Post #675663
2026-02-27 18:41 UTC
@pid_eins started his series again so let me add an entry. In v260, I've added support for delegating UID ranges to containers from nsresourced and mountfsd. This allows nested containers to acquire their own UID ranges from nsresourced without needing to set up /etc/subuid inside the container. You can also easily enter a user namespace now with the foreign UID range mapped in to create container rootfs trees for use with transient UID ranges from nsresourced.
#systemd260 #systemd
Replies (1)
-
@daandemeyer@mastodon.social 2026-02-27 18:45
This is hooked up into nspawn via a new --private-users-delegate= switch to delegate N uid ranges into the nspawn container. With this we're very close to making nested nspawn work but this requires a few more changes to nspawn which will come in 261. I'm also hooking this up to mkosi so we can finally boot VMs and containers from directories unprivileged and without /etc/subuid. vmspawn also learned to boot from a directory using nsresourced in v260.