From 71cc6c25cbacbd4bc1c56f68e53de5ab27d0fae9 Mon Sep 17 00:00:00 2001 From: Timothy Day Date: Sat, 25 Jul 2026 12:12:06 -0400 Subject: [PATCH] storage/overlay: allow native overlay on Lustre in user namespaces Native overlay is rejected on network file system backing stores when running in a user namespace. However, Lustre can potentially support idmapped mounts, which is enough for native overlay to work rootless. Add an allow list of network file systems with idmapped mounts support, currently just Lustre, and only reject network file systems that are not on it. Not all version of Lustre will support either native overlayfs or ID mapping, so we still need to probe for support at runtime. Signed-off-by: Timothy Day --- storage/drivers/overlay/overlay.go | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/storage/drivers/overlay/overlay.go b/storage/drivers/overlay/overlay.go index 229dbdfbe8..91fea81d48 100644 --- a/storage/drivers/overlay/overlay.go +++ b/storage/drivers/overlay/overlay.go @@ -319,6 +319,19 @@ func isNetworkFileSystem(fsMagic graphdriver.FsMagic) bool { return false } +func isIdmapNetworkFileSystem(fsMagic graphdriver.FsMagic) bool { + switch fsMagic { + // network file systems with idmapped mounts support... + case graphdriver.FsMagicLUSTRE: + return true + } + return false +} + +func isNonIdmapNetworkFileSystem(fsMagic graphdriver.FsMagic) bool { + return isNetworkFileSystem(fsMagic) && !isIdmapNetworkFileSystem(fsMagic) +} + // Init returns the a native diff driver for overlay filesystem. // If overlay filesystem is not supported on the host, a wrapped graphdriver.ErrNotSupported is returned as error. // If an overlay filesystem is not supported over an existing filesystem then a wrapped graphdriver.ErrIncompatibleFS is returned. @@ -390,7 +403,7 @@ func Init(home string, options graphdriver.Options) (graphdriver.Driver, error) case graphdriver.FsMagicAufs, graphdriver.FsMagicOverlay, graphdriver.FsMagicEcryptfs: return nil, fmt.Errorf("'overlay' is not supported over %s, a mount_program is required: %w", backingFs, graphdriver.ErrIncompatibleFS) } - if unshare.IsRootless() && isNetworkFileSystem(fsMagic) { + if unshare.IsRootless() && isNonIdmapNetworkFileSystem(fsMagic) { return nil, fmt.Errorf("a network file system with user namespaces is not supported. Please use a mount_program: %w", graphdriver.ErrIncompatibleFS) } }