From d4144fcf7f9217d2a2dcec21202421d5fa9d4928 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Thu, 7 May 2026 15:15:28 +0900 Subject: container: optionally map uid/gid 0 as init Unfortunately required to work around flawed APIs like binfmt_misc. Signed-off-by: Ophestra --- container/container.go | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'container/container.go') diff --git a/container/container.go b/container/container.go index 4208a449..85e6596f 100644 --- a/container/container.go +++ b/container/container.go @@ -91,6 +91,9 @@ type ( // Time to wait for processes lingering after the initial process terminates. AdoptWaitDelay time.Duration + // Map uid/gid 0 in the init process. Requires [FstypeProc] attached to + // [fhs.Proc] in the container filesystem. + InitAsRoot bool // Mapped Uid in user namespace. Uid int // Mapped Gid in user namespace. @@ -286,6 +289,18 @@ func (p *Container) Start() error { if !p.HostNet { p.cmd.SysProcAttr.Cloneflags |= CLONE_NEWNET } + if p.InitAsRoot { + p.cmd.SysProcAttr.AmbientCaps = append(p.cmd.SysProcAttr.AmbientCaps, + // mappings during init as root + CAP_SETFCAP, + ) + + if !p.SeccompDisable && + len(p.SeccompRules) == 0 && + p.SeccompPresets&std.PresetDenyNS != 0 { + return errors.New("container: as root requires late namespace creation") + } + } // place setup pipe before user supplied extra files, this is later restored by init if r, w, err := os.Pipe(); err != nil { -- cgit v1.3.1