Skip to content

Omit --userns=keep-id for root#1018

Merged
chrmarti merged 2 commits into
mainfrom
chrmarti/1004
Jun 5, 2025
Merged

Omit --userns=keep-id for root#1018
chrmarti merged 2 commits into
mainfrom
chrmarti/1004

Conversation

@chrmarti
Copy link
Copy Markdown
Contributor

@chrmarti chrmarti commented Jun 5, 2025

Fixes #1004

@chrmarti chrmarti marked this pull request as ready for review June 5, 2025 12:06
@chrmarti chrmarti requested a review from a team as a code owner June 5, 2025 12:06
Comment thread src/test/container-features/configs/lockfile/.devcontainer.json
@chrmarti chrmarti merged commit 42bf1dc into main Jun 5, 2025
37 checks passed
@chrmarti chrmarti deleted the chrmarti/1004 branch June 5, 2025 13:11
im-0 added a commit to im-0/zed that referenced this pull request May 21, 2026
When `podman` is used and `remoteUser` is `root` (which usually is the case)
and user that runs `podman` is not `root` (which usually is the case)
following happens:

* `podman` creates new user inside the container with the same name and
  the same UID as user ouside of the container.
* Nothing inside the container actually uses this newly created user as
  `remoteUser` is set to `root`.
* `root` inside the container is idmapped
  to some random sub-UID outside of the container.
* All files created inside the container are owned by that bogus sub-UID
  outside.
* This breaks many tools (like git, for example) outside of the devcontainer.

Note that `--userns=keep-id` also overrides the effect of `USER` directive from
Dockerfile that was used to build the devcontainer image. Not sure that
this affects anything though...

This patch mirrors devcontainers/cli#1018 from
the reference implementation.

Also see devcontainers/cli#1004
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Addition of --userns=keep-id is a significant breaking change for many podman devcontainers.

2 participants