Container mount point GID mapping works, but no write access

G

gechu

Active Member
Mar 22, 2019
16
2
43
43
I'm trying the new mount-point ID mapping feature introduced in Proxmox VE 9.2 with an Ubuntu 26.04 LTS unprivileged container.

The host is running the latest PVE packages with kernel 7.0.14-12-pve.

On the host, the shared directory is owned by group media:

Code: 
root@pve:/data# ls -l
drwxrwsr-x 5 david media 5 Aug 23 11:56 downloads

The media group has GID 1000 on the host.

Inside the container, I want this mapped to GID 2000.

Container configuration:

Code: 
cat /etc/pve/nodes/pve/lxc/123.conf
...
mp0: /data/downloads,mp=/data/downloads,idmap=g:1000:2000:1
...

Inside the container, the mapping appears to work:

Code: 
root@my-container:/data# ls -l
drwxrwsr-x 5 nobody media 5 Aug 23 09:56 downloads

The media group inside the container has GID 2000.

However, a user who belongs to that group cannot write to the directory:

Code: 
root@my-container:~# id bob
uid=103(bob) gid=1000(media) groups=1000(media)

Code: 
root@my-container:~# sudo -u bob touch /data/downloads/test
touch: cannot touch '/data/downloads/test': Permission denied

So the mount-point GID mapping appears to be applied correctly for ownership/display purposes, but it does not seem to grant write access.

Am I missing an additional configuration step for mapped GIDs on unprivileged containers, or is this a limitation/bug in the new mount-point ID mapping feature?
 
gechu said:
The media group has GID 1000 on the host.

Inside the container, I want this mapped to GID 2000.

Container configuration:

Code: 
cat /etc/pve/nodes/pve/lxc/123.conf
...
mp0: /data/downloads,mp=/data/downloads,idmap=g:1000:2000:1
...
Click to expand...
The format is type:container:disk:range-size.
With idmap=g:1000:2000:1, you are mapping container GID 1000 to disk GID 2000.
If you want to map container GID 2000 to disk GID 1000, use idmap=g:2000:1000:1.

gechu said:
The media group inside the container has GID 2000.
Click to expand...
From your id bob output I can see that the media group inside the container has GID 1000, not 2000:
gechu said:
root@my-container:~# id bob
uid=103(bob) gid=1000(media) groups=1000(media)
Click to expand...
 
Apologies, I mixed the GIDs.

Container GID for media is 1000, and on the disk, media GID is 2000.

1787569927837.png

Still does not work. Am i missing something?
 
I got it working by also mapping UID. Apparently GID alone is not sufficent.

Is this a bug or working as intended?
 
You must log in or register to reply here.
Top Bottom
Back