Defines subordinate user-ID ranges that accounts may use in Linux user namespaces. Rootless Podman reads the matching username or UID entry, combines it with the account’s current UID, and builds the container’s user namespace. section 5.4 section 6.2
Format and operational rules:
- Stores colon-delimited fields: login name or UID, starting subordinate UID, and range length; for example, dwalsh:100000:65536. section 5.4
- Keeps subordinate ranges unique per user and separate from system UIDs; overlapping ranges can let processes attack one another through user namespaces. section 5.4
- Supplies the allocation pool for Podman’s --userns=auto feature, which partitions ranges into separate container user namespaces. section 10.3.1
- Requires namespace refresh after changes: podman system migrate restarts the pause process using updated mappings. section 6.2
Automatic container mappings
An entry such as containers:2147483647:2147483648 provides a large allocation pool. Running podman run --userns=auto ubi8 cat /proc/self/uid_map can produce 0 2147483647 1024; --userns=auto:size=5000 requests 5000 UIDs. Podman reclaims ranges when containers are removed. section 10.3.1
Listing 10.5 The contents of the /etc/subuid and /etc/subgid files
# cat /etc/subuid dwalsh:100000:65536 containers:2147483647:2147483648 #1 # cat /etc/subgid dwalsh:100000:65536 containers:2147483647:2147483648 #1
Inspect paired /etc/subuid and /etc/subgid entries used for automatic container user-namespace allocation. section 10.3.1
