Follow-up to Bug #1300369: Server guide misleading/incorrect

[paranoya]

Following the instructions in the server guide for basic unprivileged usage for LXC containers I get the following error message:

newuidmap: uid range [0-1) -> [100000-100001) not allowed
error mapping child
setgid: Invalid argument
lxc-create: lxccontainer.c: do_create_container_dir: 978 Failed to chown container dir
lxc-create: lxc_create.c: main: 316 Error creating container u1

The guide states "The example below assumes that your mapped user and group id ranges are 100000-165536." Unfortunately it is nowhere explained, how to do that mapping.

System is Ubuntu Server 16.04.

[Doug Smythies (dsmythies)]

Is this a problem with the documentation or a problem with the default mapped user and group ranges?
In 14.04 the default user range is 100000:65536.
In 16.04 the default user range seems to be 165536:65536

14.04:
doug@serv-tt:~$ cat /etc/subgid
doug:100000:65536
doug@serv-tt:~$ cat /etc/subuid
doug:100000:65536

16.04:
doug@serv64-dev:~$ cat /etc/subuid
lxd:100000:65536
root:100000:65536
doug:165536:65536
doug@serv64-dev:~$ cat /etc/subgid
lxd:100000:65536
root:100000:65536
doug:165536:65536

When creating ~/.config/lxc/default.conf, if I use the appropriate range, then the lxc-create step works fine.

[Serge Hallyn (serge-hallyn)]

Hi Doug,

no the bug sadly is that the documentation should not assume pre-determined defaults. Nice as it would be...

[Doug Smythies (dsmythies)]

O.K. so how about this:

The example below assumes that your mapped user and group id ranges are 100000-165536. Check your actual user and group id ranges and modify the example accordingly:

grep $USER /etc/subuid
grep $USER /etc/subgid

[Serge Hallyn (serge-hallyn)]

Actually, the documentation is not wrong. subuids are in fact still started at 100000, it's just that in xenial cloud instances the first allocation goes to lxd/root.

[Serge Hallyn (serge-hallyn)]

Also, the 'User namespaces' section says:

 The list of assigned ids can be seen in the files
      <filename>/etc/subuid</filename> and <filename>/etc/subgid</filename>
      See their respective manpages for more information.
      </para>

If you think it can be clarified please do submit a merge proposal.

[Serge Hallyn (serge-hallyn)]

Sorry, Doug, didn't see your update before I changed the status.

[Serge Hallyn (serge-hallyn)]

Your suggestion sounds good. Do you want to push it, or would you prefer I do it?

[Doug Smythies (dsmythies)]

Serge, I agree that this bug report could be set to invalid, as everything that is needed is actually there. However, having struggled through it yesterday, I think adding lookup as per my comment 3 would be worthwhile. I'll do the edit.

[Serge Hallyn (serge-hallyn)]

Thanks, Doug.