Skip to content

kernel: enable idmapped mounts on overlayfs for sysbox #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kvinwang wants to merge 1 commit into
base: main
Choose a base branch
from
Open

kernel: enable idmapped mounts on overlayfs for sysbox #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 36 additions & 0 deletions meta-dstack/recipes-kernel/linux/files/0002-overlayfs-enable-idmapped-mounts.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Kevin Wang <kvin@phala.network>
Date: Tue, 4 Mar 2026 00:00:00 +0000
Subject: [PATCH] overlayfs: add FS_ALLOW_IDMAP to enable idmapped mounts

Overlayfs already has comprehensive support for idmapped mounts through
its handling of idmapped layers (since 5.19), but it is missing the
FS_ALLOW_IDMAP flag on ovl_fs_type. Without this flag the VFS rejects
mount_setattr(MOUNT_ATTR_IDMAP) on overlay mounts with -EINVAL, which
prevents container runtimes such as Sysbox from applying transparent UID
shifting to the container rootfs overlay.

Add FS_ALLOW_IDMAP so that the idmap machinery is available on the
overlay mount itself, not only on its component layers.

Upstream-Status: Submitted [https://lkml.org/lkml/2025/8/15/1218]
Signed-off-by: Kevin Wang <kvin@phala.network>
---
fs/overlayfs/super.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index 1a530c5a4e02..b7d8e5c91234 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -1484,7 +1484,7 @@ struct file_system_type ovl_fs_type = {
.name = "overlay",
.init_fs_context = ovl_init_fs_context,
.parameters = ovl_parameter_spec,
- .fs_flags = FS_USERNS_MOUNT,
+ .fs_flags = FS_USERNS_MOUNT | FS_ALLOW_IDMAP,
.kill_sb = kill_anon_super,
};
MODULE_ALIAS_FS("overlay");
--
2.46.0
1 change: 1 addition & 0 deletions meta-dstack/recipes-kernel/linux/linux-custom_6.17.6.bb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ DEPENDS += "libyaml-native openssl-native util-linux-native elfutils-native"
SRC_URI = "https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-${PV}.tar.xz;downloadfilename=linux-${PV}.tar.xz \
file://defconfig \
file://0001-x86-tdx-select-dma-direct-remap.patch \
file://0002-overlayfs-enable-idmapped-mounts.patch \
"

SRC_URI[sha256sum] = "8ecfbc6b693448abb46144a8d04d1e1631639c7661c1088425a2e5406f13c69c"
Expand Down
1 change: 1 addition & 0 deletions meta-dstack/recipes-kernel/linux/linux-custom_6.18.7.bb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ DEPENDS += "libyaml-native openssl-native util-linux-native elfutils-native"
SRC_URI = "https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-${PV}.tar.xz;downloadfilename=linux-${PV}.tar.xz \
file://defconfig \
file://0001-x86-tdx-select-dma-direct-remap.patch \
file://0002-overlayfs-enable-idmapped-mounts.patch \
"

SRC_URI[sha256sum] = "b726a4d15cf9ae06219b56d87820776e34d89fbc137e55fb54a9b9c3015b8f1e"
Expand Down
3 changes: 2 additions & 1 deletion meta-dstack/recipes-kernel/linux/linux-yocto%.bbappend
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,8 @@ SRC_URI += "file://dstack-docker.cfg \
file://dstack-sysbox.cfg \
file://dstack-sysbox.scc \
file://dstack.cfg \
file://dstack.scc"
file://dstack.scc \
file://0002-overlayfs-enable-idmapped-mounts.patch"

KERNEL_FEATURES:append = " features/cgroups/cgroups.scc \
features/overlayfs/overlayfs.scc \
Expand Down