Add user flag for exec

README.md

@@ -526,8 +526,9 @@ Flags:
 - :whale: `-e, --env`: Set environment variables
 - :whale: `--env-file`: Set environment variables from file
 - :whale: `--privileged`: Give extended privileges to the command
+- :whale: `-u, --user`: Username or UID (format: <name|uid>[:<group|gid>])
 
-Unimplemented `docker exec` flags: `--detach-keys`, `--user`
+Unimplemented `docker exec` flags: `--detach-keys`
 
 ## Container management
 ### :whale: :blue_square: nerdctl ps

cmd/nerdctl/exec.go

@@ -59,6 +59,7 @@ func newExecCommand() *cobra.Command {
 	// env-file is defined as StringSlice, not StringArray, to allow specifying "--env-file=FILE1,FILE2" (compatible with Podman)
 	execCommand.Flags().StringSlice("env-file", nil, "Set environment variables from file")
 	execCommand.Flags().Bool("privileged", false, "Give extended privileges to the command")
+	execCommand.Flags().StringP("user", "u", "", "Username or UID (format: <name|uid>[:<group|gid>])")
 	return execCommand
 }
 
@@ -86,7 +87,7 @@ func execAction(cmd *cobra.Command, args []string) error {
 			if found.MatchCount > 1 {
 				return fmt.Errorf("ambiguous ID %q", found.Req)
 			}
-			return execActionWithContainer(ctx, cmd, args, found.Container)
+			return execActionWithContainer(ctx, cmd, args, found.Container, client)
 		},
 	}
 	req := args[0]
@@ -99,7 +100,7 @@ func execAction(cmd *cobra.Command, args []string) error {
 	return nil
 }
 
-func execActionWithContainer(ctx context.Context, cmd *cobra.Command, args []string, container containerd.Container) error {
+func execActionWithContainer(ctx context.Context, cmd *cobra.Command, args []string, container containerd.Container, client *containerd.Client) error {
 	flagI, err := cmd.Flags().GetBool("interactive")
 	if err != nil {
 		return err
@@ -128,7 +129,7 @@ func execActionWithContainer(ctx context.Context, cmd *cobra.Command, args []str
 		}
 	}
 
-	pspec, err := generateExecProcessSpec(ctx, cmd, args, container)
+	pspec, err := generateExecProcessSpec(ctx, cmd, args, container, client)
 	if err != nil {
 		return err
 	}
@@ -208,11 +209,26 @@ func execActionWithContainer(ctx context.Context, cmd *cobra.Command, args []str
 	return nil
 }
 
-func generateExecProcessSpec(ctx context.Context, cmd *cobra.Command, args []string, container containerd.Container) (*specs.Process, error) {
+func generateExecProcessSpec(ctx context.Context, cmd *cobra.Command, args []string, container containerd.Container, client *containerd.Client) (*specs.Process, error) {
 	spec, err := container.Spec(ctx)
 	if err != nil {
 		return nil, err
 	}
+	userOpts, err := generateUserOpts(cmd)
+	if err != nil {
+		return nil, err
+	}
+	if userOpts != nil {
+		c, err := container.Info(ctx)
+		if err != nil {
+			return nil, err
+		}
+		for _, opt := range userOpts {
+			if err := opt(ctx, client, &c, spec); err != nil {
+				return nil, err
+			}
+		}
+	}
 
 	pspec := spec.Process
 	flagT, err := cmd.Flags().GetBool("tty")

cmd/nerdctl/exec_linux_test.go

@@ -0,0 +1,50 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package main
+
+import (
+	"testing"
+
+	"github.com/containerd/nerdctl/pkg/testutil"
+)
+
+func TestExecWithUser(t *testing.T) {
+	t.Parallel()
+	base := testutil.NewBase(t)
+	const testContainer = "nerdctl-test-exec"
+	defer base.Cmd("rm", "-f", testContainer).Run()
+
+	base.Cmd("run", "-d", "--name", testContainer, testutil.CommonImage, "sleep", "infinity").AssertOK()
+
+	testCases := map[string]string{
+		"":             "uid=0(root) gid=0(root)",
+		"1000":         "uid=1000 gid=0(root)",
+		"1000:users":   "uid=1000 gid=100(users)",
+		"guest":        "uid=405(guest) gid=100(users)",
+		"nobody":       "uid=65534(nobody) gid=65534(nobody)",
+		"nobody:users": "uid=65534(nobody) gid=100(users)",
+	}
+
+	for userStr, expected := range testCases {
+		cmd := []string{"exec"}
+		if userStr != "" {
+			cmd = append(cmd, "--user", userStr)
+		}
+		cmd = append(cmd, testContainer, "id")
+		base.Cmd(cmd...).AssertOutContains(expected)
+	}
+}