{"action":"created","issue":{"url":"https://api.github.com/repos/coreos/rkt/issues/1585","repository_url":"https://api.github.com/repos/coreos/rkt","labels_url":"https://api.github.com/repos/coreos/rkt/issues/1585/labels{/name}","comments_url":"https://api.github.com/repos/coreos/rkt/issues/1585/comments","events_url":"https://api.github.com/repos/coreos/rkt/issues/1585/events","html_url":"https://github.com/coreos/rkt/issues/1585","id":110742738,"number":1585,"title":"rkt: `run` as unprivileged user","user":{"login":"jonboulle","id":2601015,"avatar_url":"https://avatars.githubusercontent.com/u/2601015?v=3","gravatar_id":"","url":"https://api.github.com/users/jonboulle","html_url":"https://github.com/jonboulle","followers_url":"https://api.github.com/users/jonboulle/followers","following_url":"https://api.github.com/users/jonboulle/following{/other_user}","gists_url":"https://api.github.com/users/jonboulle/gists{/gist_id}","starred_url":"https://api.github.com/users/jonboulle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jonboulle/subscriptions","organizations_url":"https://api.github.com/users/jonboulle/orgs","repos_url":"https://api.github.com/users/jonboulle/repos","events_url":"https://api.github.com/users/jonboulle/events{/privacy}","received_events_url":"https://api.github.com/users/jonboulle/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/coreos/rkt/labels/area/security","name":"area/security","color":"bfe5bf"},{"url":"https://api.github.com/repos/coreos/rkt/labels/component/stage1","name":"component/stage1","color":"0052cc"},{"url":"https://api.github.com/repos/coreos/rkt/labels/help%20wanted","name":"help wanted","color":"006b75"},{"url":"https://api.github.com/repos/coreos/rkt/labels/kind/enhancement","name":"kind/enhancement","color":"c7def8"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/coreos/rkt/milestones/22","html_url":"https://github.com/coreos/rkt/milestones/vfuture","labels_url":"https://api.github.com/repos/coreos/rkt/milestones/22/labels","id":1343142,"number":22,"title":"vfuture","description":"Issues to be addressed at an as-now-unspecified point in the future.","creator":{"login":"jonboulle","id":2601015,"avatar_url":"https://avatars.githubusercontent.com/u/2601015?v=3","gravatar_id":"","url":"https://api.github.com/users/jonboulle","html_url":"https://github.com/jonboulle","followers_url":"https://api.github.com/users/jonboulle/followers","following_url":"https://api.github.com/users/jonboulle/following{/other_user}","gists_url":"https://api.github.com/users/jonboulle/gists{/gist_id}","starred_url":"https://api.github.com/users/jonboulle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jonboulle/subscriptions","organizations_url":"https://api.github.com/users/jonboulle/orgs","repos_url":"https://api.github.com/users/jonboulle/repos","events_url":"https://api.github.com/users/jonboulle/events{/privacy}","received_events_url":"https://api.github.com/users/jonboulle/received_events","type":"User","site_admin":false},"open_issues":59,"closed_issues":4,"state":"open","created_at":"2015-10-07T17:26:58Z","updated_at":"2016-02-09T13:11:59Z","due_on":null,"closed_at":null},"comments":13,"created_at":"2015-10-09T21:57:06Z","updated_at":"2016-02-22T14:43:41Z","closed_at":null,"body":"Recent changes to rkt have allowed us to perform a large subset of rkt commands (image list, fetch, etc) as an unprivileged user. It would be nice if it was possible to do ALL rkt operations this way: the elephant in the room is `run`, which historically requires root privileges for several operations (chroot, setting up network namespaces).\r\n\r\nFor the default rkt stage1, this would likely be predicated on `systemd-nspawn` gaining this ability. Relevant systemd thread: http://lists.freedesktop.org/archives/systemd-devel/2015-February/028024.html\r\n\r\nAnother option is to explore using unc to create containers: #1318"},"comment":{"url":"https://api.github.com/repos/coreos/rkt/issues/comments/187211370","html_url":"https://github.com/coreos/rkt/issues/1585#issuecomment-187211370","issue_url":"https://api.github.com/repos/coreos/rkt/issues/1585","id":187211370,"user":{"login":"muayyad-alsadi","id":1312683,"avatar_url":"https://avatars.githubusercontent.com/u/1312683?v=3","gravatar_id":"","url":"https://api.github.com/users/muayyad-alsadi","html_url":"https://github.com/muayyad-alsadi","followers_url":"https://api.github.com/users/muayyad-alsadi/followers","following_url":"https://api.github.com/users/muayyad-alsadi/following{/other_user}","gists_url":"https://api.github.com/users/muayyad-alsadi/gists{/gist_id}","starred_url":"https://api.github.com/users/muayyad-alsadi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/muayyad-alsadi/subscriptions","organizations_url":"https://api.github.com/users/muayyad-alsadi/orgs","repos_url":"https://api.github.com/users/muayyad-alsadi/repos","events_url":"https://api.github.com/users/muayyad-alsadi/events{/privacy}","received_events_url":"https://api.github.com/users/muayyad-alsadi/received_events","type":"User","site_admin":false},"created_at":"2016-02-22T14:43:41Z","updated_at":"2016-02-22T14:43:41Z","body":"> We have this already as idea in #1318\n\nNot just as a limited stage1, but doing things that needs privilege like\nsetting network before changing user and calling unc.\n\nOn Mon, Feb 22, 2016, 11:07 AM Piotr Skamruk <notifications@github.com>\nwrote:\n\n> We have this already as idea in #1318\n> <https://github.com/coreos/rkt/issues/1318>\n>\n> —\n> Reply to this email directly or view it on GitHub\n> <https://github.com/coreos/rkt/issues/1585#issuecomment-187081407>.\n>\n"}}