Repository: moby/moby
File: contrib/dockerd-rootless-setuptool.sh (Shell)

Code before:
			)
		fi
	fi

	# instruction: RHEL/CentOS 7 requires setting max_user_namespaces
	if [ -f /proc/sys/user/max_user_namespaces ]; then
		if [ "0" = "$(cat /proc/sys/user/max_user_namespaces)" ]; then
			instructions=$(
				cat <<- EOI
					${instructions}
					# Set user.max_user_namespaces
					cat <<EOT > /etc/sysctl.d/51-rootless.conf
					user.max_user_namespaces = 28633
					EOT
					sysctl --system
				EOI
			)
		fi
	fi

	# instructions: validate subuid for current user
	if ! command -v "getsubids" > /dev/null 2>&1; then
		grep -q "^$USERNAME_ESCAPED:\|^$(id -u):" /etc/subuid 2> /dev/null
	else
		getsubids "$USERNAME" > /dev/null 2>&1 || getsubids "$(id -u)" > /dev/null 2>&1
	fi
	if [ $? -ne 0 ]; then
		instructions=$(
			cat <<- EOI
				${instructions}
				# Add subuid entry for ${USERNAME}
				echo "${USERNAME}:100000:65536" >> /etc/subuid
			EOI
		)
	fi

	# instructions: validate subgid for current user
	if ! command -v "getsubids" > /dev/null 2>&1; then
		grep -q "^$USERNAME_ESCAPED:\|^$(id -u):" /etc/subgid 2> /dev/null
	else
		getsubids -g "$USERNAME" > /dev/null 2>&1 || getsubids -g "$(id -u)" > /dev/null 2>&1
	fi
	if [ $? -ne 0 ]; then
		instructions=$(
			cat <<- EOI
				${instructions}
				# Add subgid entry for ${USERNAME}
				echo "${USERNAME}:100000:65536" >> /etc/subgid
			EOI
		)
	fi

Review comment (security):
This would be _really_ a nit, but wondering if it's clearer to swap the condition; i.e., "if `getsubids` is available , then we use  it, otherwise we fall back to parsing it ourselves manually with `grep`"

i.e.  (not tested);

```bash
# instructions: validate subuid for current user
if command -v "getsubids" > /dev/null 2>&1; then
	getsubids "$USERNAME" > /dev/null 2>&1 || getsubids "$(id -u)" > /dev/null 2>&1
else
	grep -q "^$USERNAME_ESCAPED:\|^$(id -u):" /etc/subuid 2> /dev/null
fi
```

Code after:
			)
		fi
	fi

	# instruction: RHEL/CentOS 7 requires setting max_user_namespaces
	if [ -f /proc/sys/user/max_user_namespaces ]; then
		if [ "0" = "$(cat /proc/sys/user/max_user_namespaces)" ]; then
			instructions=$(
				cat <<- EOI
					${instructions}
					# Set user.max_user_namespaces
					cat <<EOT > /etc/sysctl.d/51-rootless.conf
					user.max_user_namespaces = 28633
					EOT
					sysctl --system
				EOI
			)
		fi
	fi

	# instructions: validate subuid for current user
	if command -v "getsubids" > /dev/null 2>&1; then
		getsubids "$USERNAME" > /dev/null 2>&1 || getsubids "$(id -u)" > /dev/null 2>&1
	else
		grep -q "^$USERNAME_ESCAPED:\|^$(id -u):" /etc/subuid 2> /dev/null
	fi
	if [ $? -ne 0 ]; then
		instructions=$(
			cat <<- EOI
				${instructions}
				# Add subuid entry for ${USERNAME}
				echo "${USERNAME}:100000:65536" >> /etc/subuid
			EOI
		)
	fi

	# instructions: validate subgid for current user
	if command -v "getsubids" > /dev/null 2>&1; then
		getsubids -g "$USERNAME" > /dev/null 2>&1 || getsubids -g "$(id -u)" > /dev/null 2>&1
	else
		grep -q "^$USERNAME_ESCAPED:\|^$(id -u):" /etc/subgid 2> /dev/null
	fi
	if [ $? -ne 0 ]; then
		instructions=$(
			cat <<- EOI
				${instructions}
				# Add subgid entry for ${USERNAME}
				echo "${USERNAME}:100000:65536" >> /etc/subgid
			EOI
		)
	fi