Bug 1546870
| Summary: | dockerd man page: --userns-remap=default does NOT create user namespace map | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Chris Evich <cevich> |
| Component: | docker | Assignee: | Tom Sweeney <tsweeney> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | atomic-bugs <atomic-bugs> |
| Severity: | low | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.5 | CC: | amurdaca, cevich, ddarrah, fkluknav, lsm5, nathan, santiago |
| Target Milestone: | rc | Keywords: | Documentation, Extras |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: |
Man page for usernamespace was lacking in details on subgid and subuid support on RHEL. This has been clarified.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-11-19 19:18:08 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
I think you have to add the range you want to use into /etc/sub{uid,gid}
Do you think we should do this in the spec file?
The actual root cause is:
Error during "dockremap" user creation: Couldn't create subordinate ID ranges: Unable to add subuid range to user: "dockremap"; output: usermod: invalid option -- 'v'
The problem is in pkg/idtools/usergroupadd_linux.go , which runs 'usermod -v <N> <N+range> dockremap'. Fedora usermod includes -v/-w options for updating /etc/subuid & subgid respectively; RHEL does not. I do not see an equivalent mechanism in RHEL for updating those files.
All the RHEL documentation I've ever seen for docker + user namespaces clearly indicate that a human must add 'dockremap' lines into /etc/sub[ug]id. I believe the best solution for RHEL is to update the man page accordingly, and (bonus points) update usergroupadd_linux.go to include a more helpful error message such as "sorry, RHEL does not support dynamic creation of subid ranges, please see dockerd(1) and edit /etc/sub[ug]id manually"
Ahh, thanks for the extra details Ed. Yes, that's my understanding as well (must manually add). Good idea about patching the error message in addition to man page, ya that would be nice. In case the burden of carrying another patch for the binary is a PITA, I think we could live with just the man page at a minimum. Since this is a non-default option, it's a safe bet a user will encounter either the (corrected) man page or the docs, before or after breaking it, so that should be good'nuff IMHO. It looks like pkg/idtools/usergroupadd_linux.go is only gotten into if you specify the uid/gid in the userns-remap argument and they don't already exist in the files. The error that Chris ran into is the route you get if you specify default. In that instance it's not going to try to create the entries, it just throws an error if they're not found. pkg/idtools/idtools.go:CreateIDMappings. I've adjusted the man page in my sandbox, will ponder better error messaging in the morn. I've created: https://github.com/projectatomic/docker/pull/301 for Docker 13.1. Once this gets blessed, I'll create a PR for 13.1-RHEL too. I decided to not change the messaging in pkg/idtools/usergroupadd_linux.go when usermod fails. I was concerned that if the usermod functionality is ever added to RHEL to update subuid/subgid, then the messaging would be off if the error wasn't related. I did update the error that Chris ran into appending "in /etc/subuid" or "in /etc/subgid" as appropriate. I also updated the manpage. For Docker 1.13.1-RHEL, I created this PR: https://github.com/projectatomic/docker/pull/303. Once merged, I'll close out this BZ. https://github.com/projectatomic/docker/pull/303 has been merged, I'm setting this BZ to On_QA. Inspected man page for docker daemon. It was updated to clarify manual editing is required. |
Description of problem: This may be correct for upstream, but it doesn't seem to work on RHEL 7.5. --userns-remap=default|uid:gid|user:group|user|uid Enable user namespaces for containers on the daemon. Specifying "default" will cause a new user and group to be created to handle UID and GID range remapping for the user namespace mappings used for contained processes. Specifying a user (or uid) and optionally a group (or gid) will cause the daemon to lookup the user and group's subordinate ID ranges for use as the user namespace mappings for contained processes. Version-Release number of selected component (if applicable): docker-common-1.13.1-54.rhel75.gitce62987.el7.x86_64 How reproducible: 100% Steps to Reproduce: 1. Add --userns-remap=default to OPTIONS in /etc/sysconfig/docker 2. restart docker service Actual results: dockerd-current[*]: Can't create ID mappings: No subuid ranges found for user "dockremap" Expected results: New maps would be added to /etc/sub{uid,gid} Additional info: Wrong documentation is worse than no documentation. Suggest getting rid of that section or correcting it for RHEL. e.g. --userns-remap=default|uid:gid|user:group|user|uid Enable user namespaces for containers on the daemon. Specifying "default" expects a UID and GID range map for the 'dockremap' to already be defined. Specifying a user (or uid) and optionally a group (or gid) will cause the daemon to lookup the user and group's subordinate ID ranges for use as the user namespace mappings for contained processes.