daemon/command: Refuse containerd migration with userns-remap

The containerd image store is not supported with userns-remap, so the
daemon disables the containerd-snapshotter feature and refuses to start
when it is explicitly enabled.
The containerd-migration feature was not covered by this, so a daemon
with both userns-remap and containerd-migration still switched to the
containerd image store.

Refuse to start in that case too, with the same kind of error as for
containerd-snapshotter.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>

daemon/command/daemon_linux.go

@@ -32,6 +32,12 @@ func setPlatformOptions(conf *config.Config) error {
 	if enabled {
 		return errors.New("containerd-snapshotter is explicitly enabled, but is not compatible with userns remapping. Please disable userns remapping or containerd-snapshotter")
 	}
+	// Migration switches to the containerd image store regardless of the
+	// containerd-snapshotter feature. Refuse rather than silently skip it, as
+	// containers and images of an already migrated daemon would not be visible.
+	if conf.Features["containerd-migration"] {
+		return errors.New("containerd-migration is enabled, but is not compatible with userns remapping. Please disable userns remapping or containerd-migration")
+	}
 
 	log.G(context.TODO()).Warn("userns remapping enabled, disabling containerd snapshotter")
 	if conf.Features == nil {

daemon/command/daemon_linux_test.go

@@ -128,6 +128,22 @@ func TestC8dSnapshotterWithUsernsRemap(t *testing.T) {
 			},
 			expErr: "containerd-snapshotter is explicitly enabled, but is not compatible with userns remapping. Please disable userns remapping or containerd-snapshotter",
 		},
+		{
+			name: "userns remap, containerd-migration feature",
+			cfg: &config.Config{
+				RemappedRoot: "default",
+				CommonConfig: config.CommonConfig{Features: map[string]bool{"containerd-migration": true}},
+			},
+			expCfg: &config.Config{
+				RemappedRoot: "dockremap:dockremap",
+				CommonConfig: config.CommonConfig{
+					ContainerdNamespace:       "-100000.100000",
+					ContainerdPluginNamespace: "-100000.100000",
+					Features:                  map[string]bool{"containerd-migration": true},
+				},
+			},
+			expErr: "containerd-migration is enabled, but is not compatible with userns remapping. Please disable userns remapping or containerd-migration",
+		},
 		{
 			name: "no remap, explicit containerd-snapshotter feature",
 			cfg: &config.Config{

integration/daemon/migration_test.go

@@ -90,6 +90,7 @@ func testMigrateSnapshotter(t *testing.T, graphdriver, snapshotter string) {
 
 func TestMigrateSaveLoad(t *testing.T) {
 	skip.If(t, runtime.GOOS != "linux")
+	skip.If(t, testEnv.IsUserNamespace(), "containerd snapshotters are disabled with user namespace remapping")
 
 	t.Setenv("DOCKER_MIGRATE_SNAPSHOTTER_THRESHOLD", "200M")
 	t.Setenv("DOCKER_DRIVER", "")