Ubuntu 24.04 now restricts user namespaces by default, which breaks some setups

[afbjorklund]

Description

The setup in the default cidata (for containerd) is now mandatory, since otherwise containers don't work:

https://github.com/lima-vm/lima/blob/v0.21.0/pkg/cidata/cidata.TEMPLATE.d/boot/40-install-containerd.sh#L80

• https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces

It comes with a default allowance for rootlesskit, but only when installed in /usr/bin/rootlesskit

And it needs similar setup, for Apptainer to work... Since it doesn't support Ubuntu, it doesn't affect Podman*.

• AppArmor profile needed on Ubuntu 24.04 apptainer/apptainer#2027

$ limactl shell apptainer apptainer run -u -B $HOME:$HOME docker://alpine
INFO:    Converting OCI blobs to SIF format
INFO:    Starting build...
Copying blob 4abcf2066143 done   | 
Copying config bc4e4f7999 done   | 
Writing manifest to image destination
2024/05/05 12:29:22  info unpack layer: sha256:4abcf20661432fb2d719aaf90656f55c287f8ca915dc1c92ec14ff61e67fbaf8
INFO:    Creating SIF file...
ERROR  : Could not write info to setgroups: Permission denied

---

* with Fedora you already have the SELinux and the tmp-on-tmpfs breakage to take care of instead.

[afbjorklund]

Workaround for apptainer (#2320):

root@lima-apptainer:~#     # Workaround for https://github.com/apptainer/apptainer/issues/2027
    echo "kernel.apparmor_restrict_unprivileged_userns = 0" >/etc/sysctl.d/99-userns.conf
    sysctl --system

$ limactl shell apptainer apptainer run -u -B $HOME:$HOME docker://alpine
INFO:    Using cached SIF image
Apptainer>