How to work with files which belong to the subuser namespace under Linux?

Question

I am using docker on ubuntu 16.04 with user id mapping (user namepsaces) enabled. I have following settings:

/etc/passwd myusername:x:1000:1000:,,,:/home/myusername:/bin/bash

/etc/subuid myusername:100000:65536

/etc/subguid myusername:100000:65536

When I start a container the files are being correctly mapped from 0 (root) to my subuid 100000.

host -rw-r--r-- 1 100000 100000 0 Mär 30 13:05 testfile

container rw-r--r-- 1 root root 0 Mar 30 13:05 testfile

I can read the file on the host machine, but I cannot edit it. My assumption was that 100000 is "my" subuid, so I can edit those files. How can I achieve that those files are accessible by myusername without sudo?

Answer 1

I'm not sure how to fix this with user namespace mapping but you can work around it with ACL's.

If you don't mind leaking some UID information into the container, you can add an ACL to the directory for your host user. ACL's sit on top of the standard POSIX permissions.

To set a default ACL on the parent directory, that new entries inherit:

setfacl -d -m u:1000:rwx volume_dir/

To set the ACL on all existing files and directories in a directory:

setfacl -R -m u:1000:rwX volume_dir/

The X auto detects directories and sets them to executable but skips making files executable. Unfortunately this type of differentiation is not available on the default ACL.