Could container UID outside of mapped range be detected during validation of input arguments?

[eriksjolund]

The discussion about using a big UID in

• UID higher than 10000000 #21293

reminded me of the troubleshooting tip

10) rootless setup user: invalid argument

The troubleshooting tip does not currently mention --userns=keep-id:uid=$id,gid=$id
I could try writing a PR to fix that.

Another thing: Could podman or crun classify such input as invalid when validating the input?
Are there any valid situations of using --user=$id:$id where $id is not in the mapped ranges?

Here is an example of how it currently works:

Example 1

The specified container UID 65536 is in the mapped ranges.

$ id=65536
$ podman run --rm --user $id:$id docker.io/library/alpine cat /proc/self/uid_map
         0       1003          1
         1     720896      65536

Example 2

The specified container UID 65537 is not in the mapped ranges. The podman command fails.

$ id=65537
$ podman run --rm --user $id:$id docker.io/library/alpine cat /proc/self/uid_map
Error: OCI runtime error: crun: setgroups: Invalid argument
$ 

Add --userns=keep-id:uid=$id,gid=$id
Now the podman command succeeds.

$ id=65537
$ podman run --rm --user $id:$id --userns=keep-id:uid=$id,gid=$id docker.io/library/alpine cat /proc/self/uid_map
         0          1      65536
     65537          0          1

Instead of
Error: OCI runtime error: crun: setgroups: Invalid argument
something like this would be more useful
Error: the specified container user UID is not mapped in the user namespace. Consider using --userns=keep-id:uid=65537,gid=65537

Some time in the future I could try to add this feature. (I don't want to promise anything)

In any case, it would be interesting to hear if you think this would be a useful feature?

update 1

When I started writing some text to add to the troubleshooting tip, I noticed 3 different error messages from crun

(with -ti)

Error: OCI runtime error: crun: chown `/dev/pts/0`: Invalid argument

(with -ti)

Error: container create failed (no logs from conmon): conmon bytes "": readObjectStart: expect { or n, but found , error found in #0 byte of ...||..., bigger context ...||...

(without -ti)

Error: OCI runtime error: crun: cannot setresuid to `1000000`: Invalid argument

but only one error message from runc

(with or without -ti)

Error: OCI runtime error: runc: runc create failed: unable to start container process: unable to setup user: invalid