unshare

Documentation

Index

• Constants
• func ExecRunnable(cmd Runnable, cleanup func())
• func GetHostIDMappings(pid string) ([]specs.LinuxIDMapping, []specs.LinuxIDMapping, error)
• func GetRootlessUID() int
• func GetSubIDMappings(user, group string) ([]specs.LinuxIDMapping, []specs.LinuxIDMapping, error)
• func HasCapSysAdmin() (bool, error)
• func HomeDir() (string, error)
• func IsRootless() bool
• func IsSetID(path string, modeid os.FileMode, capid capability.Cap) (bool, error)
• func MaybeReexecUsingUserNamespace(evenForRoot bool)
• func ParseIDMappings(uidmap, gidmap []string) ([]idtools.IDMap, []idtools.IDMap, error)
• func RootlessEnv() []string
• type Cmd
  • func Command(args ...string) *Cmd
  • func (c *Cmd) CombinedOutput() ([]byte, error)
  • func (c *Cmd) Output() ([]byte, error)
  • func (c *Cmd) Run() error
  • func (c *Cmd) Start() error
• type Runnable

Constants

const (
	// UsernsEnvName is the environment variable, if set indicates in rootless mode
	UsernsEnvName = "_CONTAINERS_USERNS_CONFIGURED"
)

Functions

func ExecRunnable

func ExecRunnable(cmd Runnable, cleanup func())

ExecRunnable runs the specified unshare command, captures its exit status, and exits with the same status.

func GetHostIDMappings

func GetHostIDMappings(pid string) ([]specs.LinuxIDMapping, []specs.LinuxIDMapping, error)

GetHostIDMappings reads mappings for the specified process (or the current process if pid is "self" or an empty string) from the kernel.

func GetRootlessUID

func GetRootlessUID() int

GetRootlessUID returns the UID of the user in the parent userNS

func GetSubIDMappings

func GetSubIDMappings(user, group string) ([]specs.LinuxIDMapping, []specs.LinuxIDMapping, error)

GetSubIDMappings reads mappings from /etc/subuid and /etc/subgid.

func HasCapSysAdmin

func HasCapSysAdmin() (bool, error)

HasCapSysAdmin returns whether the current process has CAP_SYS_ADMIN.

func HomeDir

func HomeDir() (string, error)

HomeDir returns the home directory for the current user.

func IsRootless

func IsRootless() bool

IsRootless tells us if we are running in rootless mode

func IsSetID

func IsSetID(path string, modeid os.FileMode, capid capability.Cap) (bool, error)

IsSetID checks if specified path has correct FileMode (Setuid|SETGID) or the matching file capability

func MaybeReexecUsingUserNamespace

func MaybeReexecUsingUserNamespace(evenForRoot bool)

MaybeReexecUsingUserNamespace re-exec the process in a new namespace

func ParseIDMappings

func ParseIDMappings(uidmap, gidmap []string) ([]idtools.IDMap, []idtools.IDMap, error)

ParseIDMappings parses mapping triples.

func RootlessEnv

func RootlessEnv() []string

RootlessEnv returns the environment settings for the rootless containers

Types

type Cmd

type Cmd struct {
	*exec.Cmd
	UnshareFlags               int
	UseNewuidmap               bool
	UidMappings                []specs.LinuxIDMapping // nolint: golint
	UseNewgidmap               bool
	GidMappings                []specs.LinuxIDMapping // nolint: golint
	GidMappingsEnableSetgroups bool
	Setsid                     bool
	Setpgrp                    bool
	Ctty                       *os.File
	OOMScoreAdj                *int
	Hook                       func(pid int) error
}

Cmd wraps an exec.Cmd created by the reexec package in unshare(), and handles setting ID maps and other related settings by triggering initialization code in the child.

func Command

func Command(args ...string) *Cmd

Command creates a new Cmd which can be customized.

func (*Cmd) CombinedOutput

func (c *Cmd) CombinedOutput() ([]byte, error)

func (*Cmd) Output

func (c *Cmd) Output() ([]byte, error)

func (*Cmd) Run

func (c *Cmd) Run() error

func (*Cmd) Start

func (c *Cmd) Start() error

type Runnable

type Runnable interface {
	Run() error
}