Mapping container user and group IDs to host
An information handling system may include at least one processor and a memory. The information handling system may be configured to: host a container; execute a containerized application within the container, wherein the containerized application executes with privileges associated with a container-internal user; determine an association between the container-internal user and a host user associated with an operating system external to the container, wherein the determining is based on a cache that maintains a mapping between container-internal users and host users; and grant privileges to the containerized application based on the host user.
1. An information handling system comprising:
at least one processor; and
a memory;
wherein the information handling system is configured to:
host a container;
execute a containerized application within the container, wherein the containerized application executes with privileges associated with a container-internal user;
determine an association between the container-internal user and a host user associated with an operating system external to the container, wherein the determining is based on a cache that maintains a mapping between container-internal users and host users; and
grant privileges to the containerized application based on the host user, wherein:
the cache is configured to listen for start and stop events associated with containers that are hosted by the information handling system;
in response to a start event associated with a starting container, the cache is configured to query for a user ID shift associated with the starting container and create a cache entry based on the user ID shift; and
in response to a stop event associated with a stopping container, the cache is configured to remove a cache entry associated with the stopping container.
2. The information handling system of claim 1 , wherein the container-internal user comprises a user identifier (ID) number.
3. The information handling system of claim 2 , wherein the user ID number is a random or pseudorandom number.
4. The information handling system of claim 1 , wherein the host user comprises a user identifier (ID) number that is usable to determine a host username string.
5. The information handling system of claim 1 , wherein the information handling system is a management controller.
6. A method comprising:
an information handling system hosting a container;
the information handling system executing a containerized application within the container, wherein the containerized application executes with privileges associated with a container-internal user;
the information handling system determining an association between the container-internal user and a host user associated with an operating system external to the container, wherein the determining is based on a cache that maintains a mapping between container-internal users and host users; and
the information handling system granting privileges to the containerized application based on the host user, wherein:
the cache listens for start and stop events associated with containers that are hosted by the information handling system;
in response to a start event associated with a starting container, the cache queries for a user ID shift associated with the starting container and create a cache entry based on the user ID shift; and
in response to a stop event associated with a stopping container, the cache removes a cache entry associated with the stopping container.
7. The method of claim 6 , wherein the container-internal user comprises a user identifier (ID) number.
8. The method of claim 7 , wherein the user ID number is a random or pseudorandom number.
9. The method of claim 6 , wherein the host user comprises a user identifier (ID) number that is usable to determine a host username string.
10. An article of manufacture comprising a non-transitory, computer-readable medium having computer-executable instructions thereon that are executable by a processor of an information handling system for:
hosting a container;
executing a containerized application within the container, wherein the containerized application executes with privileges associated with a container-internal user;
determining an association between the container-internal user and a host user associated with an operating system external to the container, wherein the determining is based on a cache that maintains a mapping between container-internal users and host users; and
granting privileges to the containerized application based on the host user, wherein:
the cache is configured to listen for start and stop events associated with containers that are hosted by the information handling system;
in response to a start event associated with a starting container, the cache is configured to query for a user ID shift associated with the starting container and create a cache entry based on the user ID shift; and
in response to a stop event associated with a stopping container, the cache is configured to remove a cache entry associated with the stopping container.
11. The article of claim 10 , wherein the container-internal user comprises a user identifier (ID) number.
12. The article of claim 11 , wherein the user ID number is a random or pseudorandom number.
13. The article of claim 10 , wherein the host user comprises a user identifier (ID) number that is usable to determine a host username string.