Skip to content

v0.4.3

Choose a tag to compare

View all tags
@magifd2 magifd2 released this 11 May 03:44
· 214 commits to main since this release
v0.4.3
bad9475

Sandbox UID-mapping fix release. Addresses the corp/LDAP-mapped macOS host UID case where podman run --user $(id -u) fails container start with crun: setresuid: Invalid argument.

Fixed

  • podman engine path now uses keep-id userns remap — replaces --user $(id -u) with --userns=keep-id:uid=1000,gid=1000 + --user 1000:1000. Large host UIDs from LDAP/AD-mapped corporate macOS accounts (e.g., 200M+ values) used to fall outside the rootless subuid range and crash crun with setresuid: Invalid argument. The keep-id remap pulls them into a small in-namespace UID while preserving /work file ownership in both directions. Defence-in-depth posture from v0.2.0 (non-root container) is preserved — the container process still runs as a non-root user, just at UID 1000 inside its namespace instead of the host UID directly.

Compatibility

  • Podman ≥ 4.3 (Nov 2022) is now required for the sandbox feature.
  • Docker users see no behaviour change at all — the docker path keeps the historical --user $(id -u).

See docs/en/sandbox-uid-mapping.md for the full root-cause analysis and design rationale.

Assets 3
Loading