Linux Mailing List

["Konrad Bucheli (PSI)" <konrad.bucheli AT psi.ch>]

Dear Linux Admins

Read on if you ever had to deal with /etc/subuid, else just be assured 
that podman will soon (~10 days) work out of the box.

Maybe you remember we introduced some time ago a central database API 
where you could register your users and would get the respective entry 
in /etc/subuid and /etc/subgid which then would be reserved PSI wide for 
2 years.

Now we would like to introduce a new tool subid-registrator[1] which 
will automatically manage /etc/subuid and /etc/subgid by adding all 
interactive users and, configurable, other required users. As this is 
very handy and allows an "out-of-the-box working" experience with 
rootless podman containers, we want to enable this everywhere on the 
Puppet managed RHEL systems (except RHEL7) by default.

If you currently mange your subids in another way, you should act. You 
can opt-out and disable this feature in Hiera with

​    aaa::subid::automatic: false

else your /etc/subuid and /etc/subgid will then be overwritten with what 
the tool thinks is right.

If you already used the central database API, e.g. with curl, then you 
ideally configure these users in Hiera:

​    aaa::subid:
      - 'svcusr-lx_test'
      - 'lx_test'

Note that this feature of registering a static user list is already 
implemented and rolled out in prod.


The subid-registrator feature is planned to be put into preprod Tue 
18.11.2025 afternoon and shall reach prod a week later on Tue 25.11.2025.

If you want to test it now, please run as user root

    puppet agent -t --environment ​automatic_subid_registration

and if that fails after tomorrow afternoon

​    puppet agent -t --environment preprod

For the full documentation please check out [2].

Feel free to speak up if you have questions or concerns.

[1] https://gitea.psi.ch/linux/subid-registrator
[2] 
https://linux.psi.ch/documentation/admin-guide/container.html#subuids-and-subgids


Kind regards

Konrad


--
Paul Scherrer Institut
Konrad Bucheli
Linux Systems Engineer
Core Linux Research Services
Science IT Infrastructure and Services department (AWI)
OBBA/230
Forschungstrasse 111
5232 Villigen PSI
Switzerland

Phone: +41 56 310 27 24
konrad.bucheli AT psi.ch
www.psi.ch