Per-CT idmap

[lcs]

When I create an unprivileged CT, its UID/GID range will be 100000-165535. This range is then reused for all new unprivileged CTs as well.

Wouldn't it be better to use a unique range for each CT? Let's say I would like to use <CTID>00000-<CTID>65535 when I create the container with id CTID. What would be the best way to achieve this?

 

[fabian]

you can set your own id mappings (as root) by adding lxc.idmap lines to the config file (/etc/pve/../lxc/XXX.conf). there are some corner cases where it might not work perfectly, and restoring backups of such containers with the mapping intact is limited to root@pam as well (since a custom mapping does allow mapping some in-container ID to an actual existing one on the hypervisor)

 

[lcs]

Right, I understand how I can configure the mapping. The thing is that by the time that config file is available, the filesystem has already been created with all the wrong IDs.

 

[fabian]

yeah, that's true :-/. it does get honored on restore, but I guess that would mean you'd need to manually fix them up after the initial creation at least. most people just use custom mappings in addition to the default one (to share certain users across containers and the host for accessing bind mounts or the like).

feel free to file an enhancement request to allow configuring custom idmaps on creation directly (or at least a switch for some ID-based "each container gets their own disjunct subrange" mechanism like you want/LXD also offers )