overlay: Require opt-in if idmap mounts are not supported.

If we don't use idmap mounts, doing a chown per pod is very expensive:
it implies duplicating the container storage for the image for every pod
and the latency to start a new pod is affected too.

Let's make sure users are aware of this, by having them opt-in, for
snapshotters that we have a better solution (like overlayfs, that has
support for idmap mounts).

Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>

snapshots/overlay/plugin/plugin.go

@@ -28,7 +28,8 @@ import (
 )
 
 const (
-	capaRemapIds = "remap-ids"
+	capaRemapIds     = "remap-ids"
+	capaOnlyRemapIds = "only-remap-ids"
 )
 
 // Config represents configuration for the overlay plugin.
@@ -38,6 +39,11 @@ type Config struct {
 	UpperdirLabel bool   `toml:"upperdir_label"`
 	SyncRemove    bool   `toml:"sync_remove"`
 
+	// slowChown allows the plugin to fallback to a recursive chown if fast options (like
+	// idmap mounts) are not available. See more info about the overhead this can have in
+	// github.com/containerd/containerd/docs/user-namespaces/.
+	SlowChown bool `toml:"slow_chown"`
+
 	// MountOptions are options used for the overlay mount (not used on bind mounts)
 	MountOptions []string `toml:"mount_options"`
 }
@@ -76,6 +82,14 @@ func init() {
 				ic.Meta.Capabilities = append(ic.Meta.Capabilities, capaRemapIds)
 			}
 
+			if config.SlowChown {
+				oOpts = append(oOpts, overlay.WithSlowChown)
+			} else {
+				// If slowChown is false, we use capaOnlyRemapIds to signal we only
+				// allow idmap mounts.
+				ic.Meta.Capabilities = append(ic.Meta.Capabilities, capaOnlyRemapIds)
+			}
+
 			ic.Meta.Exports["root"] = root
 			return overlay.NewSnapshotter(root, oOpts...)
 		},