Arch Linux

Description: Improvement: optionally set capabilities for unprivileged containers (in post-install)

Additional info:

When minio is run in an unprivileged LXD container the following needs to be set to run
the service as the unprivileged minio user:

setcap cap_net_bind_service=+ep /usr/bin/minio

this could be set in a post-install script if a uid mapping is detected:
------------------------------------------------------------------------

#!/bin/sh

uid_map=$(head -1 /proc/self/uid_map)
host_uid=$(echo $uid_map | awk '{print $1}')
ctr_uid=$(echo $uid_map | awk '{print $2}')

if [ $host_uid -ne $ctr_uid ]; then
setcap cap_net_bind_service=+ep /usr/bin/minio
fi

--------------------------------------------------

I've attached a screenshot showing the uid_map of an Arch LXD container
& a bare metal Arch system.