Description

Trying to start a Kubernetes container with userns using the nginx official image, fails. This was reported here: containerd/containerd#10598 by @ctrox.

@ctrox also found a workaround: add "tty: true" to the kubernetes pod makes it work.

And a simpler repro: just a container with userns that runs "cat /dev/stderr" also fails with permission denied.

I guess you need to run detached (as containerd does) to hit this, otherwise it uses your shell and that probably works.

@ctrox thanks for the great bug report!

Sorry the brevity, I'm sick ATM. I'll add more info when I recover

Steps to reproduce the issue

No response

Describe the results you received and expected

Works, as without user namespaces.

What version of runc are you using?

runc 1.2.0

Host OS information

No response

Host kernel information

No response