SMB Mount in Unprivileged LXC – UID/GID Confusion

[HigeMynx]

Hey everyone,

I'm trying to set up an SMB mount in an unprivileged LXC container on Proxmox, but I’m struggling to understand how UID and GID work in this context. I've read multiple guides, including this one: Proxmox: Bind SMB Mount to Unprivileged LXC Container the Easy Way, and searched various forums, but I keep running into the same problem.

The Issue:​

When I run the id command inside my unprivileged LXC container, I get:

uid=0(root) gid=0(root)

which is the same as on my Proxmox host. However, from what I’ve read, in unprivileged containers, the UIDs and GIDs should be mapped to 10000+ values. But in my case, they’re not.

What I Know So Far:​

• UID = User ID, GID = Group ID
• Normally, uid=0 and gid=0 correspond to the root user and group.
• In unprivileged LXC containers, these should be mapped to higher values (e.g., 100000+).
• I can’t find where these IDs are mapped or why my container isn’t showing the expected values.

What I Achieved So Far​

I was able to pass through a mount to the LXC container successfully using /etc/fstab on the Proxmox host and the pct bindmount command. However, I only have read permissions.

My Questions:​

1. Where exactly can I find the mapped UID/GID for an unprivileged LXC container?
2. What are /etc/subuid and /etc/subgid on the Proxmox host for?
3. Is my setup broken, or am I missing a crucial step?

I have also read the entirety of Proxmox’s Unprivileged LXC Containers Wiki, which didn't get me any further...

 

[HigeMynx]

I got it working! This video explained the missing part: the reason why you cant write from unprivileged container to Proxmox VM.

Proxmox itself just "adds" 100000 to the UID and GID of the containers as soon as the "requests" get out of the container, reaching for the mount. So, if I have 10 unprivileged LXC containers, all with root:root (0/0), all of these containers can mount and read/write the bindmount's of the share that is mounted on the Proxmox host with UID and GID 100000.

 

[Unspec]

The easiest way to think about UID/GID remapping is that it's entirely invisible to the container. To the container, 0 is still root, even though on the HOST, the CT's 0 UID/GID is actually 100000. Inside the container, the container's root user still operates entirely as expected of a root user within that container.