Hide Forgot
Description of problem: When running the rhel-tools container on OpenShift > oc run --restart=Never --attach --stdin --tty --image registry.access.redhat.com/rhel7/rhel-tools rhel-tools bash > oc run --generator=deploymentconfig/v1 --attach --stdin --tty --image registry.access.redhat.com/rhel7/rhel-tools rhel-tools bash Version-Release number of selected component (if applicable): "Id": "a94093b96828a0964d8d0147d96984547e24a080cbeac14d976ff5431495de46" How reproducible: 100% Steps to Reproduce: 1. oc run --restart=Never --attach --stdin --tty --image registry.access.redhat.com/rhel7/rhel-tools rhel-tools bash 2: oc whoami Actual results: User is not known. Expected results: The user should be known or "faked" Additional info: https://docs.openshift.com/enterprise/3.2/creating_images/guidelines.html#openshift-enterprise-specific-guidelines
Isn't this really a docker issue, that if you run as a specified UID and the UID is not defined in the /etc/passwd inside of the container, it can not translate it?
nss_wrapper described in the docs is not in rhel7 at all (as of today). Bugzilla to add it is here: https://bugzilla.redhat.com/show_bug.cgi?id=1120347
I would really rather not add nss_wrapper to RHEL just for a short-term workaround for what is (in this case) a mostly-cosmetic issue. It's a genuine issue, but the rhel-tools case doesn't seem a strong reason for adding it here. So the real question is whether this is the long-term answer we want for this general problem. (In reply to Daniel Walsh from comment #2) > Isn't this really a docker issue, that if you run as a specified UID and the > UID is not defined in the /etc/passwd inside of the container, it can not > translate it? Right, it feels like we need some core plumbing to deal with this, and not just hack around it in the container image. User namespaces may help, but is likely insufficient on its own. Dan, do we have a plan for handling this sort of thing more cleanly?
Bugzilla to add nss_wrapper to rhel is still not solved. Meanwhile, development of user namespaces moved a lot. I guess this bugzilla is obsolete. Feel free to reopen if you disagree.