Merge pull request #303 from TomSweeneyRedHat/dev/tsweeney/uninfo2

Add better error for subuid/subgid with usernamespace 1.13.1-RHEL

Author: rhatdan

man/docker-login.1.md

@@ -14,8 +14,11 @@ docker-login - Log in to a Docker registry.
 # DESCRIPTION
 Log in to a Docker Registry located on the specified
 `SERVER`.  You can specify a URL or a `hostname` for the `SERVER` value. If you
-do not specify a `SERVER`, the command uses Docker's public registry located at
-`https://registry-1.docker.io/` by default.  To get a username/password for Docker's public registry, create an account on Docker Hub.
+do not specify a `SERVER`, the command uses the first value in the field 'registries'
+in the '[registries.search]' table in /etc/containers/registries.conf, and if
+not specified there, Docker's public registry located at `https://registry-1.docker.io/`.
+
+To get a username/password for Docker's public registry, create an account on Docker Hub.
 
 `docker login` requires user to use `sudo` or be `root`, except when:
 
@@ -42,6 +45,10 @@ credentials.  When you log in, the command stores encoded credentials in
 
     # docker login localhost:8080
 
+## Login to Docker Hub overriding /etc/containers/registries.conf
+
+    # docker login docker.io
+
 # See also
 **docker-logout(1)** to log out from a Docker registry.
 
@@ -51,3 +58,4 @@ based on docker.com source material and internal work.
 June 2014, updated by Sven Dowideit <SvenDowideit@home.org.au>
 April 2015, updated by Mary Anthony for v2 <mary@docker.com>
 November 2015, updated by Sally O'Malley <somalley@redhat.com>
+March 2018, updated by Tom Sweeney <tsweeney@redhat.com>

man/dockerd.8.md

@@ -374,12 +374,13 @@ unix://[/path/to/socket] to use.
   Path to the userland proxy binary.
 
 **--userns-remap**=*default*|*uid:gid*|*user:group*|*user*|*uid*
-  Enable user namespaces for containers on the daemon. Specifying "default"
-  will cause a new user and group to be created to handle UID and GID range
-  remapping for the user namespace mappings used for contained processes.
-  Specifying a user (or uid) and optionally a group (or gid) will cause the
+  Enable user namespaces for containers on the daemon. Specifying
+  a user (or uid) and optionally a group (or gid) will cause the
   daemon to lookup the user and group's subordinate ID ranges for use as the
-  user namespace mappings for contained processes.
+  user namespace mappings for contained processes. Specifying "default"
+  will cause a "dockremap" user and group to be created if not already present.
+  The "dockremap" user and group, or the specified uid, gid, user or group must
+  be created in the subuid(5) and subgid(5) files prior to enablement.
 
 # SIGNATURE VERIFICATION
 

pkg/idtools/idtools.go

@@ -121,10 +121,10 @@ func CreateIDMappings(username, groupname string) ([]IDMap, []IDMap, error) {
 		return nil, nil, err
 	}
 	if len(subuidRanges) == 0 {
-		return nil, nil, fmt.Errorf("No subuid ranges found for user %q", username)
+		return nil, nil, fmt.Errorf("No subuid ranges found for user %q in %s", username, subuidFileName)
 	}
 	if len(subgidRanges) == 0 {
-		return nil, nil, fmt.Errorf("No subgid ranges found for group %q", groupname)
+		return nil, nil, fmt.Errorf("No subgid ranges found for group %q in %s", groupname, subgidFileName)
 	}
 
 	return createIDMap(subuidRanges), createIDMap(subgidRanges), nil