How are user namespace mappings resolved between namespaces?

Question

Let's say I spawn 2 processes in 2 different namespaces as described by this LWN article.

• The first one maps UID 0 inside the ns to UID 1000 outside the ns.
• The second one maps UID 200 inside the ns to UID 1000 outside the ns.

I came up with this figure to visualize it:

Question #1: is the figure accurate?

Question #2: why is it that when I issue a ps command in the bash process running in "user namespace 2", I see the bash process of "user namespace 1" as running with UID 200? I have some ideas of how this could work but I just can't find it written anywhere and I'd like to know the exact steps of the resolution.

Answer 1

I'm not entirely sure what you're illustrating in figure 1, so I don't know if it's accurate. Question 2, though, I can explain — hopefully that also answers #1.

"Maps" means there is a 1-to-1 relationship. When you map 1000 outside (in the root namespace) to 0 inside namespace 1, that goes both ways: 0 inside is 1000 outside. The same is true of namespace 2, where 1000 outside (root) is 200 inside (and 200 inside is 1000 outside).

So then if you start a uid=0 process in namespace 1, outside (in the root namespace) it is uid 1000. And when you look at that from inside namespace 2, well, remember that 1000 outside is 200 inside. So it's 200.

You might find the information in the user namespaces manpage, in particular the user and group mappings section useful.