Add RunAsGroup support.

Signed-off-by: Lantao Liu <[email protected]>

pkg/server/container_create.go

@@ -17,6 +17,7 @@ limitations under the License.
 package server
 
 import (
+	gocontext "context"
 	"os"
 	"path/filepath"
 	"strings"
@@ -219,12 +220,27 @@ func (c *criService) CreateContainer(ctx context.Context, r *runtime.CreateConta
 	// Set container username. This could only be done by containerd, because it needs
 	// access to the container rootfs. Pass user name to containerd, and let it overwrite
 	// the spec for us.
-	if uid := securityContext.GetRunAsUser(); uid != nil {
+	uid := securityContext.GetRunAsUser()
+	if uid != nil {
 		specOpts = append(specOpts, oci.WithUserID(uint32(uid.GetValue())))
 	}
-	if username := securityContext.GetRunAsUsername(); username != "" {
+	username := securityContext.GetRunAsUsername()
+	if username != "" {
 		specOpts = append(specOpts, oci.WithUsername(username))
 	}
+	gid := securityContext.GetRunAsGroup()
+	if gid != nil {
+		if uid == nil && username == "" {
+			return nil, errors.Errorf("user group %d is specified without user", gid.GetValue())
+		}
+		// TODO(random-liu): Add WithGroupID in containerd client.
+		specOpts = append(specOpts,
+			func(_ gocontext.Context, _ oci.Client, _ *containers.Container, s *runtimespec.Spec) error {
+				s.Process.User.GID = uint32(gid.GetValue())
+				return nil
+			},
+		)
+	}
 
 	apparmorSpecOpts, err := generateApparmorSpecOpts(
 		securityContext.GetApparmorProfile(),

pkg/server/sandbox_run.go

@@ -17,12 +17,14 @@ limitations under the License.
 package server
 
 import (
+	gocontext "context"
 	"fmt"
 	"os"
 	"strings"
 
 	"github.com/containerd/containerd"
 	containerdio "github.com/containerd/containerd/cio"
+	"github.com/containerd/containerd/containers"
 	"github.com/containerd/containerd/errdefs"
 	"github.com/containerd/containerd/linux/runctypes"
 	"github.com/containerd/containerd/oci"
@@ -145,9 +147,23 @@ func (c *criService) RunPodSandbox(ctx context.Context, r *runtime.RunPodSandbox
 	logrus.Debugf("Sandbox container spec: %+v", spec)
 
 	var specOpts []oci.SpecOpts
-	if uid := securityContext.GetRunAsUser(); uid != nil {
+	uid := securityContext.GetRunAsUser()
+	if uid != nil {
 		specOpts = append(specOpts, oci.WithUserID(uint32(uid.GetValue())))
 	}
+	gid := securityContext.GetRunAsGroup()
+	if gid != nil {
+		if uid == nil {
+			return nil, errors.Errorf("user group %d is specified without user", gid.GetValue())
+		}
+		// TODO(random-liu): Add WithGroupID in containerd client.
+		specOpts = append(specOpts,
+			func(_ gocontext.Context, _ oci.Client, _ *containers.Container, s *runtimespec.Spec) error {
+				s.Process.User.GID = uint32(gid.GetValue())
+				return nil
+			},
+		)
+	}
 
 	seccompSpecOpts, err := generateSeccompSpecOpts(
 		securityContext.GetSeccompProfilePath(),