So my essential point is that building the real kuid into the permanent
record of the xattr damages image portability, which is touted as one
of the real advantages of container images.
'container images' aren't portable in that sense now - for at least
many cases - because you have to shift the uid. However you're doing
that, you may be able to shift the xattr the same way.
Piling more things on top of that issue isn't going to make the issue
easier to solve IMO. Would shiftfs or shift-bindmounts also have to do
translation of arbitrary xattrs? Plus I would think that handling xattrs
would be harder than {u,g}ids because the image unpacker now has to be
aware of all xattrs that require remapping (Which might be an
ever-growing list).
The user namespace incompatibility with the VFS's hard-coding of
k{u,g}id values in inodes is an issue that we really shouldn't be
encouraging IMO [especially given how hard it's been so far to solve
that problem.]
Just my $.02.
--
Aleksa Sarai
Software Engineer (Containers)
SUSE Linux GmbH
https://www.cyphar.com/
_______________________________________________
Containers mailing list
Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx
https://lists.linuxfoundation.org/mailman/listinfo/containers
