2a0c446866
When building images in a user-namespaced container, v3 capabilities are
stored including the root UID of the creator of the user-namespace.
This UID does not make sense outside the build environment however. If
the image is run in a non-user-namespaced runtime, or if a user-namespaced
runtime uses a different UID, the capabilities requested by the effective
bit will not be honoured by `execve(2)` due to this mismatch.
Instead, we convert v3 capabilities to v2, dropping the root UID on the
fly.
Signed-off-by: Eric Mountain <eric.mountain@datadoghq.com>
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| testdata | ||
| build_cgroupns_linux_test.go | ||
| build_session_test.go | ||
| build_squash_test.go | ||
| build_test.go | ||
| build_userns_linux_test.go | ||
| main_test.go | ||