Mapping UID\GID in LXC containers
Posted by YogurtclosetMuted463@reddit | linuxadmin | View on Reddit | 6 comments
Hello everyone! I'm not a total newbie but I can't wrap my head around how containers behave if I try to map it's IDs to host's.
My lab is a Proxmox machine wth OMV installed alongside. Filesystem mounts are binded into container with
lxc.mount.entry: /srv/dev-disk-by-uuid-XYZ/ mnt/media none bind 0 0
For some time my drives were formatted in NTFS and containers has been working with it just fine. Recently i've reformatted all my drives from NTFS to EXT4 and now containers has access rights issues.
As an example, here's file I've created via SAMBA with host's user:
-rw-rw-r-- 1 smeta users 0 Jan 17 08:02 uidguid
LXC gets these:
-rw-rw-r-- 1 nobody nogroup 0 Jan 17 03:02 uidguid
UID and GID in host are:
smeta:x:1000:100::/home/smeta:/usr/bin/bash
users:x:100:smeta
In LXC:
qbtuser:x:1000:1000:,,,:/home/qbtuser:/bin/bash
users:x:100:qbtuser
So I tried to map /etc/pve/lxc/101.conf ID's as such:
lxc.idmap u 1000 1000 1
lxc.idmap g 100 100 1
/etc/subuid
root:1000:1
root:100000:65536
smeta:1000:1
smeta:165536:65536
and subgid
root:100:1
root:100000:65536
smeta:100:1
smeta:165536:65536
LXC still gets nobody/nogroup. Adding new users to both host and LXC with 1001:1001 also didn't change anything.
And there's also this: after I shutdown the LXC, all lxc.idmaps disappear from 101.conf. To me this config don't see complicated and yet there's something that I do wrong, but I can't understand what is it.
YogurtclosetMuted463@reddit (OP)
So I think I got it going but not as I planned initially.
GID 100, GID 1000 and UID 1000 mapped to host as follows:
But at the same time everything owned by LXC UID 1000 became nobody's and with that also /home/qbtuser which broke existing configs. So i had to:
Now everything seems to work as intended.
It's probably a specific case, but maybe there a way to get out of such a situation without chowning stuff back and forth? Did I do wrong something again?
axii0n@reddit
you shouldn't need to do any chowning in the container if you have the right owners and mapping on the host. the container shouldnt be able to mess with your configs if mapping isnt set up because it wont have perms, assuming its an unprivileged container.
YogurtclosetMuted463@reddit (OP)
Then what went wrong? I had only one extra user and group in both host and container with uid/gid=1000. User group also have gid 100 everywhere.
axii0n@reddit
it's tough to say without knowing the exact steps you took. for your peace of mind, you could try creating a new container and bind mounting something just to check if it works as expected this time without jumping through extra hoops.
axii0n@reddit
it looks like you might not be mapping the rest of the range, which may cause the issue? you'd need something like this for the uid:
and for the gid:
i can't test this atm but give it a try.
YogurtclosetMuted463@reddit (OP)
Yes, it's so silly that I couldn't wrap it in words at the time I found out myself. Found it pretty soon after op but there were some other errors that I didn't have time to address. I appreciate your feedback anyway, really.