[1.3] Implement user namespaces

[alban]

This is the containerd/cri implementation for the Kubernetes Node-Level User Namespaces Design Proposal.

The patches are based on the release/1.3 branch. It is tested on Kubernetes 1.17 with patches adapted from PR 64005 (kinvolk/kubernetes#3).

The main changes are:

• Import the new CRI API from Kubernetes PR 64005.
• Implement GetRuntimeConfigInfo returning the hard coded uid mapping with 100000
• Use the WithRemappedSnapshot snapshotter
• Fix sysfs mount with correct ownership of netns (see commitmsg for details)
• Additional mount restrictions on /dev/shm (nosuid, noexec, nodev)
• Chown /dev/shm appropriately
• Fix etc-hosts mounts with supplementary groups (see commitmsg for details)
• Use custom options WithoutNamespace, WithUserNamespace, WithLinuxNamespace at the right places

At the OCI level (config.json), we have the following changes:

• sandbox container with new "user" namespace and UidMappings
• normal containers with "user" namespace from a path and UidMappings

Demo:

$ kubectl apply -f userns-tests/pod-simple.yaml 
pod/pod-simple created
$ kubectl apply -f userns-tests/pod-userns.yaml
pod/pod-userns created
$ kubectl exec -ti pod-simple -- /bin/sh -c 'cat /proc/self/uid_map'
         0          0 4294967295
$ kubectl exec -ti pod-userns -- /bin/sh -c 'cat /proc/self/uid_map'
         0     100000      65535

Details

• userns-tests/pod-simple.yaml

apiVersion: v1
kind: Pod
metadata:
  name: pod-simple
  namespace: default
  annotations:
    alpha.kinvolk.io/userns: "disabled"
spec:
  containers:
  - name: pod-simple
    image: busybox
    command: ["sh"]
    args: ["-c", "sleep infinity"]

• userns-tests/pod-userns.yaml:

apiVersion: v1
kind: Pod
metadata:
  name: pod-userns
  namespace: default
  annotations:
    alpha.kinvolk.io/userns: "enabled"
spec:
  containers:
  - name: pod-userns
    image: busybox
    command: ["sh"]
    args: ["-c", "sleep infinity"]

TODO:

• Make the uid mapping configurable instead of hard coding 100000.
• Try on the master branch (presumably upstream wants an implementation on master first)
• Tests.
• Implement NamespaceMode=NODE_WIDE_REMAPPED correctly. At the moment, NamespaceMode=POD and NamespaceMode=NODE are implemented correctly.
• Check the status of volumes.

/cc @mauriciovasquezbernal

[mauriciovasquezbernal]

Some minor comments. I think we could remove NODE_WIDE_REMAPPED everywhere on this PR as we removed that on the kubelet one.