Hi, you mention that after creating a new user namespace you at first have all capabilities in the new ns. You don't explicitly mention (or I missed it - I did see the mention of securebits) that if you want to keep those capabilities after doing an exec, you need to first have something mapped to uid 0 in the userns, and do setuid(0). You might not want to list manpages from other projects, but Eric's shadow patches introduce some good new manpages as well. Those aren't yet accepted upstream, but if/when they are then mention at least of subuid(5), subgid(5), and newuidmap(1) and newgidmap(1) might be good. thanks, -serge _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linuxfoundation.org/mailman/listinfo/containers
