Add support for userns remapping

docs/features/configuration.md

@@ -53,6 +53,7 @@ but does not allow starting privileged containers, you can turn off the Ryuk con
 1. You can specify the connection timeout for Ryuk by setting the `TESTCONTAINERS_RYUK_CONNECTION_TIMEOUT` **environment variable**, or the `ryuk.connection.timeout` **property**. The default value is 1 minute.
 1. You can specify the reconnection timeout for Ryuk by setting the `TESTCONTAINERS_RYUK_RECONNECTION_TIMEOUT` **environment variable**, or the `ryuk.reconnection.timeout` **property**. The default value is 10 seconds.
 1. You can configure Ryuk to run in verbose mode by setting any of the `ryuk.verbose` **property** or the `TESTCONTAINERS_RYUK_VERBOSE` **environment variable**. The default value is `false`.
+1. You can configure Ryuk to run in the host userns if you're using the `--userns-remap` feature of the docker daemon by setting either the `TESTCONTAINERS_RYUK_USER_NS` **environment variable** or the `ryuk.userns` **property**. The default value is `false`.
 
 !!!info
     For more information about Ryuk, see [Garbage Collector](garbage_collector.md).

internal/config/config.go

@@ -31,6 +31,7 @@ type Config struct {
 	RyukReconnectionTimeout time.Duration `properties:"ryuk.reconnection.timeout,default=10s"`
 	RyukConnectionTimeout   time.Duration `properties:"ryuk.connection.timeout,default=1m"`
 	RyukVerbose             bool          `properties:"ryuk.verbose,default=false"`
+	RyukUserNs              bool          `properties:"ryuk.userns,default=false"`
 	TestcontainersHost      string        `properties:"tc.host,default="`
 }
 
@@ -87,6 +88,11 @@ func read() Config {
 			config.RyukVerbose = ryukVerboseEnv == "true"
 		}
 
+		ryukUserNsEnv := os.Getenv("TESTCONTAINERS_RYUK_USER_NS")
+		if parseBool(ryukUserNsEnv) {
+			config.RyukUserNs = ryukUserNsEnv == "true"
+		}
+
 		ryukReconnectionTimeoutEnv := os.Getenv("TESTCONTAINERS_RYUK_RECONNECTION_TIMEOUT")
 		if timeout, err := time.ParseDuration(ryukReconnectionTimeoutEnv); err == nil {
 			config.RyukReconnectionTimeout = timeout

reaper.go

@@ -257,6 +257,10 @@ func newReaper(ctx context.Context, sessionID string, provider ReaperProvider) (
 			hc.AutoRemove = true
 			hc.Binds = []string{dockerHostMount + ":/var/run/docker.sock"}
 			hc.NetworkMode = Bridge
+			// Ryuk mounts the Docker socket so running it within a userns will cause major headaches.
+			if tcConfig.RyukUserNs {
+				hc.UsernsMode = "host"
+			}
 		},
 		Env: map[string]string{},
 	}