{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/19093","labels_url":"https://api.github.com/repos/docker/docker/issues/19093/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/19093/comments","events_url":"https://api.github.com/repos/docker/docker/issues/19093/events","html_url":"https://github.com/docker/docker/pull/19093","id":125005865,"number":19093,"title":"Allow root non-userns metadata backwards compatibility","user":{"login":"estesp","id":1397980,"avatar_url":"https://avatars.githubusercontent.com/u/1397980?v=3","gravatar_id":"","url":"https://api.github.com/users/estesp","html_url":"https://github.com/estesp","followers_url":"https://api.github.com/users/estesp/followers","following_url":"https://api.github.com/users/estesp/following{/other_user}","gists_url":"https://api.github.com/users/estesp/gists{/gist_id}","starred_url":"https://api.github.com/users/estesp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/estesp/subscriptions","organizations_url":"https://api.github.com/users/estesp/orgs","repos_url":"https://api.github.com/users/estesp/repos","events_url":"https://api.github.com/users/estesp/events{/privacy}","received_events_url":"https://api.github.com/users/estesp/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/status/2-code-review","name":"status/2-code-review","color":"fad8c7"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-01-05T16:54:46Z","updated_at":"2016-01-05T19:51:54Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/docker/docker/pulls/19093","html_url":"https://github.com/docker/docker/pull/19093","diff_url":"https://github.com/docker/docker/pull/19093.diff","patch_url":"https://github.com/docker/docker/pull/19093.patch"},"body":"Instead of creating a \"0.0\" subdirectory and migrating graphroot\r\nmetadata into it when user namespaces are available in the daemon\r\n(currently only in experimental), change the graphroot dir permissions\r\nto only include the execute bit for \"other\" users.\r\n\r\nThis allows easy migration to and from user namespaces and will allow\r\neasier integration of user namespace support into the master build.\r\n\r\nDocker-DCO-1.1-Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com> (github: estesp)"},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/169110529","html_url":"https://github.com/docker/docker/pull/19093#issuecomment-169110529","issue_url":"https://api.github.com/repos/docker/docker/issues/19093","id":169110529,"user":{"login":"estesp","id":1397980,"avatar_url":"https://avatars.githubusercontent.com/u/1397980?v=3","gravatar_id":"","url":"https://api.github.com/users/estesp","html_url":"https://github.com/estesp","followers_url":"https://api.github.com/users/estesp/followers","following_url":"https://api.github.com/users/estesp/following{/other_user}","gists_url":"https://api.github.com/users/estesp/gists{/gist_id}","starred_url":"https://api.github.com/users/estesp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/estesp/subscriptions","organizations_url":"https://api.github.com/users/estesp/orgs","repos_url":"https://api.github.com/users/estesp/repos","events_url":"https://api.github.com/users/estesp/events{/privacy}","received_events_url":"https://api.github.com/users/estesp/received_events","type":"User","site_admin":false},"created_at":"2016-01-05T19:51:54Z","updated_at":"2016-01-05T19:51:54Z","body":"Hey @tonistiigi -- my expectation is that we would tackle that larger separation post-1.10, and it would be tied to some other refactoring around combinations of metadata + graphdrivers (like today: \"losing\" containers when switching graphdrivers).  Also, as you note, the concept of per-container userns is really complicated until we have underlying vfs support (e.g. a mount-with-shift-uid/gid option on bind mounting), so at least for 1.10 we can assume it is relegated to a per-daemon instance setting.\r\n\r\nIt may be possible to separate the mount points to somewhere outside of `/var/lib/docker`, but we also have to handle other mounts that exist within that tree as well (like the `/etc/resolv.conf`, `/etc/hostname`, and `/etc/hosts` files). I think with this PR we get the closed access to that root metadata directory, but also allow for non-root access to the subtrees where necessary--which seems like a simpler solution unless we have clear concerns about the `0701` perms."}}