Add RunAsGroup support.

Signed-off-by: Lantao Liu <[email protected]>

pkg/server/container_create.go

@@ -17,6 +17,7 @@ limitations under the License.
 package server
 
 import (
+	gocontext "context"
 	"os"
 	"path/filepath"
 	"strings"
@@ -225,6 +226,18 @@ func (c *criService) CreateContainer(ctx context.Context, r *runtime.CreateConta
 	if username := securityContext.GetRunAsUsername(); username != "" {
 		specOpts = append(specOpts, oci.WithUsername(username))
 	}
+	if gid := securityContext.GetRunAsGroup(); gid != nil {
+		if securityContext.GetRunAsUser() == nil || securityContext.GetRunAsUsername() == "" {
+			return nil, errors.New("user group is specified without user")
+		}
+		// TODO(random-liu): Add WithGroupID in containerd client.
+		specOpts = append(specOpts,
+			func(_ gocontext.Context, _ oci.Client, _ *containers.Container, s *runtimespec.Spec) error {
+				s.Process.User.GID = uint32(gid.GetValue())
+				return nil
+			},
+		)
+	}
 
 	apparmorSpecOpts, err := generateApparmorSpecOpts(
 		securityContext.GetApparmorProfile(),

pkg/server/sandbox_run.go

@@ -17,12 +17,14 @@ limitations under the License.
 package server
 
 import (
+	gocontext "context"
 	"fmt"
 	"os"
 	"strings"
 
 	"github.com/containerd/containerd"
 	containerdio "github.com/containerd/containerd/cio"
+	"github.com/containerd/containerd/containers"
 	"github.com/containerd/containerd/errdefs"
 	"github.com/containerd/containerd/linux/runctypes"
 	"github.com/containerd/containerd/oci"
@@ -148,6 +150,18 @@ func (c *criService) RunPodSandbox(ctx context.Context, r *runtime.RunPodSandbox
 	if uid := securityContext.GetRunAsUser(); uid != nil {
 		specOpts = append(specOpts, oci.WithUserID(uint32(uid.GetValue())))
 	}
+	if gid := securityContext.GetRunAsGroup(); gid != nil {
+		if securityContext.GetRunAsUser() == nil {
+			return nil, errors.New("user group is specified without user")
+		}
+		// TODO(random-liu): Add WithGroupID in containerd client.
+		specOpts = append(specOpts,
+			func(_ gocontext.Context, _ oci.Client, _ *containers.Container, s *runtimespec.Spec) error {
+				s.Process.User.GID = uint32(gid.GetValue())
+				return nil
+			},
+		)
+	}
 
 	seccompSpecOpts, err := generateSeccompSpecOpts(
 		securityContext.GetSeccompProfilePath(),