Okay, the documentation on the wiki could be better ;-)
The two main points to solve this problem are:
- `/etc/subuid` and `/etc/subgid` have to include all mapped ids for the user `root`, since this is user that starts the LXC container.
These files are the ones in the proxmox host, not the containers!
- In the lxc config you may not map any source number twice, they have to be unique
So my final working solution for a common case, where you want to forward
- "normal" users (1000-2999) and
- user-groups (1000-2999) and
- maybe a single sepecial group "users" (100)
the configs working are:
/etc/pve/nodes/[your-node]/lxc/[id].conf:
Code:
# map the first 1000 (0-999) system users to container-specific ones (100000-100999)
lxc.idmap: u 0 100000 1000
# map normal users (1000-2999) to the container (1000-2999)
lxc.idmap: u 1000 1000 2000
# map special "nobody" system user to container-specific one (165534)
lxc.idmap: u 65534 165534 1
# map the first 100 (0-99) system groups to container-specific ones (100000-100099)
lxc.idmap: g 0 100000 100
# map special group "users" (100) to the container (100)
lxc.idmap: g 100 100 1
# map the additional 899 groups (101-999) system groups to container-specific ones (100100-100999)
lxc.idmap: g 101 100100 899
# map user-groups (1000-2999) to the container (1000-2999)
lxc.idmap: g 1000 1000 2000
# map special group "nogroup" to the container-specific one (165534)
lxc.idmap: g 65534 165534 1
/etc/subgid:
Code:
# container-specific groups
root:100000:65536
# custom user groups 1000-2000
root:1000:2000
# default "users" group 100
root:100:1
/etc/subuid:
Code:
# container users
root:100000:65536
# custom users from 1000-2999
root:1000:2000
