Omit --userns=keep-id for root - #1018
Merged
Merged
Conversation
Christof Marti (chrmarti)
marked this pull request as ready for review
June 5, 2025 12:06
Álvaro Rausell Guiard (AlvaroRausell)
approved these changes
Jun 5, 2025
5 tasks
Ivan Mironov (im-0)
added a commit
to im-0/zed
that referenced
this pull request
May 21, 2026
When `podman` is used and `remoteUser` is `root` (which usually is the case) and user that runs `podman` is not `root` (which usually is the case) following happens: * `podman` creates new user inside the container with the same name and the same UID as user ouside of the container. * Nothing inside the container actually uses this newly created user as `remoteUser` is set to `root`. * `root` inside the container is idmapped to some random sub-UID outside of the container. * All files created inside the container are owned by that bogus sub-UID outside. * This breaks many tools (like git, for example) outside of the devcontainer. Note that `--userns=keep-id` also overrides the effect of `USER` directive from Dockerfile that was used to build the devcontainer image. Not sure that this affects anything though... This patch mirrors devcontainers/cli#1018 from the reference implementation. Also see devcontainers/cli#1004
12 tasks
Ivan Mironov (im-0)
added a commit
to im-0/zed
that referenced
this pull request
May 29, 2026
When `podman` is used and `remoteUser` is `root` (which usually is the case) and user that runs `podman` is not `root` (which usually is the case) following happens: * `podman` creates new user inside the container with the same name and the same UID as user ouside of the container. * Nothing inside the container actually uses this newly created user as `remoteUser` is set to `root`. * `root` inside the container is idmapped to some random sub-UID outside of the container. * All files created inside the container are owned by that bogus sub-UID outside. * This breaks many tools (like git, for example) outside of the devcontainer. Note that `--userns=keep-id` also overrides the effect of `USER` directive from Dockerfile that was used to build the devcontainer image. Not sure that this affects anything though... This patch mirrors devcontainers/cli#1018 from the reference implementation. Also see devcontainers/cli#1004
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1004