3 files changed, 41 insertions, 3 deletions
diff --git a/pkg/specgen/container_validate.go b/pkg/specgen/container_validate.go
index 219abfd9b..56c1a7ea9 100644
--- a/pkg/specgen/container_validate.go
+++ b/pkg/specgen/container_validate.go
@@ -129,7 +129,7 @@ func (s *SpecGenerator) Validate() error {
 	if err := s.CgroupNS.validate(); err != nil {
 		return err
 	}
-	if err := s.UserNS.validate(); err != nil {
+	if err := validateUserNS(&s.UserNS); err != nil {
 		return err
 	}
 
diff --git a/pkg/specgen/generate/namespaces.go b/pkg/specgen/generate/namespaces.go
index 4ec1e859c..2aaeb9513 100644
--- a/pkg/specgen/generate/namespaces.go
+++ b/pkg/specgen/generate/namespaces.go
@@ -58,8 +58,7 @@ func GetDefaultNamespaceMode(nsType string, cfg *config.Config, pod *libpod.Pod)
 		case "uts":
 			return specgen.ParseNamespace(cfg.Containers.UTSNS)
 		case "user":
-			// TODO: This may not work for --userns=auto
-			return specgen.ParseNamespace(cfg.Containers.UserNS)
+			return specgen.ParseUserNamespace(cfg.Containers.UserNS)
 		case "net":
 			ns, _, err := specgen.ParseNetworkNamespace(cfg.Containers.NetNS)
 			return ns, err
diff --git a/pkg/specgen/namespaces.go b/pkg/specgen/namespaces.go
index 4f35b31bf..fffbd6d9e 100644
--- a/pkg/specgen/namespaces.go
+++ b/pkg/specgen/namespaces.go
@@ -33,6 +33,11 @@ const (
 	// Slirp indicates that a slirp4netns network stack should
 	// be used
 	Slirp NamespaceMode = "slirp4netns"
+	// KeepId indicates a user namespace to keep the owner uid inside
+	// of the namespace itself
+	KeepID NamespaceMode = "keep-id"
+	// KeepId indicates to automatically create a user namespace
+	Auto NamespaceMode = "auto"
 )
 
 // Namespace describes the namespace
@@ -71,6 +76,16 @@ func (n *Namespace) IsPod() bool {
 func (n *Namespace) IsPrivate() bool {
 	return n.NSMode == Private
 }
+func validateUserNS(n *Namespace) error {
+	if n == nil {
+		return nil
+	}
+	switch n.NSMode {
+	case Auto, KeepID:
+		return nil
+	}
+	return n.validate()
+}
 
 func validateNetNS(n *Namespace) error {
 	if n == nil {
@@ -158,6 +173,30 @@ func ParseNamespace(ns string) (Namespace, error) {
 	return toReturn, nil
 }
 
+// ParseUserNamespace parses a user namespace specification in string
+// form.
+func ParseUserNamespace(ns string) (Namespace, error) {
+	toReturn := Namespace{}
+	switch {
+	case ns == "auto":
+		toReturn.NSMode = Auto
+		return toReturn, nil
+	case strings.HasPrefix(ns, "auto:"):
+		split := strings.SplitN(ns, ":", 2)
+		if len(split) != 2 {
+			return toReturn, errors.Errorf("invalid setting for auto: mode")
+		}
+		toReturn.NSMode = KeepID
+		toReturn.Value = split[1]
+		return toReturn, nil
+	case ns == "keep-id":
+		toReturn.NSMode = KeepID
+		toReturn.NSMode = FromContainer
+		return toReturn, nil
+	}
+	return ParseNamespace(ns)
+}
+
 // ParseNetworkNamespace parses a network namespace specification in string
 // form.
 // Returns a namespace and (optionally) a list of CNI networks to join.