Paired with @Callisto13 on an issue in the Garden backlog around Concourse and Garden runC 1.9.5.

Here's what we found:

As part of #150710163, the flags for --garden-uid-map-start --garden-uid-map-length --garden-gid-map-start --garden-gid-map-length are now required on the GardenServer, but concourse/bin doesn't set defaults for, or require those flags to be passed.

We should consider having sane defaults in worker_linux.go (here's what Garden does in their ctl script), and optionally allow them to be set (which works currently).

Might want to also consider how this can be used to limit the ability for privileged containers at the Garden server level, and implications this has on running Concourse binaries in Docker / K8s