fix(podman): support keep-id runtime groups

Signed-off-by: Evan Lezar <elezar@nvidia.com>

Author: elezar

crates/openshell-driver-podman/src/client.rs

@@ -21,7 +21,7 @@ use tracing::debug;
 const API_VERSION: &str = "v5.0.0";
 
 /// Timeout for individual Podman API calls.
-const API_TIMEOUT: Duration = Duration::from_secs(30);
+const API_TIMEOUT: Duration = Duration::from_secs(120);
 
 /// Maximum allowed size for the event stream line buffer (1 MB).
 const MAX_EVENT_BUFFER: usize = 1_048_576;

crates/openshell-driver-podman/src/driver.rs

@@ -972,6 +972,7 @@ impl PodmanComputeDriver {
                         &workload_id,
                         &uuid::Uuid::new_v4().to_string(),
                         &identity,
+                        self.config.userns.as_deref(),
                         child_env,
                         &launch_authentication,
                     )?;
@@ -1313,6 +1314,7 @@ impl PodmanComputeDriver {
                 &container_id,
                 generation.as_str(),
                 &restart_metadata.workload_identity,
+                self.config.userns.as_deref(),
                 restart_metadata.child_env,
                 &launch_authentication,
             )?;

crates/openshell-driver-podman/src/isolation.rs

@@ -25,6 +25,7 @@ pub const BOOTSTRAP_PATH: &str = "/.openshell/channel/sandbox/bootstrap.json";
 pub const RUNTIME_DESCRIPTOR_PATH: &str = "/.openshell/supervisor/runtime-descriptor.json";
 pub const AUTH_BUNDLE_PATH: &str = "/.openshell/supervisor/auth.json";
 pub const RESTART_METADATA_PATH: &str = "/.openshell/supervisor/restart-metadata.json";
+pub const USERNS_RESOURCE_CLAIM: &str = "podman.userns";
 const SOCKET_PATH: &str = "/.openshell/channel/sandbox/control.sock";
 
 pub fn supervisor_name(id: &str) -> String {
@@ -159,19 +160,23 @@ pub fn bootstrap_archives(
     container_id: &str,
     generation: &str,
     identity: &ResolvedWorkloadIdentity,
+    userns: Option<&str>,
     child_env: HashMap<String, String>,
     launch_authentication: &openshell_core::jwt::SandboxLaunchAuthentication,
 ) -> Result<BootstrapArchives, ComputeDriverError> {
     launch_authentication.validate().map_err(invalid)?;
     let session_id = launch_authentication.supervisor.session_id;
     let tls = generate_sandbox_tls_material(session_id).map_err(invalid)?;
-    let resource_claims = BTreeMap::from([
+    let mut resource_claims = BTreeMap::from([
         ("podman.container_id".into(), container_id.into()),
         (
             "podman.image_identity".into(),
             identity.resource_digest.clone(),
         ),
     ]);
+    if userns.is_some_and(|mode| mode.split(':').next() == Some("keep-id")) {
+        resource_claims.insert(USERNS_RESOURCE_CLAIM.into(), "keep-id".into());
+    }
     let driver_fence = DriverFenceEvidence::Podman {
         container_id: container_id.into(),
         network_mode: "none".into(),
@@ -434,6 +439,7 @@ mod tests {
             "container",
             "generation-1",
             &identity,
+            None,
             child_env.clone(),
             &authentication,
         )

crates/openshell-sandbox/src/boundary_server.rs

@@ -390,6 +390,10 @@ mod linux {
             .resource_claims
             .get(GPU_RESOURCE_CLAIM)
             .is_some_and(|value| value == "true")
+            || config
+                .resource_claims
+                .get("podman.userns")
+                .is_some_and(|value| value == "keep-id")
     }
 
     fn supplementary_groups_match(actual: &[u32], expected: &[u32], allow_extra: bool) -> bool {
@@ -3824,6 +3828,33 @@ mod linux {
             assert!(!supplementary_groups_match(&[44, 992], &[1001], true));
         }
 
+        #[test]
+        fn podman_keep_id_allows_runtime_supplementary_groups() {
+            let config = BoundaryConfig {
+                boundary_id: "sandbox-1".to_string(),
+                generation: "generation-1".to_string(),
+                session_id: test_session_id(),
+                session_rotation: openshell_core::jwt::SessionRotation::new(1)
+                    .expect("session rotation"),
+                auth_epoch: CredentialEpoch::new(1).expect("auth epoch"),
+                gateway_id: "test-gateway".to_string(),
+                verification_keys: vec![],
+                listener: BoundaryListenerConfig::Vsock {
+                    control_port: 5500,
+                    tls: placeholder_server_tls(),
+                },
+                resource_claims: std::collections::BTreeMap::from([(
+                    "podman.userns".to_string(),
+                    "keep-id".to_string(),
+                )]),
+                resource_claim_files: std::collections::BTreeMap::new(),
+                workload_identity: test_workload_identity(),
+                driver_fence: test_driver_fence(),
+                child_env: std::collections::HashMap::new(),
+            };
+            assert!(allows_runtime_supplementary_groups(&config));
+        }
+
         #[test]
         fn control_connection_slots_bound_authenticated_sessions() {
             let active = Arc::new(AtomicUsize::new(MAX_CONTROL_CONNECTIONS - 1));