Re: [gentoo-dev] [RFC] Revisiting GLEP 81 (acct-*) policies (reviews, cross-distro syncing)

[Thomas Deutschmann <whissi@gentoo.org>]

[-- Attachment #1.1: Type: text/plain, Size: 1501 bytes --]

Hi,

On 2019-12-10 12:47, Rich Freeman wrote:
> Having UIDs chosen completely at random seems fairly non-optimal.
> Suppose you're building containers/etc and then bind-mounting in
> persistent storage (/var/lib/mysql and so on).  Wouldn't it be nice if
> the default were that mysql would get the same UID on every build?  I
> guess you could provide an initial /etc/passwd on every fresh build
> but it just seems like an extra step.

While this sounds like a valid problem we are going to address, this
sounds like an analysis without practical experience:

In practice you will *never* assume proper container <> host user
mapping. *Never*. If you do that, you are doing it wrong:

- Container sometimes switch base images. You won't notice that unless
you follow container provider very closely. But you are using container
because you are focused on containerized application, not the container
itself...

- Container start doing things differently. Again, you won't notice, see
above.

- Your host is maybe running some real services. You really don't want
that a container suddenly become able to access these services just
because container <> host mapping has match.

No, when you follow best practice you will always pass user/group or use
other available mapping solutions.

So while it sounds like a valid *goal*, in real world, it isn't.


-- 
Regards,
Thomas Deutschmann / Gentoo Linux Developer
C4DD 695F A713 8F24 2AA1 5638 5849 7EE5 1D5D 74A5


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]