Repository: firecracker-microvm/firecracker-containerd
Pull request #364 (2019-12-11 01:00:59)

Add support for UID and GID when Jailing
This adds UID and GID to the jailer config used in the CreateVMRequest
object. This has the caveat that UID and GID cannot be zero and if they
are an error will be returned

Signed-off-by: xibz <impactbchang@gmail.com>

*Issue #, if available:*

*Description of changes:*


By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.


kzys: The change looks good. Can you add some tests that use non-default UID/GID?
xibz: > The change looks good. Can you add some tests that use non-default UID/GID?

@kzys - There is no longer a default UID and GID. However, I did update a test to use `300001` as the UID and GID if that was your concern.
kzys: Ah, right. My concern was (iirc) that we are always using 300000/300000. In theory the test wouldn't catch any issues even if we hard-code them.

The concern is addressed by using 300001 on one of them. So LGTM!

Patch:
diff --git a/proto/firecracker.pb.go b/proto/firecracker.pb.go
index 203046a..41f796f 100644
--- a/proto/firecracker.pb.go
+++ b/proto/firecracker.pb.go
@@ -553,6 +553,8 @@ type JailerConfig struct {
 	// This is formatted as specified in the cpuset man page under "List Format"
 	// http://man7.org/linux/man-pages/man7/cpuset.7.html
 	Mems                 string   `protobuf:"bytes,3,opt,name=Mems,json=mems,proto3" json:"Mems,omitempty"`
+	UID                  uint32   `protobuf:"varint,4,opt,name=UID,json=uID,proto3" json:"UID,omitempty"`
+	GID                  uint32   `protobuf:"varint,5,opt,name=GID,json=gID,proto3" json:"GID,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -603,6 +605,20 @@ func (m *JailerConfig) GetMems() string {
 	return ""
 }
 
+func (m *JailerConfig) GetUID() uint32 {
+	if m != nil {
+		return m.UID
+	}
+	return 0
+}
+
+func (m *JailerConfig) GetGID() uint32 {
+	if m != nil {
+		return m.GID
+	}
+	return 0
+}
+
 func init() {
 	proto.RegisterType((*CreateVMRequest)(nil), "CreateVMRequest")
 	proto.RegisterType((*CreateVMResponse)(nil), "CreateVMResponse")
@@ -619,41 +635,43 @@ func init() {
 func init() { proto.RegisterFile("firecracker.proto", fileDescriptor_a73317e9fb8da571) }
 
 var fileDescriptor_a73317e9fb8da571 = []byte{
-	// 571 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xd4, 0x54, 0xc1, 0x4e, 0xdb, 0x40,
-	0x10, 0x95, 0x21, 0x81, 0x64, 0x0c, 0x09, 0x59, 0x41, 0xbb, 0x42, 0x15, 0xb2, 0x7c, 0x40, 0x51,
-	0x0f, 0x48, 0x85, 0x4b, 0xd5, 0x53, 0x69, 0x52, 0x50, 0x00, 0x23, 0xe4, 0x00, 0x87, 0xde, 0xb6,
-	0xce, 0xd8, 0xb8, 0xb6, 0x77, 0xdd, 0xdd, 0x0d, 0x6d, 0xcf, 0xfd, 0xa3, 0xf6, 0x07, 0x2b, 0x6f,
-	0x8c, 0xe3, 0x44, 0x6d, 0x54, 0xa9, 0xa7, 0x9e, 0xb2, 0xf3, 0xe6, 0xcd, 0xcc, 0xd3, 0xbc, 0x89,
-	0xa1, 0x17, 0xc6, 0x12, 0x03, 0xc9, 0x82, 0x04, 0xe5, 0x51, 0x2e, 0x85, 0x16, 0xfb, 0xb6, 0xfe,
-	0x96, 0xa3, 0x9a, 0x05, 0xee, 0xf7, 0x06, 0x74, 0x07, 0x12, 0x99, 0xc6, 0x7b, 0xcf, 0xc7, 0xcf,
-	0x53, 0x54, 0x9a, 0x10, 0x68, 0xdc, 0x7b, 0xa3, 0x21, 0xb5, 0x1c, 0xab, 0xdf, 0xf6, 0x1b, 0x8f,
-	0xde, 0x68, 0x48, 0xde, 0x02, 0x78, 0x2c, 0x78, 0x88, 0x39, 0x0e, 0xc2, 0x88, 0xae, 0x39, 0x56,
-	0xdf, 0x3e, 0x76, 0x8e, 0xce, 0xe6, 0xcd, 0x9f, 0xb2, 0x82, 0x87, 0x71, 0x34, 0x95, 0x4c, 0xc7,
-	0x82, 0xfb, 0x90, 0x55, 0x35, 0xa4, 0x0f, 0xdd, 0x4b, 0x94, 0x1c, 0xd3, 0x51, 0xc6, 0x22, 0xbc,
-	0x61, 0xfa, 0x81, 0xae, 0x9b, 0x01, 0xdd, 0x64, 0x11, 0x26, 0x07, 0x00, 0x33, 0xe6, 0xa9, 0x8c,
-	0x14, 0x6d, 0x18, 0x12, 0x24, 0x15, 0x42, 0x4e, 0xa0, 0xed, 0x0b, 0xa1, 0x87, 0x32, 0x7e, 0x44,
-	0xda, 0x34, 0x52, 0xf6, 0xea, 0x52, 0xaa, 0xa4, 0xdf, 0x96, 0x4f, 0x4f, 0xf2, 0x1a, 0x6c, 0xf3,
-	0xf0, 0xc4, 0x94, 0x6b, 0x45, 0x37, 0x9c, 0xf5, 0xbe, 0x7d, 0xfc, 0xac, 0x5e, 0x36, 0x4f, 0xfb,
-	0xf6, 0x64, 0x4e, 0x25, 0x17, 0xd0, 0xbb, 0x46, 0xfd, 0x45, 0xc8, 0x64, 0xc4, 0x35, 0xca, 0x90,
-	0x05, 0xa8, 0xe8, 0xa6, 0xa9, 0x7f, 0x51, 0xaf, 0x5f, 0x26, 0xf9, 0x3d, 0xbe, 0x5c, 0x46, 0x0e,
-	0xa1, 0x33, 0x10, 0x5c, 0xb3, 0x98, 0xa3, 0x1c, 0x14, 0xed, 0x69, 0xcb, 0xb1, 0xfa, 0x4d, 0xbf,
-	0x13, 0x2c, 0xa0, 0xe4, 0x0d, 0xd0, 0xf7, 0x5f, 0x63, 0x7d, 0x1a, 0x6a, 0x94, 0xa7, 0x69, 0x7a,
-	0xcb, 0x54, 0xa2, 0x86, 0x98, 0xa2, 0xc6, 0x09, 0x6d, 0x3b, 0x56, 0xbf, 0xe5, 0x53, 0xfc, 0x43,
-	0x9e, 0xbc, 0x82, 0xad, 0x0b, 0x16, 0xa7, 0x45, 0xab, 0xc2, 0x0b, 0x0a, 0x66, 0x43, 0xdb, 0x47,
-	0x75, 0xd0, 0xdf, 0xfa, 0x54, 0x8b, 0xdc, 0x1f, 0x16, 0xec, 0xcc, 0xaf, 0x40, 0xe5, 0x82, 0x2b,
-	0xfc, 0xed, 0x19, 0x1c, 0x00, 0x8c, 0x45, 0x90, 0xa0, 0x36, 0xfe, 0xad, 0xcd, 0xac, 0x51, 0x15,
-	0x42, 0x1c, 0xb0, 0xaf, 0x44, 0x74, 0x16, 0x87, 0xa2, 0x66, 0xb0, 0x9d, 0xce, 0xa1, 0xe2, 0x0c,
-	0x3c, 0xd4, 0x32, 0x0e, 0x54, 0xc5, 0x9a, 0x39, 0xdc, 0xcd, 0x16, 0xe1, 0x62, 0xd6, 0x20, 0x92,
-	0x62, 0x9a, 0x1b, 0x52, 0x73, 0x36, 0x2b, 0xa8, 0x10, 0xf7, 0x12, 0xb6, 0xc7, 0x5a, 0xe4, 0xab,
-	0xef, 0xf6, 0x10, 0x3a, 0xb7, 0x71, 0x86, 0x62, 0xaa, 0xc7, 0x18, 0x08, 0x3e, 0x51, 0x46, 0xf4,
-	0xb6, 0xdf, 0xd1, 0x0b, 0xa8, 0x7b, 0x08, 0x3b, 0xe7, 0xa8, 0xef, 0xbd, 0x11, 0x0f, 0xc5, 0x8a,
-	0x7e, 0xee, 0x4f, 0x0b, 0x7a, 0x35, 0xe2, 0x7f, 0xb2, 0xaa, 0x33, 0xd8, 0x1d, 0x17, 0xa2, 0x3d,
-	0xd4, 0x6c, 0xc2, 0x34, 0x5b, 0xb5, 0xb1, 0x7d, 0x68, 0x3d, 0xd1, 0x4a, 0xd5, 0xad, 0xac, 0x8c,
-	0xdd, 0x11, 0x3c, 0xbf, 0xcb, 0x27, 0xe6, 0x4c, 0xfe, 0xb5, 0xd5, 0x4b, 0xd8, 0x3d, 0xff, 0x4b,
-	0x49, 0xee, 0x09, 0xec, 0x2d, 0x71, 0xcb, 0xbd, 0xd7, 0x07, 0x58, 0x4b, 0x03, 0xae, 0x16, 0xff,
-	0x06, 0x64, 0x17, 0x9a, 0xd7, 0xa8, 0xaf, 0xc7, 0x25, 0xb1, 0xc9, 0x8b, 0xa0, 0x18, 0x37, 0xb8,
-	0xb9, 0x53, 0xa5, 0xbc, 0x46, 0x70, 0x73, 0xa7, 0x0a, 0xcc, 0xc3, 0x4c, 0x95, 0x96, 0x34, 0x32,
-	0xcc, 0xd4, 0xbb, 0xcd, 0x0f, 0x4d, 0xf3, 0xc1, 0xfc, 0xb8, 0x61, 0x7e, 0x4e, 0x7e, 0x05, 0x00,
-	0x00, 0xff, 0xff, 0xa6, 0xb8, 0xfd, 0xa5, 0x59, 0x05, 0x00, 0x00,
+	// 596 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xd4, 0x54, 0x41, 0x6f, 0xd3, 0x4c,
+	0x10, 0x95, 0x9b, 0xa4, 0x4d, 0xc6, 0x4d, 0xd2, 0xac, 0xda, 0xef, 0xb3, 0x2a, 0x54, 0x59, 0x3e,
+	0x54, 0x11, 0x87, 0x4a, 0xb4, 0x17, 0xc4, 0x89, 0x12, 0xd3, 0xca, 0x2d, 0xae, 0xaa, 0x4d, 0xd3,
+	0x03, 0xb7, 0xc5, 0x19, 0xbb, 0x26, 0xf1, 0xae, 0xd9, 0xdd, 0x14, 0x38, 0xf3, 0x8f, 0xe0, 0x0f,
+	0x22, 0x6f, 0x52, 0xc7, 0x89, 0x20, 0x42, 0xe2, 0xc4, 0x29, 0x3b, 0x6f, 0xde, 0xcc, 0x3c, 0xcd,
+	0x9b, 0x18, 0x7a, 0x71, 0x2a, 0x31, 0x92, 0x2c, 0x9a, 0xa0, 0x3c, 0xc9, 0xa5, 0xd0, 0xe2, 0xd0,
+	0xd6, 0x5f, 0x73, 0x54, 0xf3, 0xc0, 0xfb, 0x56, 0x87, 0xee, 0x40, 0x22, 0xd3, 0x78, 0x1f, 0x52,
+	0xfc, 0x34, 0x43, 0xa5, 0x09, 0x81, 0xfa, 0x7d, 0x18, 0xf8, 0x8e, 0xe5, 0x5a, 0xfd, 0x16, 0xad,
+	0x3f, 0x86, 0x81, 0x4f, 0x5e, 0x03, 0x84, 0x2c, 0x7a, 0x48, 0x39, 0x0e, 0xe2, 0xc4, 0xd9, 0x72,
+	0xad, 0xbe, 0x7d, 0xea, 0x9e, 0x5c, 0x2c, 0x9b, 0x3f, 0x65, 0x05, 0x8f, 0xd3, 0x64, 0x26, 0x99,
+	0x4e, 0x05, 0xa7, 0x90, 0x95, 0x35, 0xa4, 0x0f, 0xdd, 0x6b, 0x94, 0x1c, 0xa7, 0x41, 0xc6, 0x12,
+	0xbc, 0x65, 0xfa, 0xc1, 0xa9, 0x99, 0x01, 0xdd, 0xc9, 0x2a, 0x4c, 0x8e, 0x00, 0xe6, 0xcc, 0x73,
+	0x99, 0x28, 0xa7, 0x6e, 0x48, 0x30, 0x29, 0x11, 0x72, 0x06, 0x2d, 0x2a, 0x84, 0xf6, 0x65, 0xfa,
+	0x88, 0x4e, 0xc3, 0x48, 0x39, 0xa8, 0x4a, 0x29, 0x93, 0xb4, 0x25, 0x9f, 0x9e, 0xe4, 0x25, 0xd8,
+	0xe6, 0x11, 0x8a, 0x19, 0xd7, 0xca, 0xd9, 0x76, 0x6b, 0x7d, 0xfb, 0xf4, 0xbf, 0x6a, 0xd9, 0x32,
+	0x4d, 0xed, 0xf1, 0x92, 0x4a, 0xae, 0xa0, 0x77, 0x83, 0xfa, 0xb3, 0x90, 0x93, 0x80, 0x6b, 0x94,
+	0x31, 0x8b, 0x50, 0x39, 0x3b, 0xa6, 0xfe, 0x59, 0xb5, 0x7e, 0x9d, 0x44, 0x7b, 0x7c, 0xbd, 0x8c,
+	0x1c, 0x43, 0x67, 0x20, 0xb8, 0x66, 0x29, 0x47, 0x39, 0x28, 0xda, 0x3b, 0x4d, 0xd7, 0xea, 0x37,
+	0x68, 0x27, 0x5a, 0x41, 0xc9, 0x2b, 0x70, 0xde, 0x7e, 0x49, 0xf5, 0x79, 0xac, 0x51, 0x9e, 0x4f,
+	0xa7, 0x77, 0x4c, 0x4d, 0x94, 0x8f, 0x53, 0xd4, 0x38, 0x76, 0x5a, 0xae, 0xd5, 0x6f, 0x52, 0x07,
+	0x7f, 0x93, 0x27, 0x2f, 0x60, 0xf7, 0x8a, 0xa5, 0xd3, 0xa2, 0x55, 0xe1, 0x85, 0x03, 0x66, 0x43,
+	0xed, 0x93, 0x2a, 0x48, 0x77, 0x3f, 0x56, 0x22, 0xef, 0xbb, 0x05, 0x7b, 0xcb, 0x2b, 0x50, 0xb9,
+	0xe0, 0x0a, 0x7f, 0x79, 0x06, 0x47, 0x00, 0x43, 0x11, 0x4d, 0x50, 0x1b, 0xff, 0xb6, 0xe6, 0xd6,
+	0xa8, 0x12, 0x21, 0x2e, 0xd8, 0xef, 0x44, 0x72, 0x91, 0xc6, 0xa2, 0x62, 0xb0, 0x3d, 0x5d, 0x42,
+	0xc5, 0x19, 0x84, 0xa8, 0x65, 0x1a, 0xa9, 0x92, 0x35, 0x77, 0xb8, 0x9b, 0xad, 0xc2, 0xc5, 0xac,
+	0x41, 0x22, 0xc5, 0x2c, 0x37, 0xa4, 0xc6, 0x7c, 0x56, 0x54, 0x22, 0xde, 0x35, 0xb4, 0x87, 0x5a,
+	0xe4, 0x9b, 0xef, 0xf6, 0x18, 0x3a, 0x77, 0x69, 0x86, 0x62, 0xa6, 0x87, 0x18, 0x09, 0x3e, 0x56,
+	0x46, 0x74, 0x9b, 0x76, 0xf4, 0x0a, 0xea, 0x1d, 0xc3, 0xde, 0x25, 0xea, 0xfb, 0x30, 0xe0, 0xb1,
+	0xd8, 0xd0, 0xcf, 0xfb, 0x61, 0x41, 0xaf, 0x42, 0xfc, 0x47, 0x56, 0x75, 0x01, 0xfb, 0xc3, 0x42,
+	0x74, 0x88, 0x9a, 0x8d, 0x99, 0x66, 0x9b, 0x36, 0x76, 0x08, 0xcd, 0x27, 0xda, 0x42, 0x75, 0x33,
+	0x5b, 0xc4, 0x5e, 0x00, 0xff, 0x8f, 0xf2, 0xb1, 0x39, 0x93, 0xbf, 0x6d, 0xf5, 0x1c, 0xf6, 0x2f,
+	0xff, 0x50, 0x92, 0x77, 0x06, 0x07, 0x6b, 0xdc, 0xc5, 0xde, 0xab, 0x03, 0xac, 0xb5, 0x01, 0xf9,
+	0xea, 0xdf, 0x80, 0xec, 0x43, 0xe3, 0x06, 0xf5, 0xcd, 0x70, 0x41, 0x6c, 0xf0, 0x22, 0x28, 0xc6,
+	0x0d, 0x6e, 0x47, 0x6a, 0x21, 0xaf, 0x1e, 0xdd, 0x8e, 0x54, 0x81, 0x85, 0x98, 0xa9, 0x85, 0x25,
+	0xf5, 0x0c, 0x33, 0x45, 0xf6, 0xa0, 0x36, 0x0a, 0x7c, 0xb3, 0xff, 0x36, 0xad, 0xcd, 0x02, 0xbf,
+	0x40, 0x2e, 0x03, 0xdf, 0x2c, 0xbb, 0x4d, 0x6b, 0x49, 0xe0, 0xbf, 0xd9, 0x79, 0xdf, 0x30, 0x1f,
+	0xd5, 0x0f, 0xdb, 0xe6, 0xe7, 0xec, 0x67, 0x00, 0x00, 0x00, 0xff, 0xff, 0x01, 0x7a, 0xf5, 0xcb,
+	0x7d, 0x05, 0x00, 0x00,
 }
diff --git a/proto/firecracker.proto b/proto/firecracker.proto
index 2fc5f9d..fb0b579 100644
--- a/proto/firecracker.proto
+++ b/proto/firecracker.proto
@@ -72,34 +72,35 @@ message UpdateVMMetadataRequest {
 }
 
 message GetVMMetadataRequest {
-	string VMID = 1;
+    string VMID = 1;
 }
 
 message GetVMMetadataResponse {
-	string Metadata = 1;
+    string Metadata = 1;
 }
 
 message JailerConfig {
     string NetNS = 1;
-
-	// List of the physical numbers of the CPUs on which processes in that
-	// cpuset are allowed to execute.  See List Format below for a description
-	// of the format of cpus.
-	//
-	// The CPUs allowed to a cpuset may be changed by writing a new list to its
-	// cpus file.
-	// Taken from http://man7.org/linux/man-pages/man7/cpuset.7.html
-	//
-	// This is formatted as specified in the cpuset man page under "List Format"
-	// http://man7.org/linux/man-pages/man7/cpuset.7.html
+    // List of the physical numbers of the CPUs on which processes in that
+    // cpuset are allowed to execute.  See List Format below for a description
+    // of the format of cpus.
+    //
+    // The CPUs allowed to a cpuset may be changed by writing a new list to its
+    // cpus file.
+    // Taken from http://man7.org/linux/man-pages/man7/cpuset.7.html
+    //
+    // This is formatted as specified in the cpuset man page under "List Format"
+    // http://man7.org/linux/man-pages/man7/cpuset.7.html
     string CPUs = 2;
-	// List of memory nodes on which processes in this cpuset are allowed to
-	// allocate memory.  See List Format below for a description of the format
-	// of mems.
-	// Taken from http://man7.org/linux/man-pages/man7/cpuset.7.html
-	//
-	// This is formatted as specified in the cpuset man page under "List Format"
-	// http://man7.org/linux/man-pages/man7/cpuset.7.html
+    // List of memory nodes on which processes in this cpuset are allowed to
+    // allocate memory.  See List Format below for a description of the format
+    // of mems.
+    // Taken from http://man7.org/linux/man-pages/man7/cpuset.7.html
+    //
+    // This is formatted as specified in the cpuset man page under "List Format"
+    // http://man7.org/linux/man-pages/man7/cpuset.7.html
     string Mems = 3;
+    uint32 UID = 4;
+    uint32 GID = 5;
 }
 
diff --git a/runtime/jailer.go b/runtime/jailer.go
index 05f55c5..0ef1e0d 100644
--- a/runtime/jailer.go
+++ b/runtime/jailer.go
@@ -15,6 +15,7 @@ package main
 
 import (
 	"context"
+	"fmt"
 	"os"
 
 	"github.com/firecracker-microvm/firecracker-go-sdk"
@@ -31,11 +32,6 @@ const (
 	jailerHandlerName     = "firecracker-containerd-jail-handler"
 	jailerFifoHandlerName = "firecracker-containerd-jail-fifo-handler"
 	rootfsFolder          = "rootfs"
-
-	// TODO evenetually we can get rid of this when we add usernamespaces to
-	// jailing.
-	jailerUID = 300000
-	jailerGID = 300000
 )
 
 var (
@@ -83,6 +79,14 @@ func newJailer(
 		return newNoopJailer(ctx, l, service.shimDir), nil
 	}
 
+	if request.JailerConfig.UID == 0 || request.JailerConfig.GID == 0 {
+		return nil, fmt.Errorf(
+			"attempting to run as %d:%d. 0 cannot be used for the UID or GID",
+			request.JailerConfig.UID,
+			request.JailerConfig.GID,
+		)
+	}
+
 	if err := os.MkdirAll(ociBundlePath, 0700); err != nil {
 		return nil, errors.Wrapf(err, "failed to create oci bundle path: %s", ociBundlePath)
 	}
@@ -91,8 +95,8 @@ func newJailer(
 	config := runcJailerConfig{
 		OCIBundlePath: ociBundlePath,
 		RuncBinPath:   service.config.JailerConfig.RuncBinaryPath,
-		UID:           jailerUID,
-		GID:           jailerGID,
+		UID:           request.JailerConfig.UID,
+		GID:           request.JailerConfig.GID,
 		CPUs:          request.JailerConfig.CPUs,
 		Mems:          request.JailerConfig.Mems,
 	}


Test patch:
diff --git a/runtime/cni_integ_test.go b/runtime/cni_integ_test.go
index 095b6eb..c79298d 100644
--- a/runtime/cni_integ_test.go
+++ b/runtime/cni_integ_test.go
@@ -82,6 +82,8 @@ func TestCNISupport_Isolated(t *testing.T) {
 	}()
 
 	var vmGroup sync.WaitGroup
+	const jailerUID = 300000
+	const jailerGID = 300000
 	for _, vmID := range vmIDs {
 		vmGroup.Add(1)
 		go func(vmID string) {
@@ -113,7 +115,10 @@ func TestCNISupport_Isolated(t *testing.T) {
 						},
 					},
 				}},
-				JailerConfig: &proto.JailerConfig{},
+				JailerConfig: &proto.JailerConfig{
+					UID: jailerUID,
+					GID: jailerGID,
+				},
 			})
 			require.NoError(t, err, "failed to create vm")
 
diff --git a/runtime/jailer_integ_test.go b/runtime/jailer_integ_test.go
index 4f7d8f3..3509577 100644
--- a/runtime/jailer_integ_test.go
+++ b/runtime/jailer_integ_test.go
@@ -36,7 +36,10 @@ func TestJailer_Isolated(t *testing.T) {
 		testJailer(t, nil)
 	})
 	t.Run("With Jailer", func(t *testing.T) {
-		testJailer(t, &proto.JailerConfig{})
+		testJailer(t, &proto.JailerConfig{
+			UID: 300001,
+			GID: 300001,
+		})
 	})
 }
 
@@ -90,6 +93,8 @@ func TestJailerCPUSet_Isolated(t *testing.T) {
 		config := &proto.JailerConfig{
 			CPUs: cset.CPUs(),
 			Mems: cset.Mems(),
+			UID:  300000,
+			GID:  300000,
 		}
 		testJailer(t, config)
 	})
diff --git a/runtime/jailer_test.go b/runtime/jailer_test.go
index c8683e2..d13fba3 100644
--- a/runtime/jailer_test.go
+++ b/runtime/jailer_test.go
@@ -14,10 +14,14 @@
 package main
 
 import (
+	"context"
 	"os"
 	"testing"
 
+	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
+
+	"github.com/firecracker-microvm/firecracker-containerd/proto"
 )
 
 func TestCopyFile_simple(t *testing.T) {
@@ -41,3 +45,11 @@ func TestCopyFile_invalidPaths(t *testing.T) {
 	err := copyFile(srcPath, dstPath, 0600)
 	assert.Error(t, err, "copyFile should have returned an error")
 }
+
+func TestJailer_invalidUIDGID(t *testing.T) {
+	req := proto.CreateVMRequest{
+		JailerConfig: &proto.JailerConfig{},
+	}
+	_, err := newJailer(context.Background(), logrus.NewEntry(logrus.New()), "/foo", &service{}, &req)
+	assert.Error(t, err, "expected invalid uid and gid error, but received none")
+}
diff --git a/runtime/service_integ_test.go b/runtime/service_integ_test.go
index 8c5f976..c4a4b79 100644
--- a/runtime/service_integ_test.go
+++ b/runtime/service_integ_test.go
@@ -248,6 +248,8 @@ func TestMultipleVMs_Isolated(t *testing.T) {
 		{
 			MaxContainers: 3,
 			JailerConfig: &proto.JailerConfig{
+				UID:   300000,
+				GID:   300000,
 				NetNS: netns.Path(),
 			},
 		},
@@ -967,9 +969,12 @@ func TestDriveMount_Isolated(t *testing.T) {
 	}
 
 	_, err = fcClient.CreateVM(ctx, &proto.CreateVMRequest{
-		VMID:         vmID,
-		DriveMounts:  vmDriveMounts,
-		JailerConfig: &proto.JailerConfig{},
+		VMID:        vmID,
+		DriveMounts: vmDriveMounts,
+		JailerConfig: &proto.JailerConfig{
+			UID: 300000,
+			GID: 300000,
+		},
 	})
 	require.NoError(t, err, "failed to create vm")