Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options answers only user 5462

User namespaces or short `userns` is a facility that allows a sub-namespace to have its own set of UIDs and GIDs. This allows to use the least privilege principle for LXC containers, but it's not limited to that use case.

20
votes
Unprivileged LXC containers are the ones making use of user namespaces (userns). I.e. of a kernel feature that allows to map a range of UIDs on the host into a namespace inside of which a user with …
answered Jan 2 '15 by 0xC0000022L
2
votes
I know now how to do this. If you can't follow this explanation, please ask back, but also make sure you have read up on userns in the readings I am giving at the bottom Preliminary assumptions … /$container/rootfs) container configuration is by default in ~userX/.local/share/lxc/$container/config Moving the container There are two relevant pieces of data that govern the userns containers …
answered Dec 22 '14 by 0xC0000022L
0
votes
I have investigated that topic since I asked my question and it turns out that the ranges of sub-GIDs/sub-UIDs are indeed used as file-group/-owner for the files. There is no additional metadata (unle …
answered Dec 21 '14 by 0xC0000022L
7
votes
Turns out, surprise surprise, this is a Ubuntu-specific thing. The cause The problem: although the kernel has cgroups enabled (check with grep CGROUP /boot/config-$(uname -r)) and cgmanager is run …
answered Jan 2 '15 by 0xC0000022L
3
votes
: lxc.id_map = u 0 1000000000 10000 lxc.id_map = g 0 1000000000 10000 which tells LXC to create a user namespace (userns) with 10000 IDs for both, group and user IDs respectively, starting at 1000000000 … subordinate IDs in the mapped range, or set the configuration option UsePrivilegeSeparation no in sshd_config Background The script container-userns-convert which is hosted on launchpad (checkout …
answered May 6 '15 by 0xC0000022L
1
vote
For the time being, here's the shell script I've been using. #!/bin/bash SUBUID=/etc/subuid SUBGID=/etc/subgid for i in $SUBUID $SUBGID; do [[ -f "$i" ]] || { echo "ERROR: $i does not exist, but is r …
answered Dec 22 '14 by 0xC0000022L