@@ -8,6 +8,7 @@ import (

 	"testing"

 	"github.com/docker/docker/pkg/system"

+	rsystem "github.com/opencontainers/runc/libcontainer/system"

 	"golang.org/x/sys/unix"

 	"gotest.tools/assert"

 	"gotest.tools/skip"

@@ -24,6 +25,7 @@ import (

 //     └── f1 # whiteout, 0644

 func setupOverlayTestDir(t *testing.T, src string) {

 	skip.If(t, os.Getuid() != 0, "skipping test that requires root")

+	skip.If(t, rsystem.RunningInUserNS(), "skipping test that requires initial userns (trusted.overlay.opaque xattr cannot be set in userns, even with Ubuntu kernel)")

 	// Create opaque directory containing single file and permission 0700

 	err := os.Mkdir(filepath.Join(src, "d1"), 0700)

 	assert.NilError(t, err)

@@ -18,6 +18,7 @@ import (

 	"github.com/docker/docker/pkg/idtools"

 	"github.com/docker/docker/pkg/ioutils"

+	rsystem "github.com/opencontainers/runc/libcontainer/system"

 	"gotest.tools/assert"

 	is "gotest.tools/assert/cmp"

 	"gotest.tools/skip"

@@ -1229,6 +1230,7 @@ func TestReplaceFileTarWrapper(t *testing.T) {

 // version of this package that was built with <=go17 are still readable.

 func TestPrefixHeaderReadable(t *testing.T) {

 	skip.If(t, runtime.GOOS != "windows" && os.Getuid() != 0, "skipping test that requires root")

+	skip.If(t, rsystem.RunningInUserNS(), "skipping test that requires more than 010000000 UIDs, which is unlikely to be satisfied when running in userns")

 	// https://gist.github.com/stevvooe/e2a790ad4e97425896206c0816e1a882#file-out-go

 	var testFile = []byte("\x1f\x8b\x08\x08\x44\x21\x68\x59\x00\x03\x74\x2e\x74\x61\x72\x00\x4b\xcb\xcf\x67\xa0\x35\x30\x80\x00\x86\x06\x10\x47\x01\xc1\x37\x40\x00\x54\xb6\xb1\xa1\xa9\x99\x09\x48\x25\x1d\x40\x69\x71\x49\x62\x91\x02\xe5\x76\xa1\x79\x84\x21\x91\xd6\x80\x72\xaf\x8f\x82\x51\x30\x0a\x46\x36\x00\x00\xf0\x1c\x1e\x95\x00\x06\x00\x00")

@@ -14,6 +14,7 @@ import (

 	"testing"

 	"github.com/docker/docker/pkg/system"

+	rsystem "github.com/opencontainers/runc/libcontainer/system"

 	"golang.org/x/sys/unix"

 	"gotest.tools/assert"

 	is "gotest.tools/assert/cmp"

@@ -182,6 +183,7 @@ func getInode(path string) (uint64, error) {

 func TestTarWithBlockCharFifo(t *testing.T) {

 	skip.If(t, os.Getuid() != 0, "skipping test that requires root")

+	skip.If(t, rsystem.RunningInUserNS(), "skipping test that requires initial userns")

 	origin, err := ioutil.TempDir("", "docker-test-tar-hardlink")

 	assert.NilError(t, err)