User namespace over 9p

[Alin Dobre <alin.dobre@elastichosts.com>]

Hello,

Continuing the struggle to run containers over the 9p filesystem I am
now running into another issue.

A simple container with user namespace mapping UID -2 (4294967294) to
root can run a container image found in /tmp/src without any problems.
When I export that /tmp/src path via 9p and mount it in /tmp/dst,
running the same container over /tmp/dst fails to allow chown (and
probably chmod) system calls to be successful. This happens because 9p
considers that the UID which runs the system calls is actually -2, but
it's actually 0, because the lchown system call is run inside the
namespace, not outside it. So, 9p should consider that the UID which
does the system call is root.

Do I understand this correctly as a problem, or does it work as
intended? If latter, do you have any insights on how to achieve running
containers in this scenario?

Cheers,
Alin.