Documentation
¶
Overview ¶
Package rootless is the accounts a namespace may run rootless containers as.
A rootless container runs its podman commands as the unix account its rootless_user keyword names, and as the group rootless_group names, or the primary group of the account. The account owns the container, its image store and its files, so an account is a boundary: whoever runs a container as it reaches everything else that account owns on the node, the rootless containers of other objects included.
Which accounts are the namespace's to use is not the namespace's to decide, so the namespace configuration lists them, and only the squatter writes it:
[DEFAULT] rootless_users = web-ns1 rootless_groups = web-ns1
A namespace listing none has no account to run rootless containers as. An allowed user allows its primary group. The root account and the root group are never allowed, whatever the lists say.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DescribeShared ¶
DescribeShared says the namespaces sharing the accounts of a namespace, for a warning.
Types ¶
type Allowed ¶
Allowed is what a namespace lists, as written.
func Load ¶
Load reads what a namespace allows from its configuration on this node, and allows nothing for a namespace whose configuration this node does not hold.
It is read from the node and never over the api, as a claim is: a namespace configuration is on every node.
func (Allowed) Check ¶
Check says why a namespace may not run a container as the user and the group given, and nil when it may. An empty user is a rootful container, which is not an account of the namespace.
The ids are compared, not the names: an account allowed by name is the same account named by its uid, and a name resolving to another uid on another node is another account there.
func (Allowed) SharedWith ¶
SharedWith returns the other namespaces allowing one of the users this one allows, by the uid they share.
Two namespaces running containers as the same account reach each other's containers, images and files, which is allowed, the squatter deciding it, and said.
Source Files