nspawn: introduce --private-users-ownership=map|auto
This adds a two new values to --private-users-ownership=: "map" and "auto". "map" exposes the kernel 5.12 idmap feature pretty much 1:1. It fails if the kernel or used file system doesn't support ID mapping. "auto" is a bit smarter: if we can make ID mapping work, we'll use it, otherwise revert back to classic chown()ing. We'll also use chown()ing if we detect that an image is already ID shifted, both to increase compatibility with the status quo ante, and to simplify our codepaths, since the mappings become a lot simpler if we only have to map from zero to something else, instead of from anything to anything else. The short -U switch, and --private-users=pick will now imply --private-users-ownership=auto instead of --private-users-ownership=chown, since the new logic should be the much better choice.
Loading
Please register or sign in to comment