Repository: opencontainers/runc
File: libcontainer/configs/validate/rootless.go (Go)

Code before:
	}
	// We only require mappings if we are not joining another userns.
	if config.Namespaces.IsPrivate(configs.NEWUSER) {
		if len(config.UIDMappings) == 0 {
			return errors.New("rootless containers requires at least one UID mapping")
		}
		if len(config.GIDMappings) == 0 {
			return errors.New("rootless containers requires at least one GID mapping")
		}
	}
	return nil
}

// rootlessEUIDMount verifies that all mounts have valid uid=/gid= options,
// i.e. their arguments has proper ID mappings.
func rootlessEUIDMount(config *configs.Config) error {
	// XXX: We could whitelist allowed devices at this point, but I'm not
	//      convinced that's a good idea. The kernel is the best arbiter of
	//      access control.

	for _, mount := range config.Mounts {
		// Check that the options list doesn't contain any uid= or gid= entries
		// that don't resolve to root.
		if !strings.Contains(mount.Data, "id=") {
			continue
		}
		for _, opt := range strings.Split(mount.Data, ",") {
			if str, ok := strings.CutPrefix(opt, "uid="); ok {
				uid, err := strconv.Atoi(str)
				if err != nil {
					// Ignore unknown mount options.
					continue
				}
				if _, err := config.HostUID(uid); err != nil {
					return fmt.Errorf("cannot specify %s mount option for rootless container: %w", opt, err)
				}
			} else if str, ok := strings.CutPrefix(opt, "gid="); ok {
				gid, err := strconv.Atoi(str)
				if err != nil {
					// Ignore unknown mount options.
					continue
				}
				if _, err := config.HostGID(gid); err != nil {
					return fmt.Errorf("cannot specify %s mount option for rootless container: %w", opt, err)
				}
			}
		}
	}

	return nil
}

Review comment (bug):
I think the current comment on top of this is not very clear. That explains what the for loop does, so I think that comment outside of the loop seems better. And here I'd explain that we are checking for "id" as a way to see if it containers uid or gid and fail early if it doesn't.

Code after:
	}
	// We only require mappings if we are not joining another userns.
	if config.Namespaces.IsPrivate(configs.NEWUSER) {
		if len(config.UIDMappings) == 0 {
			return errors.New("rootless containers requires at least one UID mapping")
		}
		if len(config.GIDMappings) == 0 {
			return errors.New("rootless containers requires at least one GID mapping")
		}
	}
	return nil
}

// rootlessEUIDMount verifies that all mounts have valid uid=/gid= options,
// i.e. their arguments has proper ID mappings.
func rootlessEUIDMount(config *configs.Config) error {
	// XXX: We could whitelist allowed devices at this point, but I'm not
	//      convinced that's a good idea. The kernel is the best arbiter of
	//      access control.

	// Check that the options list doesn't contain any uid= or gid= entries
	// that don't resolve to root.
	for _, mount := range config.Mounts {
		// Look for a common substring; skip further processing
		// if there can't be any uid= or gid= options.
		if !strings.Contains(mount.Data, "id=") {
			continue
		}
		for _, opt := range strings.Split(mount.Data, ",") {
			if str, ok := strings.CutPrefix(opt, "uid="); ok {
				uid, err := strconv.Atoi(str)
				if err != nil {
					// Ignore unknown mount options.
					continue
				}
				if _, err := config.HostUID(uid); err != nil {
					return fmt.Errorf("cannot specify %s mount option for rootless container: %w", opt, err)
				}
			} else if str, ok := strings.CutPrefix(opt, "gid="); ok {
				gid, err := strconv.Atoi(str)
				if err != nil {
					// Ignore unknown mount options.
					continue
				}
				if _, err := config.HostGID(gid); err != nil {
					return fmt.Errorf("cannot specify %s mount option for rootless container: %w", opt, err)
				}
			}
		}
	}