content: Fix typo in userns example
We were showing 4294967295 for the uid_map file, that is how it looks on the host (not the container). Let's fix that. While we are there, let's improve the explanation too. Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>pull/45178/head
parent
2c3ef64fee
commit
b327397fc6
|
@ -82,27 +82,42 @@ to `false`. For example:
|
||||||
kubectl attach -it userns bash
|
kubectl attach -it userns bash
|
||||||
```
|
```
|
||||||
|
|
||||||
And run the command. The output is similar to this:
|
Run this command:
|
||||||
|
|
||||||
```none
|
```shell
|
||||||
readlink /proc/self/ns/user
|
readlink /proc/self/ns/user
|
||||||
user:[4026531837]
|
|
||||||
cat /proc/self/uid_map
|
|
||||||
0 0 4294967295
|
|
||||||
```
|
```
|
||||||
|
|
||||||
Then, open a shell in the host and run the same command.
|
The output is similar to:
|
||||||
|
|
||||||
The output must be different. This means the host and the pod are using a
|
```shell
|
||||||
different user namespace. When user namespaces are not enabled, the host and the
|
user:[4026531837]
|
||||||
pod use the same user namespace.
|
```
|
||||||
|
|
||||||
|
Also run:
|
||||||
|
|
||||||
|
```shell
|
||||||
|
cat /proc/self/uid_map
|
||||||
|
```
|
||||||
|
|
||||||
|
The output is similar to:
|
||||||
|
```shell
|
||||||
|
0 833617920 65536
|
||||||
|
```
|
||||||
|
|
||||||
|
Then, open a shell in the host and run the same commands.
|
||||||
|
|
||||||
|
The `readlink` command shows the user namespace the process is running in. It
|
||||||
|
should be different when it is run on the host and inside the container.
|
||||||
|
|
||||||
|
The last number of the `uid_map` file inside the container must be 65536, on the
|
||||||
|
host it must be a bigger number.
|
||||||
|
|
||||||
If you are running the kubelet inside a user namespace, you need to compare the
|
If you are running the kubelet inside a user namespace, you need to compare the
|
||||||
output from running the command in the pod to the output of running in the host:
|
output from running the command in the pod to the output of running in the host:
|
||||||
|
|
||||||
```none
|
```shell
|
||||||
readlink /proc/$pid/ns/user
|
readlink /proc/$pid/ns/user
|
||||||
user:[4026534732]
|
|
||||||
```
|
```
|
||||||
|
|
||||||
replacing `$pid` with the kubelet PID.
|
replacing `$pid` with the kubelet PID.
|
||||||
|
|
Loading…
Reference in New Issue