search

tailhook / unshare

The low-level linux containers creation library for rust
Apache License 2.0
124 stars 27 forks source link

setns happens in child process after uid/gid mapping #28

Open skeptomai opened 2 years ago

skeptomai commented 2 years ago

I want to put the child into a network namespace by calling setns, but this requires CAP_SYS_ADMIN, which I've lost after the uid/gid mapping. (Basically building a rootless container). The calls to setns happen in child_after_clone, which is called after the uid/gid mapping is done in after_start, which then wakes the child process. So the order currently is:

clone->wait->after_start (which does uid/gid mapping) -> wakeup -> child_after_clone (which calls setns)

Am I doing something wrong?