libpod: allow userns=keep-id for root

[giuseppe]

copy the current mapping into a new user namespace, and run into a separate user namespace.

Closes: #17337

Signed-off-by: Giuseppe Scrivano gscrivan@redhat.com

Does this PR introduce a user-facing change?

Now --userns=keep-id also works for root containers and it copies the current mapping into a new user namespace

[flouthoc]

LGTM

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: flouthoc, giuseppe

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [flouthoc,giuseppe]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Luap99]

Is there an actual difference between running in a userns with the same mappings compared to just running in the host ns?

[giuseppe]

Is there an actual difference between running in a userns with the same mappings compared to just running in the host ns?

only minor differences compared to using a mapping where the "real" root is not mapped.

There are few places in the kernel that just check if it is running in the initial user namespace.

[Luap99]

/lgtm

I changed your release note because it said --userns=auto instead of keep-id, assuming that this was a typo.