feat: add ALT Linux compatibility improvements

[liannnix]

This PR adds ALT Linux support to distrobox, addressing compatibility issues with ALT Linux containers. The changes include:

What was done

1. Added --container-runuser option (-R) to use runuser instead of su inside containers when unshare_groups is enabled

   • Supported via command line, environment variable DBX_CONTAINER_RUNUSER, and configuration file
   • Defaults to disabled to maintain backward compatibility

2. Added ALT Linux setup hooks in distrobox-init:

   • Disable pam_mktemp for AltLinux PAM stack compatibility

3. Fixed directory creation using mkdir -p to prevent errors when /etc/tcb/$user already exists

Why this is needed

ALT Linux has specific requirements for user management and authentication:

Critical incompatibility: ALT Linux uses a different su implementation that is incompatible with the standard su from util-linux package. The ALT Linux su has different command-line options and behavior.

Alternative solution: runuser provides compatible functionality and integrates better with ALT Linux security systems.

Additional requirements:

• pam_mktemp conflicts with container environments (private /tmp directory is unnecessary since /tmp is mounted from host)

[89luca89]

Hi @liannnix is runuser a replacement for su or an addition in ALTLinux?
If it's a replacement, so it's mutually exclusive, we could just symlink it?

[liannnix]

Hi @liannnix is runuser a replacement for su or an addition in ALTLinux? If it's a replacement, so it's mutually exclusive, we could just symlink it?

Hi,

In ALT Linux runuser is an addition, not a drop-in replacement for su. ALT ships its own su implementation with different options/behaviour, and a bunch of tools rely on this exact su. Replacing it with a symlink to runuser would break those expectations inside ALT containers.

The actual problem is that distrobox-enter calls su with util-linux style options, but inside an ALT container /bin/su is this custom one, so it blows up. At the same time distrobox cannot reliably know which distro is inside the target container, so it cannot decide on its own when su is safe to use and when it is not.

That’s why the opt-in --container-runuser toggle in this PR is preferable: it fixes ALT containers without touching their su and without relying on symlinks or image modifications.

[89luca89]

Got it now it's more clear
I'll be honest, I don't like adding a flag in create only for a very specific distro acting in a non posix-y way.
Distrobox's su usage is posix compliant and distrobox is a targets a posix compliant userland, if that doesn't work it's just an incompatibility on ALT Linux side, more than Distrobox itself.

I'm open to find a way to make it work that does not involve additional options, env variables, or flags.

ALT Linux has a dedicated setup section in the init (about line 967) you can use that to put in some logic in order to make it compliant. Had this problem before with Alpine and Chimera where sudo was replaced by su-exec and doas. We can work in that direction, but as explained, adding a per-distro flag for a very specific use-case is not ok for me.

cc @dottorblaster

[liannnix]

Got it now it's more clear I'll be honest, I don't like adding a flag in create only for a very specific distro acting in a non posix-y way. Distrobox's su usage is posix compliant and distrobox is a targets a posix compliant userland, if that doesn't work it's just an incompatibility on ALT Linux side, more than Distrobox itself.

I'm open to find a way to make it work that does not involve additional options, env variables, or flags.

ALT Linux has a dedicated setup section in the init (about line 967) you can use that to put in some logic in order to make it compliant. Had this problem before with Alpine and Chimera where sudo was replaced by su-exec and doas. We can work in that direction, but as explained, adding a per-distro flag for a very specific use-case is not ok for me.

cc @dottorblaster

Thanks for the detailed explanation, that makes your concerns much clearer. I agree that a per-distro flag is not ideal, and it’s better to handle ALT Linux specifics in its dedicated init section instead. I’ll rework the PR to move the su/runuser handling there, following the approach you used for Alpine/Chimera, and drop the --container-runuser flag. Thanks again for the review and guidance!