feat: Update /etc/sub*id files in order to run podman command in a user namespace

Signed-off-by: Anatolii Bazko <[email protected]>

Author: tolusha

base/ubi9/entrypoint.sh

@@ -31,6 +31,49 @@ if ! whoami &> /dev/null; then
     echo "${USER_NAME:-user}:x:$(id -u):0:${USER_NAME:-user} user:${HOME}:/bin/bash" >> /etc/passwd
     echo "${USER_NAME:-user}:x:$(id -u):" >> /etc/group
   fi
+
+  # Try to detect if we are running in a user namespace and if so, update /etc/subuid and /etc/subgid files.
+  # The user namespace is created when `UserNamespacesSupport` feature is enabled and `hostUsers` is set to false in Pod spec.
+  # Typical output of `/proc/self/uid_map`:
+  # 1. When NOT running in a user namespace:
+  #         0          0 4294967295
+  # 2. When running in a user namespace:
+  #         0 1481179136      65536
+  #    or
+  #         0       1000          1
+  #         1       1001      64535
+  # For more details see:
+  # - https://man7.org/linux/man-pages/man7/user_namespaces.7.html
+  # - https://kubernetes.io/docs/concepts/workloads/pods/user-namespaces/
+  # - https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates/
+  # - https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/
+  if [ -f /proc/self/uid_map ]; then
+    if ! grep -q '^\s*0\s\+0\s\+\([2-9]\|[1-9][0-9]\+\)' /proc/self/uid_map; then
+      echo "Running in a user namespace, user id: $(id -u)"
+      # By default, the valid UIDs/GIDs is the range 0-65535
+      # Update /etc/subuid and /etc/subgid to reflect that.
+      if [ "$(id -u)" -lt 65536 ]; then
+        USER_NAME=$(whoami)
+        START_ID=$(( $(id -u) + 1 ))
+        END_ID=$(( 65536 - ${START_ID} ))
+        ID_RANGE="${USER_NAME}:${START_ID}:${END_ID}"
+
+        if [ -w /etc/subuid ]; then
+          echo "${ID_RANGE}" > /etc/subuid
+          echo "/etc/subuid updated"
+        fi
+        if [ -w /etc/subgid ]; then
+          echo "${ID_RANGE}" > /etc/subgid
+          echo "/etc/subgid updated"
+        fi
+      fi
+    else
+      echo "Not running in a user namespace"
+      echo "/proc/self/uid_map content: $(cat /proc/self/uid_map)"
+    fi
+  else
+    echo "/proc/self/uid_map not found, cannot determine if running in a user namespace"
+  fi
 fi
 
 source kubedock_setup