Cannot run container in existing user namespace

[vishvananda]

Attempting to run a container in an existing user namespace simply ignores the path value and creates a new user namespace:

{
    "version": "pre-draft",
    "platform": {
        "os": "linux",
        "arch": "amd64"
    },
    "process": {
        "terminal": true,
        "args": [
            "/bin/bash"
        ]
    },
    "linux": {
        "uidMappings": [
            {
                "from": 0,
                "to": 1000,
                "count": 1
            }
        ],
        "gidMappings": [
            {
                "from": 0,
                "to": 1000,
                "count": 1
            }
        ],
        "namespaces": [
            {
                "type": "user",
                "path": "/proc/8660/ns/user"
            }
        ]
    }
}

$ sudo ls -lah /proc/$$/ns/user
lrwxrwxrwx 1 vishvananda vishvananda 0 Jul  7 06:06 /proc/38377/ns/user -> user:[4026531837]
$ sudo ls -lah /proc/8660/ns/user
lrwxrwxrwx 1 root root 0 Jul  8 00:05 /proc/8660/ns/user -> user:[4026532754]
$ sudo ls -lah /proc/14833/ns/user
lrwxrwxrwx 1 vishvananda vishvananda 0 Jul  8 01:14 /proc/14833/ns/user -> user:[4026532751]

It looks like the code will need some modification because you can't join an existing user namespace once you are in multithreaded code.

[vishvananda]

It looks like docker-archive/libcontainer#609 will handle this, but in needs to be ported over

[mrunalp]

@dqminh did mention that he is going to port it soon.

[vishvananda]

My goal here is really for shared network namespaces between containers that use user namespaces. @LK4D4 mentioned that it is possible to join the network namespace before unsharing the user namespace which would also be an acceptable solution for my use case.

[estesp]

This works properly now (as of awhile ago after the rewrite of nsexec.c and the join code); should this issue be closed?

[hqhq]

@estesp Thanks for confirming, closing.