nix-super/src/libutil/namespaces.hh

#pragma once

namespace nix {

#if __linux__

bool userNamespacesSupported();

bool mountNamespacesSupported();

bool pidNamespacesSupported();

#endif

}
Fix auto-uid-allocation in Docker containers This didn't work because sandboxing doesn't work in Docker. However, the sandboxing check is done lazily - after clone(CLONE_NEWNS) fails, we retry with sandboxing disabled. But at that point, we've already done UID allocation under the assumption that user namespaces are enabled. So let's get rid of the "goto fallback" logic and just detect early whether user / mount namespaces are enabled. This commit also gets rid of a compatibility hack for some ancient Linux kernels (<2.13). 2023-01-25 18:31:27 +02:00			`#pragma once`

			`namespace nix {`

More #ifdef 2023-01-27 17:52:31 +02:00			`#if __linux__`

Fix auto-uid-allocation in Docker containers This didn't work because sandboxing doesn't work in Docker. However, the sandboxing check is done lazily - after clone(CLONE_NEWNS) fails, we retry with sandboxing disabled. But at that point, we've already done UID allocation under the assumption that user namespaces are enabled. So let's get rid of the "goto fallback" logic and just detect early whether user / mount namespaces are enabled. This commit also gets rid of a compatibility hack for some ancient Linux kernels (<2.13). 2023-01-25 18:31:27 +02:00			`bool userNamespacesSupported();`

			`bool mountNamespacesSupported();`

Check whether we can use PID namespaces In unprivileged podman containers, /proc is not fully visible (there are other filesystems mounted on subdirectories of /proc). Therefore we can't mount a new /proc in the sandbox that matches the PID namespace of the sandbox. So this commit automatically disables sandboxing if /proc is not fully visible. 2023-01-27 16:25:56 +02:00			`bool pidNamespacesSupported();`

More #ifdef 2023-01-27 17:52:31 +02:00			`#endif`

Fix auto-uid-allocation in Docker containers This didn't work because sandboxing doesn't work in Docker. However, the sandboxing check is done lazily - after clone(CLONE_NEWNS) fails, we retry with sandboxing disabled. But at that point, we've already done UID allocation under the assumption that user namespaces are enabled. So let's get rid of the "goto fallback" logic and just detect early whether user / mount namespaces are enabled. This commit also gets rid of a compatibility hack for some ancient Linux kernels (<2.13). 2023-01-25 18:31:27 +02:00			`}`