Support idmap mounts in snapshotter to avoid expensive chown walk with user namespaces

[arc9693]

What is the version of your Accelerated Container Image

Latest release (issue applies to all current versions)

What would you like to be added?

When --uidmap/--gidmap is passed to containerd, the snapshotter should handle ID mapping itself using Linux idmap mounts (mount_setattr() with MOUNT_ATTR_IDMAP) rather than relying on containerd's fallback chown walk.

Concretely, in pkg/snapshot/overlay.go, Prepare() should:

1. Check for containerd.io/snapshot/uidmapping andcontainerd.io/snapshot/gidmapping labels
2. After mounting the block device, call open_tree() with OPEN_TREE_CLONE to get a detached mount fd
3. Construct a user namespace fd from the mapping labels
4. Call mount_setattr() with MOUNT_ATTR_IDMAP
5. Attach via move_mount()
6. Advertise the idmap capability so containerd skips the chown walk

The kernel already supports idmap mounts on both ext4 and erofs (since 5.12).

Why is this needed for Accelerated Container Image?

Without this, running containers with user namespaces triggers containerd's fallback: a full recursive lchown walk of the entire container rootfs mounted at a temporary path.

This is the same issue described in containerd/containerd#10313 (proxy plugins cannot advertise idmap capability), but the fix lives here in the snapshotter implementation. A similar idmap impl was done for erofs .

Kernel 5.12+ supports idmap mounts on ext4; erofs is also supported.

Are you willing to submit PRs to contribute to this feature?

• Yes, I am willing to implement it.

[hiSandog]

Capability advertisement should be conditional on successfully detecting kernel, filesystem, and mapping support; otherwise containerd may skip its chown fallback and hand back an unusable snapshot. Tests should include multi-range UID/GID mappings, an unsupported kernel/filesystem path that cleanly falls back, and rootless operation where user-namespace FD creation has different constraints. Reusing the mapping parser and conformance cases from containerd's erofs implementation could reduce semantic drift.