Skip to content

Commit 0a50ba6

Browse files
committed
config-linux: Make "don't modify filesystem permissions" generic
The user-namespace restriction isn't about the root filesystem in particular. For example, if you bind mount in a second filesystem, the runtime shouldn't adjust ownership on that filesystem either. I've also adjusted the old "permissions" to "ownership", since that more clearly reflects the fields (user and group) that you would modify if you wanted to adjust for user namespacing. Signed-off-by: W. Trevor King <[email protected]>
1 parent 87f6ba4 commit 0a50ba6

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

config-linux.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ Also, when a path is specified, a runtime MUST assume that the setup for that pa
8888
```
8989

9090
uid/gid mappings describe the user namespace mappings from the host to the container.
91-
The mappings represent how the bundle `rootfs` expects the user namespace to be setup and the runtime SHOULD NOT modify the permissions on the rootfs to realize the mapping.
91+
The runtime SHOULD NOT modify the ownership of referenced filesystems to realize the mapping.
9292
*hostID* is the starting uid/gid on the host to be mapped to *containerID* which is the starting uid/gid in the container and *size* refers to the number of ids to be mapped.
9393
There is a limit of 5 mappings which is the Linux kernel hard limit.
9494

0 commit comments

Comments
 (0)