Struct UserNamespaceConfig 

pub struct UserNamespaceConfig {
    pub uid_mappings: Vec<IdMapping>,
    pub gid_mappings: Vec<IdMapping>,
}

User namespace configuration

Fields

uid_mappings: Vec<IdMapping>

UID mappings

gid_mappings: Vec<IdMapping>

GID mappings

Implementations

impl UserNamespaceConfig

pub fn rootless() -> Self

Create config for rootless mode

Maps container root (UID/GID 0) to current user. This is the historic Nucleus rootless mapping (“nomap”): only container uid 0 is usable, so workloads that refuse euid 0 (e.g. PostgreSQL) cannot run. Prefer UserNamespaceConfig::keep_id or UserNamespaceConfig::subuid_auto when /etc/subuid is configured.

pub fn keep_id() -> Result<Self>

Rootless “keep-id” mapping (Podman --userns=keep-id).

Maps the calling user’s own uid/gid to itself inside the namespace, and maps container root (0) to the start of the delegated subuid/subgid range. Because the workload keeps the host uid, bind-mounted host files owned by the user are directly accessible with no ownership shifting — this is the recommended rootless mode for workloads like PostgreSQL that (a) refuse euid 0 and (b) read user-owned bind mounts.

Requires /etc/subuid and /etc/subgid for the calling user.

pub fn subuid_auto() -> Result<Self>

Rootless “auto” mapping (Podman/Docker rootless default).

Maps container root (0) to the calling user, and container 1..N to the delegated subuid/subgid range. Workloads therefore run as their image / configured uid (e.g. 999 for the Postgres image) mapped into the subuid range. Unlike Self::keep_id, bind-mounted host files owned by the user are not automatically accessible to a non-zero workload uid — the caller must align ownership (as with Docker/Podman rootless bind mounts).

pub fn from_map_specs( uid_specs: &[String], gid_specs: &[String], ) -> Result<Self>

Build a mapping from explicit container:host:size triplets (Podman --uidmap / Docker --userns-uid-map syntax).

pub fn for_unprivileged_rootless(workload_uid: Option<u32>) -> Self

Choose a rootless mapping for the current (unprivileged) process.

When the workload requests a non-zero uid (--user N), the historic rootless() mapping (only container 0) would make that uid unmappable. If /etc/subuid is configured, transparently pick keep_id so the requested uid maps to the caller’s own uid; otherwise fall back to the trivial rootless() mapping (the caller will get a clear validation error pointing at /etc/subuid).

pub fn needs_setuid_helper(&self) -> bool

Whether the configured mapping can be written to /proc/<pid>/{u,g}id_map by an unprivileged process directly. The kernel only permits this for the trivial single 0 <own> 1 mapping; anything else requires the setuid newuidmap/newgidmap helpers (which authorize via /etc/subuid).

pub fn root_remapped() -> Self

Create config for root-remapped mode

When running as host root, maps container UID 0 to a high unprivileged UID range so a container escape does not yield real host root.

pub fn custom( uid_mappings: Vec<IdMapping>, gid_mappings: Vec<IdMapping>, ) -> Result<Self>

Create config with custom mappings (validated)

Trait Implementations

impl Clone for UserNamespaceConfig

fn clone(&self) -> UserNamespaceConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for UserNamespaceConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.