Send in the chown()s - systemd containers in user namespaces
summary
Runs systemd inside a single “monolithic” container on Kubernetes/OpenShift by enabling user namespaces so root in-container maps to host uid 200000 with a 65536-size range, and by requiring cgroups v2 plus an OCI/runtime change that chowns the container cgroup so systemd can create scopes. Demonstrates an OpenShift machineconfig, an experimental runc build, and a working demo (systemd + nginx running) — shows the exact pod annotations and host uid mappings needed.
AI-written summary · about
chapters (17)
- 0:00Intro
- 1:18Preliminaries
- 2:51What is a container?
- 4:17Containers on linux
- 5:50Container standards
- 6:56OCI Runtime Specification
- 8:00Kubernetes - container orchestration
- 9:10Kubernetes - terminology
- 13:08Kubernetes - Pod definition
- 14:47OpenShift - terminology
- 15:32OpenShift runtime environment (today)
- 19:16FreelPA on Kubernetes/OpenShift - use cases
- 26:34Runtime user namespaces
- 30:53Runtime - user namespaces - Kubernetes support
- 33:24Runtime - OCI cgroup ownership semantics
- 35:16Runtime - cluster configuration (OCP 4.10) - 3/3
- 43:28Status and future
related talks
40mUser Namespaces in Kubernetes: Security and Flexibility - Pick Both
31mTowards unprivileged container builds
38mUnderstanding root inside and outside a container
22mRun As “Root”, Not Root: User Namespaces In K8s
30mThe Route To Rootless Containers
38mBringing Containers to Enterprise
25mIsolate the Users! Supporting User Namespaces in K8s for Increased Security
40mRootless Containers with Podman