Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Proposal: Support for user namespaces #7906

Closed
dineshs-altiscale opened this issue Sep 5, 2014 · 16 comments
Closed

Proposal: Support for user namespaces #7906

dineshs-altiscale opened this issue Sep 5, 2014 · 16 comments
Labels
kind/feature Functionality or other elements that the project doesn't currently have. Features are new and shiny

Comments

@dineshs-altiscale
Copy link
Contributor

The details of user namespace support have been discussed quite a bit under the following docker and libcontainer PRs. However, there was never really a proposal to provide a space to discuss the big picture. This issue is created to cover that purpose.

#4572
docker-archive/libcontainer#23
docker-archive/libcontainer#53

To summarize, docker support for user namespaces requires the backend exec driver to provide the necessary system interface. Currently LXC supports it but libcontainer support is gated by Go (https://code.google.com/p/go/issues/detail?id=8447).

One of the questions to answer is whether the high level support in Docker (regardless of the backend) can be shepherded along based on LXC, while Go issues for libcontainer are being worked out in parallel. If so, we can discuss approaches currently proposed in #4572 along with other potential alternatives.

@gdm85
Copy link
Contributor

gdm85 commented Feb 1, 2015

Has the potential development of this feature come to a halt?

It would have been a great addition, from security/isolation perspective.

@LK4D4
Copy link
Contributor

LK4D4 commented Feb 2, 2015

@gdm85 There will be support in native driver in 1.6.

@jaybuff
Copy link

jaybuff commented Feb 2, 2015

@LK4D4 Where can we track the progress of that development work if not in this issue?

@fivetonsflax
Copy link

What @jaybuff said.

@jessfraz jessfraz added the kind/feature Functionality or other elements that the project doesn't currently have. Features are new and shiny label Feb 26, 2015
@sammcj
Copy link

sammcj commented Mar 4, 2015

Very excited about this - is it definitely confirmed for docker 1.6?

@estesp
Copy link
Contributor

estesp commented Mar 9, 2015

See PR #11253 for the user-facing proposal. I can't confirm that all components will make it for 1.6, but work is ongoing. The most important is to have the libcontainer version that has the support in the Docker vendor tree, and that PR (to update libcontainer in vendor/ and use the new libcontainer API) is going through review at the moment.

@tphyahoo
Copy link

Could this have label project/security added?

@pdonorio
Copy link

Is this already available in the latest 1.6 rc?

@duglin
Copy link
Contributor

duglin commented Apr 13, 2015

Not yet - plan is for v1.7

@afolarin
Copy link

Do we know if this is going to make 1.7. I can't see it in the listed features https://github.com/docker/libnetwork/wiki/Docker-1.7-Project-Page

@duglin
Copy link
Contributor

duglin commented Jun 10, 2015

Due to some issues that were exposed recently this has been push out to after v1.7.

@afolarin
Copy link

@duglin i'd like to be able to track this progres on this feature. userns are quite important to my planning

@estesp
Copy link
Contributor

estesp commented Jun 10, 2015

@afolarin we'll probably continue to use the open PR to track progress: #12648

At this point we have some work to resolve the order of namespace creation and some recently realized restrictions in the Linux kernel namespaces implementation. With the inclusion of libnetwork in 1.7, this "surprise" was exposed and we had to keep user namespaces out of 1.7 until we resolve this.

@LK4D4
Copy link
Contributor

LK4D4 commented Jun 11, 2015

@estesp @afolarin I think we can do this pretty fast if we will have time.

@robertoandrade
Copy link

Any projections as to when this will be available?

@cpuguy83
Copy link
Member

I'm going to close this one since most of the discussion is happening @ #15187
The plan is to have this in docker 1.9.
The PR which introduces this is here: #12648

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/feature Functionality or other elements that the project doesn't currently have. Features are new and shiny
Projects
None yet
Development

No branches or pull requests