Debian 12 + LXD/LXC security.idmap.isolated fails
Debian 12.1 (6.1.0-11-amd64) running LXD/LXC and on an unprivileged container setting security.idmap.isolated=true
seems to fail to update the owner/group of the container’s files.
Here is an example:
<span style="color:#323232;"># lxc launch images:debian/12 debian
</span><span style="color:#323232;">(...)
</span><span style="color:#323232;">
</span><span style="color:#323232;"># lxc config get debian volatile.idmap.base
</span><span style="color:#323232;">296608
</span><span style="color:#323232;">
</span><span style="color:#323232;"># lxc stop debian
</span><span style="color:#323232;">Error: The instance is already stopped
</span><span style="color:#323232;">
</span><span style="color:#323232;"># lxc config set debian security.idmap.isolated true
</span><span style="color:#323232;">
</span><span style="color:#323232;"># lxc config get debian security.idmap.isolated
</span><span style="color:#323232;">true
</span><span style="color:#323232;">
</span><span style="color:#323232;"># lxc start debian
</span>
Now if I list the files on the container volume I’ll get they’re all owned by the host root
user:
<span style="color:#323232;"># ls -la /mnt/NVME1/lxd/containers/debian/rootfs/
</span><span style="color:#323232;">total 24
</span><span style="color:#323232;">drwxr-xr-x 1 root root 154 Sep 5 06:28 .
</span><span style="color:#323232;">d--x------ 1 296608 root 78 Sep 5 15:59 ..
</span><span style="color:#323232;">lrwxrwxrwx 1 root root 7 Sep 5 06:25 bin -> usr/bin
</span><span style="color:#323232;">drwxr-xr-x 1 root root 0 Jul 14 17:00 boot
</span><span style="color:#323232;">drwxr-xr-x 1 root root 0 Sep 5 06:28 dev
</span><span style="color:#323232;">drwxr-xr-x 1 root root 1570 Sep 5 06:28 etc
</span>
I tried multiple versions of LXD/LXC. This happens with both 5.0.2 from apt
as well with 4.0 and 5.17 (latest) from snap
.
Interestingly enough I have another Debian 10 (4.19.0-25-amd64) running and older LXD 4 from snap
and on that one things work as expected:
<span style="color:#323232;"># ls -la /mnt/NVME1/lxd/containers/debian/rootfs/
</span><span style="color:#323232;">total 0
</span><span style="color:#323232;">drwxr-xr-x 1 1065536 1065536 138 Oct 29 2020 .
</span><span style="color:#323232;">d--x------ 1 1065536 root 78 Oct 14 2020 ..
</span><span style="color:#323232;">drwxr-xr-x 1 1065536 1065536 1328 Jul 24 19:07 bin
</span><span style="color:#323232;">drwxr-xr-x 1 1065536 1065536 0 Sep 19 2020 boot
</span><span style="color:#323232;">drwxr-xr-x 1 1065536 1065536 0 Oct 14 2020 dev
</span><span style="color:#323232;">drwxr-xr-x 1 1065536 1065536 1716 Jul 24 19:08 etc
</span>
As you can see on this systems all the files are owned by 1065536:1065536
.
Update:
I tried to probe around the maps with lxc config show debian
in both machines and I saw this:
Machine running Debian 10:
<span style="color:#323232;">security.idmap.isolated: "true"
</span><span style="color:#323232;">(...)
</span><span style="color:#323232;">volatile.idmap.base: "1065536"
</span><span style="color:#323232;">volatile.idmap.current: '[{"Isuid":true,"Isgid":false,"Hostid":1065536,"Nsid":0,"Maprange":65536},{"Isuid":false,"Isgid":true,"Hostid":1065536,"Nsid":0,"Maprange":65536}]'
</span><span style="color:#323232;">volatile.idmap.next: '[{"Isuid":true,"Isgid":false,"Hostid":1065536,"Nsid":0,"Maprange":65536},{"Isuid":false,"Isgid":true,"Hostid":1065536,"Nsid":0,"Maprange":65536}]'
</span><span style="color:#323232;">volatile.last_state.idmap: '[{"Isuid":true,"Isgid":false,"Hostid":1065536,"Nsid":0,"Maprange":65536},{"Isuid":false,"Isgid":true,"Hostid":1065536,"Nsid":0,"Maprange":65536}]'
</span>
Machine running Debian 12:
<span style="color:#323232;">security.idmap.isolated: "true"
</span><span style="color:#323232;">(...)
</span><span style="color:#323232;">volatile.idmap.base: "231072"
</span><span style="color:#323232;">volatile.idmap.current: '[{"Isuid":true,"Isgid":false,"Hostid":231072,"Nsid":0,"Maprange":65536},{"Isuid":false,"Isgid":true,"Hostid":231072,"Nsid":0,"Maprange":65536}]'
</span><span style="color:#323232;">volatile.idmap.next: '[{"Isuid":true,"Isgid":false,"Hostid":231072,"Nsid":0,"Maprange":65536},{"Isuid":false,"Isgid":true,"Hostid":231072,"Nsid":0,"Maprange":65536}]'
</span><span style="color:#323232;">volatile.last_state.idmap: '[]'
</span>
Why didn’t it populate volatile.last_state.idmap: ‘[]’
?
How can I fix it? Thank you.
![](https://kbin.life/media/cache/resolve/entry_thumb/1b/36/1b366a011b4a58cb972e95f097ca073080b623f6f248681d39a3b75f0c3f23d4.png)