AD DC option to use acl_tdb rather than acl_xattr?

[Andrew Walker]

For what it's worth if ZFS is an option for your container host, once the
VFS plumbing is in, you can use our ZFS patches to ZoL to add support for
native ZFS (NFSv4-style ACLs). I've tested this before in containers before
and ZFS ACLs work as expected. The primary gotcha is that there is unmerged
work in upstream ZFS to add overlayfs support.

My PR to add it to OpenZFS is here:
https://github.com/openzfs/zfs/pull/13186

You can use the samba VFS module and parameters listed in the PR or you can
grab my samba work from here:
https://github.com/truenas/samba/pull/111/files

If you have grab the lib/zfsacl and lib/sunacl code and related wscript
changes from that PR you can make vfs_zfsacl work on Linux. lib/zfsacl also
provides python bindings for interacting with the native ZFS ACLs.

A CLI management tool is here:
https://github.com/truenas/nfs4xdr-acl-tools/

These things combined provide "rich" ACLs that will work in containers
without having to rely on exposing the security namespace, storing in user
xattrs, or writing to tdb files. If anyone is interested in taking this for
a spin, feel free to email me about it and I can give more detailed
instructions.

Some things are still WIP. Today I finished writing samba support for ZFS
DOS attributes, but this is somewhat irrelevant to case of just providing
ACL support.

- other Andrew