Mapping multiple single IDs to LXC

[zuaram]

Hi,

I didn't find any relevant posts around the web which had the same problem as I´m facing.

My reference for all of this was the wiki of Proxmox (https://pve.proxmox.com/wiki/Unprivileged_LXC_containers)

Currently I´m trying to setup a Jellyfin LXC (Unprivileged) with iGPU passthrough and a CIFS mount from Proxmox VE.
I had success with the mp0 mount and the relevant mapping so that the Jellyfin user inside of the LXC has full access to it.

lxc.idmap: u 0 100000 1003
lxc.idmap: g 0 100000 1003
lxc.idmap: u 1003 1003 1
lxc.idmap: g 1003 1003 1
lxc.idmap: u 1004 101004 64530
lxc.idmap: g 1004 101004 64530
lxc.idmap: g 65534 165534 1 #root apt-get

and mapping in sub{g,u}id

root:1003:

Then I was trying to passthrough the /dev/dri devices and the relevant groups. Please note that I exchanged the id 1003 to id 1004 for the mp0.

lxc.cgroup2.devices.allow: c 226:0 rwm
lxc.cgroup2.devices.allow: c 226:128 rwm
lxc.mount.entry: /dev/dri/card0 dev/dri/card0 none bind,optional,create=file,mode=0666
lxc.mount.entry: /dev/dri/renderD128 dev/dri/renderD128 none bind,optional,create=file
lxc.autodev: 1
lxc.idmap: u 0 100000 44
lxc.idmap: g 0 100000 44
lxc.idmap: u 44 44 1
lxc.idmap: g 44 44 1
lxc.idmap: u 45 100102 58
lxc.idmap: g 45 100102 58
lxc.idmap: u 103 103 1
lxc.idmap: g 103 103 1
lxc.idmap: u 104 101004 900
lxc.idmap: g 104 101004 900
lxc.idmap: u 1004 1004 1
lxc.idmap: g 1004 1004 1
lxc.idmap: u 1005 101005 64530
lxc.idmap: g 1005 101005 64530

I think the UID isn't strictly necessary but I included it since I was learning about ID mapping. As the error tells me I think the mapping itself is fine, had to tune it a bit and was going through multiple versions.

The ids of my render/video group are also mapped again in sub{g,u}id

root:44:1
root:103:1

Sadly the PVE env throws me a error which leaves me puzzled since I don't have a clue where to go from here

()
lxc_map_ids: 3668 newuidmap failed to write mapping "newuidmap: write to uid_map failed: Invalid argument": newuidmap 559395 0 100000 44 44 44 1 45 100102 58 103 103 1 104 101004 900 1004 1004 1 1005 101005 64530 65534 165534 1
lxc_spawn: 1791 Failed to set up id mapping.
__lxc_start: 2074 Failed to spawn container "112"
TASK ERROR: startup for container '112' failed

If anyone has a pointer from where to go or a more elegant solution I´ll gladly take any feedback

 

[dcsapak]

lxc.idmap: u 0 100000 44
lxc.idmap: g 0 100000 44
lxc.idmap: u 44 44 1
lxc.idmap: g 44 44 1
lxc.idmap: u 45 100102 58
lxc.idmap: g 45 100102 58
lxc.idmap: u 103 103 1
lxc.idmap: g 103 103 1
lxc.idmap: u 104 101004 900
lxc.idmap: g 104 101004 900
lxc.idmap: u 1004 1004 1
lxc.idmap: g 1004 1004 1
lxc.idmap: u 1005 101005 64530
lxc.idmap: g 1005 101005 64530

that looks wrong, imho the line

lxc.idmap: u 45 100102 58

would have to be

lxc.idmap: u 45 100045 58

? since you want the uid 45 to mapt to 100045 no?
the first parameter ist the 'start uid' of the host, the second the 'start uid' of the container and the third the number of mappings
so '45 100102 58' maps 45 -> 100102, 46 -> 100103, and so on

(same is valid for the remaining entries also)