From: Filip Schauer <f.schauer@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [PATCH container/manager v2 0/7] implement per-mountpoint uid/gid mapping
Date: Mon, 30 Mar 2026 16:10:11 +0200 [thread overview]
Message-ID: <20260330141021.151921-1-f.schauer@proxmox.com> (raw)
Add support for configuring UID/GID mappings on individual container
mount points without affecting the global container mapping.
A new "idmap" mount point option accepts semicolon-separated mappings:
```
idmap=type:ct:host:len;type:ct:host:len;...
```
type: can be either 'u' or 'g'
ct: ID as seen inside the container
host: corresponding ID on the host
len: number of consecutive IDs to map
Unmapped ranges inherit the container's ID mapping.
Example to pass through the host UID & GID 1005:
```
mp0: /mnt/data,mp=/data,idmap=u:1005:1005:1;g:1005:1005:1
```
To identity-map the entire range of ids, "passthrough" can be used:
```
idmap=passthrough
```
Mount point idmapping only works for unprivileged containers. Privileged
containers are unaffected.
Build/Bump order:
* pve-container
* pve-manager
Changes since v1:
* Include $msg in error message in sync_send/sync_recv
* Switch idmap from space-separated to semicolon-separated
* Improve documentation of idmap option
* Add 'idmap=passthrough'
* Cache user namespace file descriptors in memory at container startup
to avoid overhead of re-creating duplicates
pve-container:
Filip Schauer (5):
namespaces: relax prototype of run_in_userns
namespaces: refactor run_in_userns
d/control: update versioned dependency for libpve-common-perl
namespaces: add helper to create user namespace from idmap
implement per-mountpoint uid/gid mapping
debian/control | 2 +-
src/PVE/LXC.pm | 96 +++++++++++++++++++++++++++++++++++++--
src/PVE/LXC/Config.pm | 39 ++++++++++++++++
src/PVE/LXC/Namespaces.pm | 63 ++++++++++++++++++++-----
src/lxc-pve-prestart-hook | 23 ++++++++++
5 files changed, 206 insertions(+), 17 deletions(-)
pve-manager:
Filip Schauer (2):
ui: lxc/MPEdit: remove duplicate "mp" assignment
ui: lxc/MPEdit: add "idmap" option
www/manager6/lxc/MPEdit.js | 213 ++++++++++++++++++++++++++++++++++++-
1 file changed, 212 insertions(+), 1 deletion(-)
Summary over all repositories:
6 files changed, 418 insertions(+), 18 deletions(-)
--
Generated by git-murpp 0.6.0
next reply other threads:[~2026-03-30 14:10 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-30 14:10 Filip Schauer [this message]
2026-03-30 14:10 ` [PATCH container v2 1/7] namespaces: relax prototype of run_in_userns Filip Schauer
2026-03-30 14:10 ` [PATCH container v2 2/7] namespaces: refactor run_in_userns Filip Schauer
2026-03-30 14:10 ` [PATCH container v2 3/7] d/control: update versioned dependency for libpve-common-perl Filip Schauer
2026-03-30 14:10 ` [PATCH container v2 4/7] namespaces: add helper to create user namespace from idmap Filip Schauer
2026-03-30 14:10 ` [PATCH container v2 5/7] implement per-mountpoint uid/gid mapping Filip Schauer
2026-03-30 14:10 ` [PATCH manager v2 6/7] ui: lxc/MPEdit: remove duplicate "mp" assignment Filip Schauer
2026-03-30 14:10 ` [PATCH manager v2 7/7] ui: lxc/MPEdit: add "idmap" option Filip Schauer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260330141021.151921-1-f.schauer@proxmox.com \
--to=f.schauer@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.