Bug 1367837

Summary: [Supportability] RHEL Tools container does not support running as Arbitrary User IDs
Product: Red Hat Enterprise Linux 7 Reporter: Eric Rich <erich>
Component: rhel-tools-containerAssignee: Frantisek Kluknavsky <fkluknav>
Status: CLOSED NOTABUG QA Contact: atomic-bugs <atomic-bugs>
Severity: medium Docs Contact: Vikram Goyal <vigoyal>
Priority: unspecified    
Version: 7.3CC: dwalsh, erich, jeder, sct
Target Milestone: rcKeywords: Extras
Target Release: ---Flags: erich: needinfo-
sct: needinfo? (dwalsh)
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-04-19 13:49:38 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Eric Rich 2016-08-17 15:22:48 UTC 
Description of problem:

When running the rhel-tools container on OpenShift 

> oc run --restart=Never --attach --stdin --tty --image registry.access.redhat.com/rhel7/rhel-tools rhel-tools bash

> oc run --generator=deploymentconfig/v1 --attach --stdin --tty --image registry.access.redhat.com/rhel7/rhel-tools rhel-tools bash

Version-Release number of selected component (if applicable): "Id": "a94093b96828a0964d8d0147d96984547e24a080cbeac14d976ff5431495de46"

How reproducible: 100% 

Steps to Reproduce:
1. oc run --restart=Never --attach --stdin --tty --image registry.access.redhat.com/rhel7/rhel-tools rhel-tools bash
2: oc whoami

Actual results:

User is not known. 

Expected results:

The user should be known or "faked" 

Additional info:

https://docs.openshift.com/enterprise/3.2/creating_images/guidelines.html#openshift-enterprise-specific-guidelines
Comment 2 Daniel Walsh 2016-08-19 22:10:52 UTC 
Isn't this really a docker issue, that if you run as a specified UID and the UID is not defined in the /etc/passwd inside of the container, it can not translate it?
Comment 3 Frantisek Kluknavsky 2016-10-05 10:54:33 UTC 
nss_wrapper described in the docs is not in rhel7 at all (as of today). Bugzilla to add it is here: https://bugzilla.redhat.com/show_bug.cgi?id=1120347
Comment 5 Stephen Tweedie 2016-10-05 11:31:10 UTC 
I would really rather not add nss_wrapper to RHEL just for a short-term workaround for what is (in this case) a mostly-cosmetic issue.  It's a genuine issue, but the rhel-tools case doesn't seem a strong reason for adding it here.  

So the real question is whether this is the long-term answer we want for this general problem.

(In reply to Daniel Walsh from comment #2)
> Isn't this really a docker issue, that if you run as a specified UID and the
> UID is not defined in the /etc/passwd inside of the container, it can not
> translate it?

Right, it feels like we need some core plumbing to deal with this, and not just hack around it in the container image.  User namespaces may help, but is likely insufficient on its own.

Dan, do we have a plan for handling this sort of thing more cleanly?
Comment 7 Frantisek Kluknavsky 2018-04-19 13:49:38 UTC 
Bugzilla to add nss_wrapper to rhel is still not solved. Meanwhile, development of user namespaces moved a lot. I guess this bugzilla is obsolete. Feel free to reopen if you disagree.