Quoting Aleksa Sarai (asarai@xxxxxxx):
> >>So my essential point is that building the real kuid into the permanent
> >>record of the xattr damages image portability, which is touted as one
> >>of the real advantages of container images.
> >
> >'container images' aren't portable in that sense now - for at least
> >many cases - because you have to shift the uid. However you're doing
> >that, you may be able to shift the xattr the same way.
>
> Piling more things on top of that issue isn't going to make the
> issue easier to solve IMO. Would shiftfs or shift-bindmounts also
> have to do translation of arbitrary xattrs? Plus I would think that
> handling xattrs would be harder than {u,g}ids because the image
> unpacker now has to be aware of all xattrs that require remapping
> (Which might be an ever-growing list).
No, that's actually the point of Stefan's patch (versus mine). It
should be able to generically map anything that is 'security.foo@uid=100'
or 'trusted.foo@uid=100'. It doesn't need more intelligence than that.
-serge
_______________________________________________
Containers mailing list
Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx
https://lists.linuxfoundation.org/mailman/listinfo/containers
