Support custom id mapping about lxd HOT 3 CLOSED

Ain't the proper isolation of the containers wrt UIDs and GIDs an LXC issue? I would be very interested in this feature for LXC.

from lxd.

LXC lets you do it already, making it automatic and more user friendly is where LXD comes in.

from lxd.

Instead of doing security groups, we'll just implement

 - security.idmap.size: auto (if non-isolated, all mappable uid/gid, if isolated, 65536)
 - security.idmap.isolated: false
 - raw.idmap: |-
    both 1000 1000
    uid 100 2500
    gid 10 3000
    uid 50-60 50-60

To have all containers on separate maps, the user will just need to set:

 - security.idmap.isolated: true

Which will have each container get its own chunk of 65536 uid/gid.

To have a different sized chunk you can set:

 - security.idmap.size: 1000000

Which will bump the uid/gid allocation to a million.

To setup custom maps, passing uid 1000 from the host to container, one can set:

 - raw.idmap: |-
     uid 1000 1000

Format is "type", "host", "container".
Ranges can be used for "host" and "container" (must be of same size) using "START-END" notation.

from lxd.