Tool to generate syntax for LXC unprivileged uid/gid mappings.

[DougD]

Wrote it for myself, but others may benefit from it.

If running a Proxmox LXC container in unprivileged mode, and a container uid/gid to host uid/gid mapping is necessary, this tool will provide the correct syntax needed. It will not modify any files on its own.

https://github.com/ddimick/proxmox-lxc-idmapper

 

[mbosma]

Thanks! I'll try it out.
Stopped trying to use unprivileged containers because of the hassle a while ago.

 

[DougD]

Thanks! I'll try it out.
Stopped trying to use unprivileged containers because of the hassle a while ago.

Let me know if you run into any problems with it.

 

[rubictus]

this tool is a good idea.
But it only gives the conf for example to map id 1000 from host to id 1000 in the lxc.
It could be nice to give the conf to map an id from host (ex. 1000) to a different id in the lxc (ex. 1123)

I've this sample :
Map id 666 from host to id 108 in my lxc
map gid 666 from host to gid 114 in my lxc

# Add to /etc/pve/lxc/<container_id>.conf:
lxc.idmap: u 0 100000 108
lxc.idmap: g 0 100000 114
lxc.idmap: u 108 666 1
lxc.idmap: g 114 666 1
lxc.idmap: u 109 100109 65427
lxc.idmap: g 115 100115 65421


# Add to /etc/subuid:
root:666:1

# Add to /etc/subgid:
root:666:1

 

[Alecz]

I need to map 3 uids/guids and after spending several hours trying to figure our the config, I found your tool and it almost works:

python .\run.py 1003:1003=1003:1003 2001:2001=2001:2001 2002:2002=2002:2002

# Add to /etc/pve/lxc/<container_id>.conf:
lxc.idmap: u 0 100000 1003
lxc.idmap: g 0 100000 1003
lxc.idmap: u 1003 1003 1
lxc.idmap: g 1003 1003 1
lxc.idmap: u 1004 101004 997
lxc.idmap: g 1004 101004 997
lxc.idmap: u 2001 2001 1
lxc.idmap: g 2001 2001 1
lxc.idmap: u 2002 102002 0
lxc.idmap: g 2002 102002 0
lxc.idmap: u 2002 2002 1
lxc.idmap: g 2002 2002 1
lxc.idmap: u 2003 102003 63533
lxc.idmap: g 2003 102003 63533

# Add to /etc/subuid:
root:1003:1
root:2001:1
root:2002:1

# Add to /etc/subgid:
root:1003:1
root:2001:1
root:2002:1

So I updated the files but I get:

root@proxmox:~# lxc-start -n 100 -F -l DEBUG -o /tmp/lxc-CT100.log
lxc-start: 100: ../src/lxc/conf.c: lxc_map_ids: 3701 newuidmap failed to write mapping "newuidmap: uid range [2002-2002) -> [102002-102002) not allowed": newuidmap 202217 0 100000 1003 1003 1003 1 1004 101004 997 2001 2001 1 2002 2002 1 2002 102002 0 2002 102003 63533

Is this a bug in the tool, or did I mess something up?

EDIT: this seems to be a bug. There is an issue raised and a fix here:
https://github.com/ddimick/proxmox-lxc-idmapper/issues/2
https://github.com/ddimick/proxmox-lxc-idmapper/pull/6 (not merged)
https://github.com/mnestor/proxmox-lxc-idmapper/tree/master (fork with fix)