api: expose container user/group ID to plugins.

[klihub]

Expose container user, group and supplemental group info to NRI plugins.

[fmuyassarov]

Thanks @klihub, this patch would be really helpful for our use case. In our setup, we inject a custom script through the NRI hook injector plugin to adjust volume mounts. The script’s logic depends on the pod’s user and group (securityContext.runAsUser / runAsGroup), so having that information available makes it possible to handle mounts correctly based on who the container is running as.

[tuminoid]

Lovely, I was not aware it was as simple as exposing the User from the spec.

This is very helpful to us going forward, thank you!

[mikebrow]

Lovely, I was not aware it was as simple as exposing the User from the spec.

This is very helpful to us going forward, thank you!

user placed into the container (oci) spec.. is carefully crafted :-)

[mikebrow]

LGTM

NIT wdyt about also adding umask, username?

is this the first "useful" linux vs windows fields area did we talk about that?

see examples here: https://github.com/opencontainers/runtime-spec/blob/main/config.md#user
not saying I want LinuxUser vs WindowsUser.. just sayin it's worth a discussion.

[klihub]

LGTM

NIT wdyt about also adding umask, username?

@mikebrow Username I was looking at, but since it is Windows only and we don't really have any Windows support at the moment, it was left out. If we start adding Windows support at some point, we can/should add it then.

Umask we can definitely add, now or later, if we find it useful for an external observer or just for the sake of completeness.

is this the first "useful" linux vs windows fields area did we talk about that?
see examples here: https://github.com/opencontainers/runtime-spec/blob/main/config.md#user not saying I want LinuxUser vs WindowsUser.. just sayin it's worth a discussion.

We have deliberately omitted anything windows-specific so far.