programs/workerbee: Add "--nested-idmap" option Rootless podman uses namespace but newuidmap fails to allocate the shifted id range because Incus' "security.idmap.isolated" allocates dedicated id range size of 65536 (it's the minimum.)

Changes

2 changed files (+23/-0)

• programs/workerbee/default.nix
  • @@ -68,6 +68,11 @@ stdenvNoCC.mkDerivation rec {
    --long disable-nesting \ -d "Disable container nesting" + complete -c ${name} \ + --condition "__fish_seen_subcommand_from incus; and __fish_seen_subcommand_from $incus_commands" \ + --long nested-idmap \ + -d "Allow idmap inside container" + complete -c ${name} \ --condition "__fish_seen_subcommand_from incus; and __fish_seen_subcommand_from $incus_commands" \ --long wayland \
• programs/workerbee/src/incus_config.zig
  • @@ -56,6 +56,10 @@ const Options = struct {
    /// Enable container nesting (only container). nesting: bool = true, + /// Enable idmap inside container, for example rootless podman. + /// Ignored when "nesting" is disabled. + nested_idmap: bool = false, + /// Wayland socket to bind. wayland_socket: ?WaylandSocket = null,
  • @@ -95,6 +99,12 @@ const Options = struct {
    if (self.nesting) { try json.objectField("security.nesting"); try json.write(true); + + if (self.nested_idmap) { + // Give extra id range for nested idmap. + try json.objectField("security.idmap.size"); + try json.write(165536); + } } try json.endObject();
  • @@ -176,6 +186,9 @@ const help =
    \\ Non-Incus sandbox technologies such as Nix and podman \\ won't work when disabled. \\ + \\--nested-idmap Allows the container to create idmap. Enable this option + \\ to use rootless podman inside the container. + \\ \\--wayland Proxy host's Wayland socket to the container, \\ at "/mnt/wayland-0". As this command Wayland socket \\ path and UID of local machine (where the command runs
  • @@ -226,6 +239,11 @@ pub fn run(allocator: std.mem.Allocator, args: *std.process.ArgIterator) !exit.C
    continue; } + if (std.mem.eql(u8, arg, "--nested-idmap")) { + options.nested_idmap = true; + continue; + } + if (std.mem.eql(u8, arg, "--wayland")) { // The current Zig stdlib misses `std.posix.getgid`. const gid = std.os.linux.getgid();