Lennart Poettering
2635b5dc4a
So far nspawn supported unpriv containers only if backed by a DDI. This adds dir-based unpriv containers too. To make this work this introduces a new UID concept to systemd: the "foreign UID range". This is a high UID range of size 64K. The idea is that disk images that are "foreign" to the local system can use that, and when a container or similar is invoked from it, a transiently allocated dynamic UID range is mapped from that foreign UID range via id mapped mounts. This means the fully dynamic, transient UID ranges never hit the disk, which should vastly simplify management, and does not require that uid "subranges" are persistently delegated to any users. The mountfsd daemon gained a new method call for acquiring an idmapped mount fd for an mount tree owned by the foreign UID range. Access is permitted to unpriv clients – as long as the referenced inode is located within a dir owned by client's own uid range.
System and Service Manager
Details
Most documentation is available on systemd's web site.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list, join our IRC channel #systemd on libera.chat or Matrix channel
Stable branches with backported patches are available in the stable repo.
We have a security bug bounty program sponsored by the Sovereign Tech Fund hosted on YesWeHack
Repositories with distribution packages built from git main are available on OBS