? Or would it be better altogether to merge the relatively small structure manually and avoid adding that function altogether?podman-py
. In your view, what would be a good collection of integration tests for this PR/feature? At a minimum, I will be contributing one integration test which checks that passing theuserns='auto'
results in a container with a private user namespace, with IDs not overlapping with the initial namespace, as that is my use case