allow file-descriptor passing from podman-exec

[chergert]

/kind feature

Description

Add support for passing file-descriptors across podman exec execution boundary.

I've started integrating some basic podman support into GNOME Builder using our native container abstractions (like we do for flatpak). One thing that makes this possible with flatpak is that we can pass file descriptors across the execution boundary. That way, I can feed a PTY for the debugger inferior to tooling like gdb while using the controlling PTY to control gdb itself.

I've looked at calling runc directly using --preserve-fds, but that would mean duplicating a lot of what podman already does for us.

[rhatdan]

So you want to add a --preserve-fds flag to podman run/create?

[debarshiray]

So you want to add a --preserve-fds flag to podman run/create?

Yes, but to podman run/exec, if I understood @chergert properly.

[rhatdan]

@mheon @giuseppe WDYT?

[giuseppe]

It is an useful idea.

The only issue is that we are already passing down a bunch of fds, so we would need to properly reassign them.

[mheon]

The Flatpak way of doing this is --forward-fd=FD, which seems like a sane enough interface... I don't see many people using this, but the exec command isn't very cluttered right now, so I'm not opposed to adding it.

[rhatdan]

@giuseppe Do you have time to work on it?

[rhatdan]

There are probably going to be SELinux issues with this. SELinux should block the use of these fd's being passed in.

[rhatdan]

Unless they are labeled with something like
system_u:system_r:container_t:s0

[rhatdan]

@giuseppe Could you take a look at this?

[giuseppe]

PR for runc here: opencontainers/runc#1995

PR for libpod here: #2426