Support multiple uid/gid mappings #10722

henry118 · 2024-09-24T22:00:55Z

This is a follow-up PR of the previous #10307 to support multiple id mappings for ID mapped mounts.

What's changed

Added 'WithUserNSRemapperLabels()' to take multiple uid/gid mappings
Updated 'ctr' to call the new func in case of '--remap-labels'
Updated built-in overlay SN to handle labels with multiple mappings. It's also updated to create mount options for multiple mappings, e.g. 'uidmap=0:666:1000,1000:6666:64536'
Updated 'GetUsernsFD()' to parse a string of multiple mappings

What's not changed

CRI code is not changed
- It still calls 'WithRemapperLabels()' which takes a single mapping entry
- I believe it's okay because kubelet currently only passes a single mapping entry to the runtime
- If required, CRI just needs to call 'WithUserNSRemapperLabels()' to handle multiple mappings

k8s-ci-robot · 2024-09-24T22:00:57Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

henry118 · 2024-10-21T18:01:29Z

@rata can you ptal?

rata

@henry118 sorry for the delay, I was with urgent bugfixes for runc/containerd and then got sick and I'm just looking at this.

Would it be possible to split it in more atomic commits, so it is simpler to review? A 800+ lines change in a single commit is not the most trivial thing to do :)

Also, did you look at adding an e2e test for this? Or should this already be covered by the previous PR?

client/snapshotter_opts_unix.go

henry118 · 2024-11-13T20:06:04Z

Hi @rata, sorry for the late update. I was busy with other stuff for the last week.

Would it be possible to split it in more atomic commits, so it is simpler to review? A 800+ lines change in a single commit is not the most trivial thing to do :)

Sure. I splitted the commit into multiple smaller ones. Hopefully it makes it easier to review :)

Also, did you look at adding an e2e test for this? Or should this already be covered by the previous PR?

I did update the integration test (see the last commit) to cover the multiple remapper label case. I didn't touch CRI test cases because I didn't update CRI to use this feature. I think CRI integration can be a follow up effort.

Please take another look at the changes. Thanks!

henry118 · 2024-12-02T17:53:16Z

Kindly ping @rata, also @fuweid @cpuguy83 @dmcgowan @AkihiroSuda if you can take a look as well. It would be great to have this in the 2.1 milestone. Thanks!

client/snapshotter_opts_unix.go

fuweid · 2024-12-03T21:08:06Z

integration/client/container_idmapped_linux_test.go

+		)
+		defer cancel()
+
+		if ok, err := overlayutils.SupportsIDMappedMounts(); err != nil || !ok {


please consider putting this checker at the beginning of the function

Will update this in the next revision.

fuweid

LGTM

core/mount/mount_idmapped_linux.go

integration/client/container_idmapped_linux_test.go

Signed-off-by: Henry Wang <henwang@amazon.com>

…ntries Signed-off-by: Henry Wang <henwang@amazon.com>

Signed-off-by: Henry Wang <henwang@amazon.com>

containerd 2.1.0 Welcome to the v2.1.0 release of containerd! The first minor release of containerd 2.x focuses on continued stability alongside new features and improvements. This is the first time-based released for containerd. Most the feature set and core functionality has long been stable and harderened in production environments, so now we transition to a balance of timely delivery of new functionality with the same high confidence in stability and performance. * Add no_sync option to boost boltDB performance on ephemeral environments ([containerd#10745](containerd#10745)) * Add content create event ([containerd#11006](containerd#11006)) * Erofs snapshotter and differ ([containerd#10705](containerd#10705)) * Update CRI to use transfer service for image pull by default ([containerd#8515](containerd#8515)) * Support multiple cni plugin bin dirs ([containerd#11311](containerd#11311)) * Support container restore through CRI/Kubernetes ([containerd#10365](containerd#10365)) * Add OCI/Image Volume Source support ([containerd#10579](containerd#10579)) * Enable Writable cgroups for unprivileged containers ([containerd#11131](containerd#11131)) * Fix recursive RLock() mutex acquisition ([containerd/go-cni#126](containerd/go-cni#126)) * Support CNI STATUS Verb ([containerd/go-cni#123](containerd/go-cni#123)) * Retry last registry host on 50x responses ([containerd#11484](containerd#11484)) * Multipart layer fetch ([containerd#10177](containerd#10177)) * Enable HTTP debug and trace for transfer based puller ([containerd#10762](containerd#10762)) * Add support for unpacking custom media types ([containerd#11744](containerd#11744)) * Add dial timeout field to hosts toml configuration ([containerd#11106](containerd#11106)) * Expose Pod assigned IPs to NRI plugins ([containerd#10921](containerd#10921)) * Support multiple uid/gid mappings ([containerd#10722](containerd#10722)) * Fix race between serve and immediate shutdown on the server ([containerd/ttrpc#175](containerd/ttrpc#175)) * Update FreeBSD defaults and re-organize platform defaults ([containerd#11017](containerd#11017)) * Postpone cri config deprecations to v2.2 ([containerd#11684](containerd#11684)) * Remove deprecated dynamic library plugins ([containerd#11683](containerd#11683)) * Remove the support for Schema 1 images ([containerd#11681](containerd#11681)) Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues. * Derek McGowan * Phil Estes * Akihiro Suda * Maksym Pavlenko * Jin Dong * Wei Fu * Sebastiaan van Stijn * Samuel Karp * Mike Brown * Adrien Delorme * Austin Vazquez * Akhil Mohan * Kazuyoshi Kato * Henry Wang * Gao Xiang * ningmingxiao * Krisztian Litkey * Yang Yang * Archit Kulkarni * Chris Henzie * Iceber Gu * Alexey Lunev * Antonio Ojea * Davanum Srinivas * Marat Radchenko * Michael Zappa * Paweł Gronowski * Rodrigo Campos * Alberto Garcia Hierro * Amit Barve * Andrey Smirnov * Divya * Etienne Champetier * Kirtana Ashok * Philip Laine * QiPing Wan * fengwei0328 * zounengren * Adrian Reber * Alfred Wingate * Amal Thundiyil * Athos Ribeiro * Brian Goff * Cesar Talledo * ChengyuZhu6 * Chongyi Zheng * Craig Ingram * Danny Canter * David Son * Fupan Li * HirazawaUi * Jing Xu * Jonathan A. Sternberg * Jose Fernandez * Kaita Nakamura * Kohei Tokunaga * Lei Liu * Marco Visin * Mike Baynton * Qiyuan Liang * Sameer * Shiming Zhang * Swagat Bora * Teresaliu * Tony Fang * Tõnis Tiigi * Vered Rosen * Vinayak Goyal * bo.jiang * chriskery * luchenhan * mahmut * zhaixiaojuan * **github.com/Microsoft/hcsshim** v0.12.9 -> v0.13.0-rc.3 * **github.com/cilium/ebpf** v0.11.0 -> v0.16.0 * **github.com/containerd/cgroups/v3** v3.0.3 -> v3.0.5 * **github.com/containerd/containerd/api** v1.8.0 -> v1.9.0 * **github.com/containerd/continuity** v0.4.4 -> v0.4.5 * **github.com/containerd/go-cni** v1.1.10 -> v1.1.12 * **github.com/containerd/imgcrypt/v2** v2.0.0-rc.1 -> v2.0.1 * **github.com/containerd/otelttrpc** ea5083fda723 -> v0.1.0 * **github.com/containerd/platforms** v1.0.0-rc.0 -> v1.0.0-rc.1 * **github.com/containerd/ttrpc** v1.2.6 -> v1.2.7 * **github.com/containerd/typeurl/v2** v2.2.2 -> v2.2.3 * **github.com/containernetworking/cni** v1.2.3 -> v1.3.0 * **github.com/containernetworking/plugins** v1.5.1 -> v1.7.1 * **github.com/containers/ocicrypt** v1.2.0 -> v1.2.1 * **github.com/davecgh/go-spew** d8f796af33cc -> v1.1.1 * **github.com/fsnotify/fsnotify** v1.7.0 -> v1.9.0 * **github.com/go-jose/go-jose/v4** v4.0.4 -> v4.0.5 * **github.com/google/go-cmp** v0.6.0 -> v0.7.0 * **github.com/grpc-ecosystem/grpc-gateway/v2** v2.22.0 -> v2.26.1 * **github.com/klauspost/compress** v1.17.11 -> v1.18.0 * **github.com/mdlayher/socket** v0.4.1 -> v0.5.1 * **github.com/moby/spdystream** v0.4.0 -> v0.5.0 * **github.com/moby/sys/user** v0.3.0 -> v0.4.0 * **github.com/opencontainers/image-spec** v1.1.0 -> v1.1.1 * **github.com/opencontainers/runtime-spec** v1.2.0 -> v1.2.1 * **github.com/opencontainers/selinux** v1.11.1 -> v1.12.0 * **github.com/pelletier/go-toml/v2** v2.2.3 -> v2.2.4 * **github.com/petermattis/goid** 4fcff4a6cae7 **_new_** * **github.com/pmezard/go-difflib** 5d4384ee4fb2 -> v1.0.0 * **github.com/prometheus/client_golang** v1.20.5 -> v1.22.0 * **github.com/prometheus/common** v0.55.0 -> v0.62.0 * **github.com/sasha-s/go-deadlock** v0.3.5 **_new_** * **github.com/smallstep/pkcs7** v0.1.1 **_new_** * **github.com/stretchr/testify** v1.9.0 -> v1.10.0 * **github.com/tchap/go-patricia/v2** v2.3.1 -> v2.3.2 * **github.com/urfave/cli/v2** v2.27.5 -> v2.27.6 * **github.com/vishvananda/netlink** v1.3.0 -> 0e7078ed04c8 * **github.com/vishvananda/netns** v0.0.4 -> v0.0.5 * **go.etcd.io/bbolt** v1.3.11 -> v1.4.0 * **go.opentelemetry.io/auto/sdk** v1.1.0 **_new_** * **go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc** v0.56.0 -> v0.60.0 * **go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp** v0.56.0 -> v0.60.0 * **go.opentelemetry.io/otel** v1.31.0 -> v1.35.0 * **go.opentelemetry.io/otel/exporters/otlp/otlptrace** v1.31.0 -> v1.35.0 * **go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc** v1.31.0 -> v1.35.0 * **go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp** v1.31.0 -> v1.35.0 * **go.opentelemetry.io/otel/metric** v1.31.0 -> v1.35.0 * **go.opentelemetry.io/otel/sdk** v1.31.0 -> v1.35.0 * **go.opentelemetry.io/otel/trace** v1.31.0 -> v1.35.0 * **go.opentelemetry.io/proto/otlp** v1.3.1 -> v1.5.0 * **golang.org/x/crypto** v0.28.0 -> v0.36.0 * **golang.org/x/exp** aacd6d4b4611 -> 2d47ceb2692f * **golang.org/x/mod** v0.21.0 -> v0.24.0 * **golang.org/x/net** v0.30.0 -> v0.38.0 * **golang.org/x/oauth2** v0.22.0 -> v0.27.0 * **golang.org/x/sync** v0.8.0 -> v0.14.0 * **golang.org/x/sys** v0.26.0 -> v0.33.0 * **golang.org/x/term** v0.25.0 -> v0.30.0 * **golang.org/x/text** v0.19.0 -> v0.23.0 * **golang.org/x/time** v0.3.0 -> v0.7.0 * **google.golang.org/genproto/googleapis/api** 5fefd90f89a9 -> 56aae31c358a * **google.golang.org/genproto/googleapis/rpc** 324edc3d5d38 -> 56aae31c358a * **google.golang.org/grpc** v1.67.1 -> v1.72.0 * **google.golang.org/protobuf** v1.35.1 -> v1.36.6 * **k8s.io/api** v0.31.2 -> v0.32.3 * **k8s.io/apimachinery** v0.31.2 -> v0.32.3 * **k8s.io/apiserver** v0.31.2 -> v0.32.3 * **k8s.io/client-go** v0.31.2 -> v0.32.3 * **k8s.io/cri-api** v0.31.2 -> v0.32.3 * **k8s.io/kubelet** v0.31.2 -> v0.32.3 * **k8s.io/utils** 18e509b52bc8 -> 3ea5e8cea738 * **sigs.k8s.io/json** bc3834ca7abd -> 9aa6b5e7a4b3 * **sigs.k8s.io/structured-merge-diff/v4** v4.4.1 -> v4.4.2 * **tags.cncf.io/container-device-interface** v0.8.0 -> v1.0.1 * **tags.cncf.io/container-device-interface/specs-go** v0.8.0 -> v1.0.0 Previous release can be found at [v2.0.0](https://github.com/containerd/containerd/releases/tag/v2.0.0) * `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04). * `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent. In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases) and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too. See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.

k8s-ci-robot added do-not-merge/work-in-progress size/XL labels Sep 24, 2024

henry118 force-pushed the uidmap2 branch 3 times, most recently from ed47d9f to 0287d9b Compare September 25, 2024 17:23

k8s-ci-robot added size/XXL and removed size/XL labels Sep 25, 2024

henry118 changed the title ~~[WIP] Support multiple uid/gid mappings [2/2]~~ Support multiple uid/gid mappings [2/2] Sep 25, 2024

henry118 marked this pull request as ready for review September 25, 2024 18:52

k8s-ci-robot removed the do-not-merge/work-in-progress label Sep 25, 2024

dosubot bot added the area/runtime Runtime label Sep 25, 2024

rata reviewed Nov 1, 2024

View reviewed changes

client/snapshotter_opts_unix.go Outdated Show resolved Hide resolved

henry118 force-pushed the uidmap2 branch 2 times, most recently from 323d07b to c9d8ef4 Compare November 13, 2024 19:58

estesp added this to the 2.1 milestone Nov 13, 2024

fuweid reviewed Dec 3, 2024

View reviewed changes

henry118 force-pushed the uidmap2 branch from c9d8ef4 to b3302d1 Compare December 6, 2024 22:57

henry118 mentioned this pull request Dec 6, 2024

Added conversion logic for multiple id mapping snasphotter labels containerd/fuse-overlayfs-snapshotter#109

Merged

fuweid approved these changes Dec 11, 2024

View reviewed changes

core/mount/mount_idmapped_linux.go Outdated Show resolved Hide resolved

integration/client/container_idmapped_linux_test.go Outdated Show resolved Hide resolved

henry118 added 6 commits December 11, 2024 17:53

Add RootPair() and serialization routines to userns idmap

a114059

Signed-off-by: Henry Wang <henwang@amazon.com>

Update idmapped mount to support multiple uid/gid mappings

168ec21

Signed-off-by: Henry Wang <henwang@amazon.com>

Update overlay snapshotter to support multiple uid/gid mappings

8a030d6

Signed-off-by: Henry Wang <henwang@amazon.com>

Update snapshotter opts to support multiple uid/gid mapping entries

8bbfb65

Signed-off-by: Henry Wang <henwang@amazon.com>

Update ctr to support remapper labels with multiple uid/gid mapping e…

ec231cd

…ntries Signed-off-by: Henry Wang <henwang@amazon.com>

Add multiple uid/gid mapping test cases to integration tests

ff0d99e

Signed-off-by: Henry Wang <henwang@amazon.com>

henry118 force-pushed the uidmap2 branch from b3302d1 to ff0d99e Compare December 11, 2024 18:05

kzys approved these changes Jan 14, 2025

View reviewed changes

estesp approved these changes Jan 17, 2025

View reviewed changes

estesp added this pull request to the merge queue Jan 17, 2025

Merged via the queue into containerd:main with commit 98af40b Jan 17, 2025
59 checks passed

henry118 deleted the uidmap2 branch January 17, 2025 20:09

dmcgowan changed the title ~~Support multiple uid/gid mappings [2/2]~~ Support multiple uid/gid mappings Mar 8, 2025

dmcgowan added the impact/changelog label Mar 8, 2025

dmcgowan mentioned this pull request Mar 8, 2025

Prepare release notes for v2.1.0-beta.0 #11510

Merged

dmcgowan mentioned this pull request Apr 23, 2025

Add release notes for v2.1.0-rc.0 #11752

Merged

dmcgowan mentioned this pull request May 7, 2025

Prepare release notes for v2.1.0 #11819

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Support multiple uid/gid mappings #10722

Support multiple uid/gid mappings #10722

Uh oh!

henry118 commented Sep 24, 2024 •

edited

Loading

Uh oh!

k8s-ci-robot commented Sep 24, 2024

Uh oh!

henry118 commented Oct 21, 2024

Uh oh!

rata left a comment

Uh oh!

Uh oh!

henry118 commented Nov 13, 2024

Uh oh!

henry118 commented Dec 2, 2024

Uh oh!

Uh oh!

Uh oh!

fuweid Dec 3, 2024

Uh oh!

henry118 Dec 4, 2024

Uh oh!

fuweid left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Support multiple uid/gid mappings #10722

Support multiple uid/gid mappings #10722

Uh oh!

Conversation

henry118 commented Sep 24, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What's changed

What's not changed

Uh oh!

k8s-ci-robot commented Sep 24, 2024

Uh oh!

henry118 commented Oct 21, 2024

Uh oh!

rata left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

henry118 commented Nov 13, 2024

Uh oh!

henry118 commented Dec 2, 2024

Uh oh!

Uh oh!

Uh oh!

fuweid Dec 3, 2024

Choose a reason for hiding this comment

Uh oh!

henry118 Dec 4, 2024

Choose a reason for hiding this comment

Uh oh!

fuweid left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

henry118 commented Sep 24, 2024 •

edited

Loading