Hi,
I'm a proxmox-noob, been messing around with lxc.idmap, /etc/sub{u,g}id etc and I finally got something working but I cannot login as root and when I "cheat" using "pct enter 101" it's like the root user lost his root permissions so this is really weird and I've been googling around, trying to understand this problem. Instead I'll just describe what I see and have done:
So I wanted that root-owned files in the bind mount appeared, not as uid/gid 100000, but as pve : pve, which exists on the host. I'll later setup a network share for this bind-mounted folder, from within the container (CIFS/NFS or maybe FTP, haven't completely decided yet). But I want root:root (container) --> pve : pve (host), where uid/gid for pve is 1000:1000. Continuing from here I have just added two extra lines to each of these files, telling that I want to permit mapping from container to uid/gid 1000:1000:
Luckily I could google for figuring out this configuration but for a long time I thought the configuration was wrong: The weird thing is that when I made these changes, restarted the container, I could no longer login as root using the GUI Console... I thought I had made a mistake - until I discovered that I could type "pct enter 101" or "lxc-attach 101" and get access. Then I could "touch somefile", exit the container and verify that the file that was owned by root:root in the container, while that same file(s) on the host appeared to be not 100000:100000, but pve : pve. So far so good...
I was - and am - still wondering about what happened to the root-user and why I cannot login as root anylonger to the container using the GUI Console. Inside the "pct enter 101"-terminal, I first verified that I in fact was/is root - next I tried to add a new user "hostuser" - but I also cannot do that as root:
When I checked here: https://wiki.alpinelinux.org/wiki/Setting_up_a_new_user - I realized that this shouldn't happen. It's supposed to accept that command, create a new user and ask for that users password. And when I saw this - that root cannot even make a user, I was thinking, hmm, that seems to be related with the fact that I cannot login as root. But how? I don't understand that?
I thought the mapping was not about changing root permissions "inside" the container, I thought the mapping would only affect something outside the container, i.e. something in the host/container-communication? If/when I remove the id-mapping stuff, the root user works as normal or before. But that doesn't solve the original problem, because I want the mapping to happen, while root should function as normally.
There is something I don't understand about this - and this is where I thought, I have to create this post and hopefully someone is willing to explain the missing part of this... I tried googling and reading, but couldn't see exactly this problem described anywhere. At the same time I'm not happy with the situation (either the mapping isn't as I want or the root-account is screwed up) - so I would be very grateful if anyone could help with ideas or explain what I'm missing, thanks!
I'm a proxmox-noob, been messing around with lxc.idmap, /etc/sub{u,g}id etc and I finally got something working but I cannot login as root and when I "cheat" using "pct enter 101" it's like the root user lost his root permissions so this is really weird and I've been googling around, trying to understand this problem. Instead I'll just describe what I see and have done:
Code:
# pct config 101
...
mp0: /mnt/test_share,mp=/mnt/test_share
...
unprivileged: 1
lxc.idmap: u 0 1000 1
lxc.idmap: g 0 1000 1
lxc.idmap: u 1 100001 65535
lxc.idmap: g 1 100001 65535So I wanted that root-owned files in the bind mount appeared, not as uid/gid 100000, but as pve : pve, which exists on the host. I'll later setup a network share for this bind-mounted folder, from within the container (CIFS/NFS or maybe FTP, haven't completely decided yet). But I want root:root (container) --> pve : pve (host), where uid/gid for pve is 1000:1000. Continuing from here I have just added two extra lines to each of these files, telling that I want to permit mapping from container to uid/gid 1000:1000:
Code:
root@proxmox:/etc/pve/lxc# cat /etc/subuid
root:100000:65536
pve:165536:65536
root:1000:1
pve:1000:1
Code:
root@proxmox:/etc/pve/lxc# cat /etc/subgid
root:100000:65536
pve:165536:65536
root:1000:1
pve:1000:1Luckily I could google for figuring out this configuration but for a long time I thought the configuration was wrong: The weird thing is that when I made these changes, restarted the container, I could no longer login as root using the GUI Console... I thought I had made a mistake - until I discovered that I could type "pct enter 101" or "lxc-attach 101" and get access. Then I could "touch somefile", exit the container and verify that the file that was owned by root:root in the container, while that same file(s) on the host appeared to be not 100000:100000, but pve : pve. So far so good...
I was - and am - still wondering about what happened to the root-user and why I cannot login as root anylonger to the container using the GUI Console. Inside the "pct enter 101"-terminal, I first verified that I in fact was/is root - next I tried to add a new user "hostuser" - but I also cannot do that as root:
Code:
/ # whoami
root
/ # adduser hostuser
adduser: /etc/passwd: Permission deniedWhen I checked here: https://wiki.alpinelinux.org/wiki/Setting_up_a_new_user - I realized that this shouldn't happen. It's supposed to accept that command, create a new user and ask for that users password. And when I saw this - that root cannot even make a user, I was thinking, hmm, that seems to be related with the fact that I cannot login as root. But how? I don't understand that?
I thought the mapping was not about changing root permissions "inside" the container, I thought the mapping would only affect something outside the container, i.e. something in the host/container-communication? If/when I remove the id-mapping stuff, the root user works as normal or before. But that doesn't solve the original problem, because I want the mapping to happen, while root should function as normally.
There is something I don't understand about this - and this is where I thought, I have to create this post and hopefully someone is willing to explain the missing part of this... I tried googling and reading, but couldn't see exactly this problem described anywhere. At the same time I'm not happy with the situation (either the mapping isn't as I want or the root-account is screwed up) - so I would be very grateful if anyone could help with ideas or explain what I'm missing, thanks!
Last edited:
