all lists on lists.proxmox.com
 help / color / mirror / Atom feed
From: Filip Schauer <f.schauer@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [PATCH container/manager v2 0/7] implement per-mountpoint uid/gid mapping
Date: Mon, 30 Mar 2026 16:10:11 +0200	[thread overview]
Message-ID: <20260330141021.151921-1-f.schauer@proxmox.com> (raw)

Add support for configuring UID/GID mappings on individual container
mount points without affecting the global container mapping.

A new "idmap" mount point option accepts semicolon-separated mappings:
```
idmap=type:ct:host:len;type:ct:host:len;...
```

type: can be either 'u' or 'g'
ct: ID as seen inside the container
host: corresponding ID on the host
len: number of consecutive IDs to map

Unmapped ranges inherit the container's ID mapping.

Example to pass through the host UID & GID 1005:
```
mp0: /mnt/data,mp=/data,idmap=u:1005:1005:1;g:1005:1005:1
```

To identity-map the entire range of ids, "passthrough" can be used:
```
idmap=passthrough
```

Mount point idmapping only works for unprivileged containers. Privileged
containers are unaffected.

Build/Bump order:
* pve-container
* pve-manager

Changes since v1:
* Include $msg in error message in sync_send/sync_recv
* Switch idmap from space-separated to semicolon-separated
* Improve documentation of idmap option
* Add 'idmap=passthrough'
* Cache user namespace file descriptors in memory at container startup
  to avoid overhead of re-creating duplicates

pve-container:

Filip Schauer (5):
  namespaces: relax prototype of run_in_userns
  namespaces: refactor run_in_userns
  d/control: update versioned dependency for libpve-common-perl
  namespaces: add helper to create user namespace from idmap
  implement per-mountpoint uid/gid mapping

 debian/control            |  2 +-
 src/PVE/LXC.pm            | 96 +++++++++++++++++++++++++++++++++++++--
 src/PVE/LXC/Config.pm     | 39 ++++++++++++++++
 src/PVE/LXC/Namespaces.pm | 63 ++++++++++++++++++++-----
 src/lxc-pve-prestart-hook | 23 ++++++++++
 5 files changed, 206 insertions(+), 17 deletions(-)


pve-manager:

Filip Schauer (2):
  ui: lxc/MPEdit: remove duplicate "mp" assignment
  ui: lxc/MPEdit: add "idmap" option

 www/manager6/lxc/MPEdit.js | 213 ++++++++++++++++++++++++++++++++++++-
 1 file changed, 212 insertions(+), 1 deletion(-)


Summary over all repositories:
  6 files changed, 418 insertions(+), 18 deletions(-)

-- 
Generated by git-murpp 0.6.0




             reply	other threads:[~2026-03-30 14:10 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-03-30 14:10 Filip Schauer [this message]
2026-03-30 14:10 ` [PATCH container v2 1/7] namespaces: relax prototype of run_in_userns Filip Schauer
2026-03-30 14:10 ` [PATCH container v2 2/7] namespaces: refactor run_in_userns Filip Schauer
2026-03-30 14:10 ` [PATCH container v2 3/7] d/control: update versioned dependency for libpve-common-perl Filip Schauer
2026-03-30 14:10 ` [PATCH container v2 4/7] namespaces: add helper to create user namespace from idmap Filip Schauer
2026-03-30 14:10 ` [PATCH container v2 5/7] implement per-mountpoint uid/gid mapping Filip Schauer
2026-03-30 14:10 ` [PATCH manager v2 6/7] ui: lxc/MPEdit: remove duplicate "mp" assignment Filip Schauer
2026-03-30 14:10 ` [PATCH manager v2 7/7] ui: lxc/MPEdit: add "idmap" option Filip Schauer

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260330141021.151921-1-f.schauer@proxmox.com \
    --to=f.schauer@proxmox.com \
    --cc=pve-devel@lists.proxmox.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal