feat(guest-agent): rootless 支援 chown/gosu image（/etc/subuid + newuidmap 委派）#84
Merged
Conversation
原生 Linux rootless 路徑新增 newuidmap/newgidmap 範圍映射（同 rootless podman）： host 有 uidmap 工具且使用者有 subuid/subgid 委派範圍時，unshare(NEWUSER) 後由 supervisor 經握手管線以 newuidmap 代寫「0 <uid> 1 + 容器 uid 1 起接上委派範圍」， chown/gosu 到服務專用 uid（官方 redis/postgres 的 999…）不再失敗；代寫路徑不寫 setgroups deny，gosu 的 setgroups 才可用。無委派或代寫失敗退回既有單一 uid 自寫 映射（不致命）。root 後端（WSL2/VM/native-root）行為完全不變。 兩個套用點：shared 模式的中繼行程（exec.rs）；internal/bridge 的 netns holder （netns.rs）——服務加入 holder user ns 自動繼承。 實測（WSL Ubuntu 非 root）：bridge/shared 模式容器內 chown 999 都成功；官方 redis:7.2-alpine 以非 root 起服務（host 側觀察到 redis-server 跑在 subuid 100998 = 容器 999）、宣告埠 PING→+PONG。新增 linux-e2e run_subid_e2e（bridge+ shared 各驗一次 chown，無委派環境自動跳過）與 CI 安裝 uidmap。
quick-xml <0.41 的 O(n^2) DoS 公告；self_update 上游也還在 0.38、無 >=0.41 可升。 該依賴只用於 self_update 的 S3/GCS XML backend，chefer upgrade 走 GitHub JSON backend 不觸發。附解除條件於 audit.toml 註解。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
摘要
Roadmap 項目「Rootless Linux support for chown/gosu images」。原生 Linux rootless 路徑（以非 root 使用者跑單檔）改用 newuidmap/newgidmap + /etc/subuid 委派做範圍 uid/gid 映射（同 rootless podman），官方 redis/postgres 這類 entrypoint 會
chown+gosu到專用 uid 的映像因此免 root 也能跑。無委派環境（無 uidmap 工具或無 subuid 範圍）自動退回既有單一 uid 映射，不致命；root 後端行為完全不變。設計
guest-agent/src/subid.rs：偵測（解析 /etc/subuid、/etc/subgid，PATH 找 newuidmap/newgidmap，process 級快取 + 一次性診斷訊息）＋ 套用（0 <uid> 1+ 容器 uid 1 起依序接上各委派範圍）＋ 握手協定（子行程 unshare(NEWUSER) 後通知，supervisor 代寫映射後回 verdict，失敗 fallback 自寫）。gosu的 setgroups 才可用。驗證
chown 999:999成功、exit 0、委派 banner 正確。redis:7.2-alpine：非 root 起服務，host 側觀察 redis-server 跑在 uid 100998（=容器 999 的 subuid 映射）、宣告埠 PING→+PONG、未強制委派時 fallback 路徑（移除 PATH 的 newuidmap）不 crash。linux-e2e.shrun_subid_e2e（bridge+shared 各驗 chown，斷言委派 banner；無委派環境跳過）；e2e workflow 安裝uidmap。文件
README（能力表、chown/gosu 段落、Roadmap 打勾）、DESIGN §6（服務 namespace 流程）、skills/write-appcipe（rootless 陷阱段改寫；順帶修掉兩處早已過時的「只吃 tar」描述）、CLAUDE.md。