Add user namespace ID mapping support for overlaybd

pkg/snapshot/docker.go

@@ -249,13 +249,13 @@ func (o *snapshotter) RemoveDockerLayer(ctx context.Context, key string, initID
 
 // dockerContainerLayerMount handles Docker container layer mounting logic
 func (o *snapshotter) dockerContainerLayerMount(ctx context.Context,
-	parentInfo snapshots.Info, s storage.Snapshot, parentID string) ([]mount.Mount, error) {
+	parentInfo snapshots.Info, s storage.Snapshot, parentID string, info snapshots.Info) ([]mount.Mount, error) {
 
 	// Get init layer's parent (the image top layer key)
 	initParentKey := parentInfo.Parent
 	if initParentKey == "" {
 		log.G(ctx).Warnf("Mounts: Docker container layer has no init parent, falling back to normal mount")
-		return o.normalOverlayMount(s), nil
+		return o.normalOverlayMount(s, info), nil
 	}
 
 	// Get image top layer info
@@ -296,5 +296,5 @@ func (o *snapshotter) dockerContainerLayerMount(ctx context.Context,
 
 	// Normal image: fall back to standard overlay mount
 	// s.ParentIDs already contains [initLayerID, imageLayer1ID, ...]
-	return o.normalOverlayMount(s), nil
+	return o.normalOverlayMount(s, info), nil
 }

pkg/snapshot/idmap_linux.go

@@ -0,0 +1,56 @@
+//go:build linux
+
+/*
+   Copyright The Accelerated Container Image Authors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package snapshot
+
+import (
+	"github.com/containerd/containerd/v2/core/mount"
+	"github.com/containerd/containerd/v2/plugins/snapshots/overlay/overlayutils"
+	"github.com/containerd/continuity/fs"
+)
+
+// remapSupportProbe is overridden in tests.
+var remapSupportProbe = detectRemapIDsSupport
+
+// detectRemapIDsSupport checks kernel overlay idmap support, userns FD creation,
+// and backing filesystem properties before enabling remapIDs.
+func detectRemapIDsSupport(root string) (bool, error) {
+	ok, err := overlayutils.SupportsIDMappedMounts()
+	if err != nil {
+		return false, err
+	}
+	if !ok {
+		return false, nil
+	}
+
+	supportsDType, err := fs.SupportsDType(root)
+	if err != nil {
+		return false, err
+	}
+	if !supportsDType {
+		return false, nil
+	}
+
+	usernsFd, err := mount.GetUsernsFD("0:65534:1", "0:65534:1")
+	if err != nil {
+		return false, nil
+	}
+	_ = usernsFd.Close()
+
+	return true, nil
+}

pkg/snapshot/idmap_linux_test.go

@@ -0,0 +1,57 @@
+//go:build linux
+
+/*
+   Copyright The Accelerated Container Image Authors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package snapshot
+
+import "testing"
+
+func TestNewSnapshotter_remapIDsRequiresSupportProbe(t *testing.T) {
+	orig := remapSupportProbe
+	t.Cleanup(func() { remapSupportProbe = orig })
+
+	root := t.TempDir()
+	cfg := DefaultBootConfig()
+	cfg.Root = root
+	cfg.RemapIDs = true
+
+	remapSupportProbe = func(string) (bool, error) {
+		return false, nil
+	}
+	sn, err := NewSnapshotter(cfg)
+	if err != nil {
+		t.Fatalf("NewSnapshotter() error: %v", err)
+	}
+	defer sn.Close()
+
+	if sn.(*snapshotter).remapIDs {
+		t.Fatal("remapIDs should stay disabled when support probe fails")
+	}
+
+	remapSupportProbe = func(string) (bool, error) {
+		return true, nil
+	}
+	sn2, err := NewSnapshotter(cfg)
+	if err != nil {
+		t.Fatalf("NewSnapshotter() error: %v", err)
+	}
+	defer sn2.Close()
+
+	if !sn2.(*snapshotter).remapIDs {
+		t.Fatal("remapIDs should be enabled when support probe succeeds")
+	}
+}

pkg/snapshot/idmap_other.go

@@ -0,0 +1,26 @@
+//go:build !linux
+
+/*
+   Copyright The Accelerated Container Image Authors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package snapshot
+
+// remapSupportProbe is overridden in tests on Linux.
+var remapSupportProbe = detectRemapIDsSupport
+
+func detectRemapIDsSupport(string) (bool, error) {
+	return false, nil
+}