fix(cli,guest): support a named --user / exec -u, resolved in the guest

Docker accepts `--user name` / `exec -u name`, resolving it against the
container's /etc/passwd; a3s-box rejected any non-numeric user with 'Named user
is not supported yet'. normalize_user_part now forwards a named user/group
as-is, and the guest exec server resolves it (resolve_named_user) against the
container root — defaulting the rootfs to '/' for an exec (no rootfs override),
so `exec -u nobody` runs as 65534 like Docker. (The run path already resolved
the image USER in-guest; this also makes `run --user name` work.)

Author: Roy Lin

src/cli/src/boot.rs

@@ -497,13 +497,13 @@ mod tests {
     }
 
     #[test]
-    fn test_config_from_record_rejects_invalid_user() {
+    fn test_config_from_record_accepts_named_user() {
+        // Named users are forwarded as-is and resolved in the guest.
         let mut record = sample_record();
         record.user = Some("node".to_string());
 
-        let err = config_from_record(&record).unwrap_err();
-
-        assert!(err.contains("Named user"));
+        let config = config_from_record(&record).unwrap();
+        assert_eq!(config.user.as_deref(), Some("node"));
     }
 
     #[test]

src/cli/src/commands/common.rs

@@ -51,7 +51,7 @@ pub struct CommonBoxArgs {
     #[arg(long)]
     pub hostname: Option<String>,
 
-    /// Run as a specific user (supported: root, UID, UID:GID)
+    /// Run as a specific user (root, UID, UID:GID, name, or name:group)
     #[arg(short = 'u', long)]
     pub user: Option<String>,
 
@@ -413,12 +413,18 @@ fn normalize_user_part(part: &str, label: &str, original: &str) -> Result<String
             "Invalid --user '{original}' ({label} component is empty)"
         ));
     }
+    if part.contains('\0') {
+        return Err(format!(
+            "Invalid --user '{original}' ({label} contains a NUL byte)"
+        ));
+    }
     if part == "root" {
         return Ok("0".to_string());
     }
-    part.parse::<u32>().map(|_| part.to_string()).map_err(|_| {
-        format!("Named {label} '{part}' is not supported yet; use root or a numeric UID[:GID]")
-    })
+    // Numeric stays numeric; a named user/group is forwarded as-is and resolved
+    // in the guest against the container's /etc/passwd and /etc/group, like
+    // Docker's `--user name`.
+    Ok(part.to_string())
 }
 
 /// Validate an in-guest working directory override.
@@ -890,13 +896,22 @@ mod tests {
     }
 
     #[test]
-    fn test_validate_runtime_options_rejects_named_user() {
+    fn test_validate_runtime_options_accepts_named_user() {
+        // A named user is forwarded as-is and resolved in the guest against the
+        // container's /etc/passwd (like Docker's --user name).
         let mut args = default_common_args();
         args.user = Some("node".to_string());
-
-        let err = validate_runtime_options(&args).unwrap_err();
-
-        assert!(err.contains("Named user"));
+        validate_runtime_options(&args).unwrap();
+        assert_eq!(
+            normalize_user_option(Some("nobody")).unwrap().as_deref(),
+            Some("nobody")
+        );
+        assert_eq!(
+            normalize_user_option(Some("node:staff"))
+                .unwrap()
+                .as_deref(),
+            Some("node:staff")
+        );
     }
 
     #[test]

src/guest/init/src/exec_server.rs

@@ -438,13 +438,14 @@ fn build_command(
     };
     let timeout = Duration::from_nanos(timeout_ns);
     let workdir = spec.working_dir.unwrap_or("/");
-    // Resolve a named user (CRI RunAsUserName) against the container's
-    // /etc/passwd before numeric parsing; falls through to spec.user when the
-    // value is already numeric/root or cannot be resolved.
+    // Resolve a named user (CRI RunAsUserName, or `exec -u <name>`) against the
+    // container's /etc/passwd before numeric parsing; falls through to spec.user
+    // when the value is already numeric/root or cannot be resolved. For an exec
+    // (no rootfs override) the container root is the current `/`.
+    let resolve_rootfs = spec.rootfs.unwrap_or("/");
     let resolved_user = spec
         .user
-        .zip(spec.rootfs)
-        .and_then(|(user, rootfs)| crate::user::resolve_named_user(user, rootfs));
+        .and_then(|user| crate::user::resolve_named_user(user, resolve_rootfs));
     let mut process_user = match parse_process_user(resolved_user.as_deref().or(spec.user)) {
         Ok(process_user) => process_user,
         Err(error) => {
@@ -458,9 +459,9 @@ fn build_command(
     // When a user is set without an explicit group (RunAsUser, no RunAsGroup),
     // default the primary gid to the user's /etc/passwd group — matching how a
     // normal login derives the primary group — instead of inheriting root's.
-    if let (Some(process_user), Some(rootfs)) = (process_user.as_mut(), spec.rootfs) {
+    if let Some(process_user) = process_user.as_mut() {
         if process_user.gid.is_none() {
-            process_user.gid = crate::user::primary_gid_for_uid(rootfs, process_user.uid);
+            process_user.gid = crate::user::primary_gid_for_uid(resolve_rootfs, process_user.uid);
         }
     }