Function startProcessWithUserNamespace

pkg/sys/unshare_linux.go:125–146

startProcessWithUserNamespace starts a ptraced dummy process to create a user namespace. It runs a goroutine on a single thread as targetHostUID when creating the process and user namespace, ensuring that the kernel attributes user limits to targetHostUID and not containerd's user. On success it ret

(targetHostUID int, unshareFlags uintptr, uidMaps, gidMaps []syscall.SysProcIDMap)

// attributes user limits to targetHostUID and not containerd's user. On success
// it returns the pid, pidfd and no error.
func startProcessWithUserNamespace(targetHostUID int, unshareFlags uintptr, uidMaps, gidMaps []syscall.SysProcIDMap) (int, int, error) {
	type result struct {
		pid   int
		pidfd int
		err   error
	}
	resultChan := make(chan result)

	go func() {
		runtime.LockOSThread()
		pid, pidfd, err := startProcessWithUsernsLocked(targetHostUID, unshareFlags, uidMaps, gidMaps)

		// If this errored out let the go runtime reap the thread by not unlocking
		if err == nil {
			runtime.UnlockOSThread()
		}
		resultChan <- result{pid, pidfd, err}
	}()

	res := <-resultChan
	return res.pid, res.pidfd, res.err
}

// startProcessWithUsernsLocked expects the os thread to be locked already. It does
//  1. setresuid() to the targetHostUID user to attribute further user namespace creations to it