EOS CI image has UIDs > 65536
In the EOS CI images:
[root@eos-mgm-1 /]# id eosarchi
uid=72811(eosarchi) gid=993(eosarchi) groups=993(eosarchi)
[root@eos-mgm-1 /]# find / -user eosarchi
/etc/sysconfig/eosarchived_env
/etc/eosarchived.conf
/usr/lib/systemd/system/eosarchived.service
/usr/lib/python3.9/site-packages/eosarch
/usr/lib/python3.9/site-packages/eosarch/__init__.py
/usr/lib/python3.9/site-packages/eosarch/archivefile.py
/usr/lib/python3.9/site-packages/eosarch/asynchandler.py
/usr/lib/python3.9/site-packages/eosarch/configuration.py
/usr/lib/python3.9/site-packages/eosarch/exceptions.py
/usr/lib/python3.9/site-packages/eosarch/processinfo.py
/usr/lib/python3.9/site-packages/eosarch/transfer.py
/usr/lib/python3.9/site-packages/eosarch/utils.py
/usr/lib/python3.9/site-packages/opt-eos-xrootd.pth
/usr/bin/eosarch_reconstruct.py
/usr/bin/eosarch_run.py
/usr/bin/eosarchived.py
This account has a UID > 65536, which makes the container images not amenable to running as an unprivileged user, e.g. with podman. This is because the typical default setup is to have 65536 sub-IDs allocated for user namespaces (and that is already a very large ID space to allocate, some container images limit their ID usage to 1024 IDs).
$ cat /etc/subuid
fedora:100000:65536
This can lead to errors such as eos/eos-charts#107 (comment 9280439), meaning that EOS can not run on a KIND cluster out of the box.
This UID comes from: https://gitlab.cern.ch/dss/eos/-/blob/master/eos.spec.in?ref_type=heads#L814
@esindril would it be possible to use a smaller UID for the eosarchi user, to support running EOS on KIND/podman? Thanks!
Edited by Ryan Taylor