Podman fix: derive `--userns=keep-id` mapping from the remote user's actual UID/GID
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 58/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- typescript
Research direction
Start by tracing where the Dev Containers CLI injects the plain --userns=keep-id argument and how it resolves the remoteUser inside the image. Verify the generated Podman arguments for a high host UID/GID and for matching host and container IDs, with both cases preserving the expected workspace permissions.
Written by the indexing model from the issue text.
Description
The problem
When running a dev container with rootless podman, the Dev Containers CLI injects a plain --userns=keep-id flag, which maps the host user id to the same UID number inside the container.
This breaks for high/out-of-range host UIDs (e.g. AD/SSSD users which have values like1400601154, which are not valid inside the container (they are out of range as the containers are typically given a 0-65535 range via subuid/subgid mapping). As a result the mapping fails silently and the container's vscode user remains at UID 1000, not matching the host user, and causing Permission denied on the workspace bind mount).
Current workaround
The current workaround is a fragile manual runArgs entry (--userns=keep-id:uid=1000,gid=1000). Since the host UID is unmappable to itself, we keep the 1000 id inside the container and map the host user to that. This allows one to use podman on Linux boxes with AD and thus high uid/gid combinations, as it removes the requirement for the exact host UID to be inside the container's range.
The request for improvement
Instead of injecting a plain --userns=keep-id, the CLI should resolve the remoteUser's actual UID/GID in the image and emit --userns=keep-id:uid=<remote-uid>,gid=<remote-gid>. This fixes the high-UID case with no regressions: when the host UID already equals the container user's UID, keep-id:uid=X,gid=X produces the identical mapping to plain keep-id, so existing setups are unaffected.
- Dominant language
- TypeScript
- Stars
- 3k
- Forks
- 461
- Avg merge
- 18m
- Merged PRs (30d)
- 5
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from devcontainers/cli
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
devcontainers/cli#1203 ·
-
Difficulty 1/5 1-3 hours Newbie friendliness 68/100
devcontainers/cli#1178 · 1 comment ·
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
devcontainers/cli#1308 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 78/100
devcontainers/cli#1307 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 55/100
devcontainers/cli#1305 ·
All issues in devcontainers/cli
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
safetrustcr/dApp-SafeTrust#426 ·
-
area:workflow bug ready-for-agent
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
fil-donadoni/tolaria#4409 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Fission-AI/OpenSpec#1960 ·
-
Add dependabot Open
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
corsairdev/corsair#1764 ·