overlay: disable "rebase" capability when running in UserNS

[AkihiroSuda]

Fix #13388

[...]
May 12 16:57:23 kind-control-plane kubelet[257]:         failed to extract layer (application/vnd.docker.image.rootfs
.diff.tar sha256:6f1cdceb6a3146f0ccb986521156bef8a422cdbb0863396f7f751f575ba308f4) to overlayfs as "extract-920875437
-7QPF sha256:31e64620332e54e3e4fb246d8325ed2c9f1c2cc64a95f0bb23b4b7e82834c95a": failed to mount /var/lib/containerd/t
mpmounts/containerd-mount2180142388: mount source: "overlay", target: "/var/lib/containerd/tmpmounts/containerd-mount
2180142388", fstype: overlay, flags: 0, data: "upperdir=/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/sn
apshots/279/fs", err: invalid argument
[...]

This was a regression introduced in PR #13115.

[AkihiroSuda]

/cherry-pick release/2.2
/cherry-pick release/2.3

[k8s-infra-cherrypick-robot]

@AkihiroSuda: once the present PR merges, I will cherry-pick it on top of release/2.2, release/2.3 in new PRs and assign them to you.

Details

In response to this:

/cherry-pick release/2.2
/cherry-pick release/2.3

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[Copilot]

Pull request overview

This PR fixes a regression affecting rootless (UserNS) deployments by preventing the parallel-unpack overlayfs “bind mount -> overlay mount” workaround from running when containerd is executing inside a Linux user namespace. This avoids generating an overlay mount spec that later fails to mount with EINVAL during extraction (as reported in #13388), while keeping the workaround intact for the non-UserNS case introduced in #13115.

Changes:

• Import github.com/moby/sys/userns in the unpacker.
• Skip bindToOverlay(mounts) during parallel unpack for overlayfs when userns.RunningInUserNS() is true.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[k8s-infra-cherrypick-robot]

@AkihiroSuda: new pull request created: #13393

Details

In response to this:

/cherry-pick release/2.2
/cherry-pick release/2.3

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[k8s-infra-cherrypick-robot]

@AkihiroSuda: new pull request created: #13394

Details

In response to this:

/cherry-pick release/2.2
/cherry-pick release/2.3

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.