[SOLVED] uid/gid mapping to unpriv. lxc breaks permissions in guest

[craBshot]

Hey there,

so, there seems to be something I don't quite understand about ID mapping.

I have an unprivileged container with a user/group pair 107:114 mapped to the hosts 1002:1002 pair with the following config:

lxc.idmap: u 0 100000 107
lxc.idmap: u 107 1002 1
lxc.idmap: u 108 100108 65428
lxc.idmap: g 0 100000 114
lxc.idmap: g 114 1002 1
lxc.idmap: g 115 100115 65421

The mapping works fine and a bind mount path that's owned by 1002 on the host is accessible (rw) by the 107 user in the guest. However, every guest folder previously owned by 107:114 is now set to nobody:nogroup - this is also the case without the bind mount.

I was expecting all settings for 107:114 to remain untouched on the guest, but there appears to be something going on in the background that is not mentioned anywhere I searched.

Can someone help me out with this? I'd like to understand how id mapping can influence existing ownership on the guest.

Regards

 

[fiona]

Hi,

I was expecting all settings for 107:114 to remain untouched on the guest, but there appears to be something going on in the background that is not mentioned anywhere I searched.

the ownership in the file system is still the same as before. But the user is now mapped to a different ID and thus there is a mismatch between the user ID and the ownership ID. You can run pct mount <container ID here> to inspect the actual ownership from the host's perspective. You'll want to chown the relevant directories to the user ID according to the new map.

 

[craBshot]

pct mount <container ID here>

Hey, thanks for pointing this out. Didn't understand how the CT file system is actually handled by the host.