Cannot start an LXD container when the subuid and subgid information for root are changed

Question

New to LXD and running into a problem where I am trying to build a subuid and subgid map for the root user of my container so that when root writes to the directory /megalith, it will be the UID/GID of the host user (1000:1000) rather than uid/gid of 165536:65536. I am trying to follow the instructions that are listed here:

http://insights.ubuntu.com/2016/12/08/mounting-your-home-directory-in-lxd/

But when I try to start the container, I receive the errors listed below. If I return the root subuid and subgid entries back to root:165536:65536 though, everything starts to work properly, except that when I write to /megalith, the UID and GID are 165536:65536 obviously.

Is there anything else that I need to do to make the root subuid and subgid mappings work properly that may not be in the documentation or that I may be missing?

cliff@reventon /megalith $ id
uid=1000(cliff) gid=1000(cliff) groups=1000(cliff),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),113(lpadmin),130(sambashare),132(lxd)

cliff@reventon /megalith $ cat /etc/subuid
cliff:100000:65536
lxd:165536:65536
root:1000:1

cliff@reventon /megalith $ cat /etc/subgid
cliff:100000:65536
lxd:165536:65536
root:1000:1

cliff@reventon /megalith $ lxc init ubuntu-daily:z zestytest
Creating zestytest

cliff@reventon /megalith $ lxc config set zestytest raw.idmap 'both 1000 1000'

cliff@reventon /megalith $ lxc config device add zestytest megalith disk source=/megalith path=/megalith
Device megalith added to zestytest

cliff@reventon /megalith $ lxc start zestytest
error: Error calling 'lxd forkstart zestytest /var/lib/lxd/containers /var/log/lxd/zestytest/lxc.conf': err='exit status 1'
  lxc 20170112215311.265 ERROR lxc_start - start.c:lxc_spawn:1163 - Failed to set up id mapping.
  lxc 20170112215311.303 ERROR lxc_start - start.c:__lxc_start:1338 - Failed to spawn container "zestytest".
  lxc 20170112215311.855 ERROR lxc_conf - conf.c:run_buffer:347 - Script exited with status 1
  lxc 20170112215311.855 ERROR lxc_start - start.c:lxc_fini:546 - Failed to run lxc.hook.post-stop for container "zestytest".
  lxc 20170112215311.858 ERROR lxc_conf - conf.c:userns_exec_1:4374 - Error setting up child mappings
  lxc 20170112215311.858 ERROR lxc_cgfsng - cgroups/cgfsng.c:recursive_destroy:1274 - Error destroying /sys/fs/cgroup/systemd//lxc/zestytest
  lxc 20170112215311.861 ERROR lxc_conf - conf.c:userns_exec_1:4374 - Error setting up child mappings
  lxc 20170112215311.861 ERROR lxc_cgfsng - cgroups/cgfsng.c:recursive_destroy:1274 - Error destroying /sys/fs/cgroup/cpuset//lxc/zestytest
  lxc 20170112215311.864 ERROR lxc_conf - conf.c:userns_exec_1:4374 - Error setting up child mappings
  lxc 20170112215311.864 ERROR lxc_cgfsng - cgroups/cgfsng.c:recursive_destroy:1274 - Error destroying /sys/fs/cgroup/hugetlb//lxc/zestytest
  lxc 20170112215311.867 ERROR lxc_conf - conf.c:userns_exec_1:4374 - Error setting up child mappings
  lxc 20170112215311.867 ERROR lxc_cgfsng - cgroups/cgfsng.c:recursive_destroy:1274 - Error destroying /sys/fs/cgroup/cpu//lxc/zestytest
  lxc 20170112215311.869 ERROR lxc_conf - conf.c:userns_exec_1:4374 - Error setting up child mappings
  lxc 20170112215311.869 ERROR lxc_cgfsng - cgroups/cgfsng.c:recursive_destroy:1274 - Error destroying /sys/fs/cgroup/pids//lxc/zestytest
  lxc 20170112215311.872 ERROR lxc_conf - conf.c:userns_exec_1:4374 - Error setting up child mappings
  lxc 20170112215311.872 ERROR lxc_cgfsng - cgroups/cgfsng.c:recursive_destroy:1274 - Error destroying /sys/fs/cgroup/perf_event//lxc/zestytest
  lxc 20170112215311.875 ERROR lxc_conf - conf.c:userns_exec_1:4374 - Error setting up child mappings
  lxc 20170112215311.875 ERROR lxc_cgfsng - cgroups/cgfsng.c:recursive_destroy:1274 - Error destroying /sys/fs/cgroup/freezer//lxc/zestytest
  lxc 20170112215311.878 ERROR lxc_conf - conf.c:userns_exec_1:4374 - Error setting up child mappings
  lxc 20170112215311.878 ERROR lxc_cgfsng - cgroups/cgfsng.c:recursive_destroy:1274 - Error destroying /sys/fs/cgroup/memory//lxc/zestytest
  lxc 20170112215311.881 ERROR lxc_conf - conf.c:userns_exec_1:4374 - Error setting up child mappings
  lxc 20170112215311.881 ERROR lxc_cgfsng - cgroups/cgfsng.c:recursive_destroy:1274 - Error destroying /sys/fs/cgroup/net_cls//lxc/zestytest
  lxc 20170112215311.884 ERROR lxc_conf - conf.c:userns_exec_1:4374 - Error setting up child mappings
  lxc 20170112215311.884 ERROR lxc_cgfsng - cgroups/cgfsng.c:recursive_destroy:1274 - Error destroying /sys/fs/cgroup/devices//lxc/zestytest
  lxc 20170112215311.886 ERROR lxc_conf - conf.c:userns_exec_1:4374 - Error setting up child mappings
  lxc 20170112215311.886 ERROR lxc_cgfsng - cgroups/cgfsng.c:recursive_destroy:1274 - Error destroying /sys/fs/cgroup/blkio//lxc/zestytest

Try `lxc info --show-log zestytest` for more info

score 0 · Answer 1 · answered Jan 19 '17 at 09:48

0

If I return the root subuid and subgid entries back to root:165536:65536

You need both the 165536:65536 and the 1000:1 ranges.

The former to hold the bulk of the uids/gids used inside the container, the later to map your uid/gid to stay the same inside the container.

answered Jan 19 '17 at 09:48

vila

1

Thanks for your help! Still seeing the issue after your suggestion. Here is my /etc/subuid and /etc/subgid now: `cliff@reventon ~ $ cat /etc/subuid cliff:100000:65536 lxd:165536:65536 root:165536:65536 root:1000:1 cliff@reventon ~ $ cat /etc/subgid cliff:100000:65536 lxd:165536:65536 root:16553:65536 root:1000:1 ` I restarted lxd using `sudo service lxd restart`, which seemed to work. When I tried touching a file again though in the bindmounted directory /megalith, I still got the UID:GID 165536:16553 instead of 1000:1000. – Cliff Friedel Jan 21 '17 at 02:57

score 0 · Answer 2 · answered Dec 06 '17 at 01:04

Not quite sure if this addresses your question: https://github.com/lxc/lxc/issues/1622

The gist of that thread is that it's unsafe/non-sensical to map a host uid and/or host gid to the container root uid and/or gid. If you want to do what you describe, you should map to the default container user or create a new container user and run your commands with that container user. Then you can map the host uid/gid to that container uid/gid.

Cannot start an LXD container when the subuid and subgid information for root are changed

2 Answers2