crio: basic support for rootless mode

Allow to run it in an user namespace.  This is only a first step but I
was able to run a pod and some basic containers.

Leave it undocumented for now as we don't want to stick with this
API.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

server/container_create_linux.go

@@ -874,6 +874,12 @@ func (s *Server) createSandboxContainer(ctx context.Context, containerID string,
 		}()
 	}
 
+	if os.Getenv("_CRIO_ROOTLESS") != "" {
+		if err := makeOCIConfigurationRootless(&specgen); err != nil {
+			return nil, err
+		}
+	}
+
 	saveOptions := generate.ExportOptions{}
 	if err = specgen.SaveToFile(filepath.Join(containerInfo.RunDir, "config.json"), saveOptions); err != nil {
 		return nil, err

server/rootless.go

@@ -0,0 +1,39 @@
+package server
+
+import (
+	"strings"
+
+	rspec "github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/opencontainers/runtime-tools/generate"
+)
+
+func makeOCIConfigurationRootless(g *generate.Generator) error {
+	g.Config.Linux.Resources = nil
+	g.Config.Process.OOMScoreAdj = nil
+	g.Config.Process.ApparmorProfile = ""
+	g.Config.Process.SelinuxLabel = ""
+
+	for i := range g.Config.Mounts {
+		var newOptions []string
+		for _, o := range g.Config.Mounts[i].Options {
+			if strings.HasPrefix(o, "gid=") {
+				continue
+			}
+			newOptions = append(newOptions, o)
+		}
+		g.Config.Mounts[i].Options = newOptions
+	}
+
+	g.RemoveMount("/sys")
+	sysMnt := rspec.Mount{
+		Destination: "/sys",
+		Type:        "bind",
+		Source:      "/sys",
+		Options:     []string{"nosuid", "noexec", "nodev", "ro", "rbind"},
+	}
+	g.AddMount(sysMnt)
+
+	g.SetLinuxCgroupsPath("")
+
+	return nil
+}

server/sandbox_run_linux.go

@@ -544,6 +544,12 @@ func (s *Server) runPodSandbox(ctx context.Context, req *pb.RunPodSandboxRequest
 		g.SetRootPath(mountPoint)
 	}
 
+	if os.Getenv("_CRIO_ROOTLESS") != "" {
+		if err := makeOCIConfigurationRootless(&g); err != nil {
+			return nil, err
+		}
+	}
+
 	container.SetSpec(g.Spec())
 
 	sb.SetInfraContainer(container)