User namespaces or short `userns` is a facility that allows a sub-namespace to have its own set of UIDs and GIDs. This allows to use the least privilege principle for LXC containers, but it's not limited to that use case.

learn more… | top users | synonyms

2
votes
0answers
31 views

Is it possible to register “virtual” user/group IDs in a Linux system?

Is there a standardized mechanism in Linux which can be used to tie usernames to user IDs without actually creating a system account that can log in? It would seem something like this is possible, ...
6
votes
1answer
150 views

What is an unprivileged LXC container?

What does it mean if a Linux container (LXC container) is called "unprivileged"?
4
votes
1answer
586 views

userns container fails to start, how to track down the reason?

When creating a userns (unprivileged) LXC container on Ubuntu 14.04 with the following command line: lxc-create -n test1 -t download -- -d $(lsb_release -si|tr 'A-Z' 'a-z') -r $(lsb_release -sc) -a ...
1
vote
0answers
47 views

How to influence the assignment of subordinate UIDs/GIDs when creating user accounts?

To my knowledge the subordinate UIDs and GIDs are assigned to accounts in such a manner that they form a contiguous range. The range starts at 100000 by default and probably stretches to the ...
1
vote
0answers
49 views

Subordinate GIDs/UIDs with LXC and userns for unprivileged user?

When using userns (via LXC in my case), you assign a range of subordinate GIDs and UIDs to an unprivileged user. See for resources: subuid(5), subgid(5), newuidmap(1), newgidmap(1), ...
1
vote
1answer
53 views

How do I conserve the userns UID/GID mappings when archiving an LXC guest?

I'd like to archive an existing LXC container that has been configured to run as unprivileged LXC container (see this question). How can I conserve all the file system meta-data that is used to store ...
5
votes
1answer
225 views

Migrate an unprivileged LXC container between users

I have an Ubuntu 14.04 server installation which acts as an LXC host. It has two users: user1 and user2. user1 owns an unprivileged LXC container, which uses a directory (inside ...
8
votes
1answer
691 views

Is there a tool(!) to list assigned subuid and subgid values for users?

The question is basically in the title. usermod -v (--add-sub-uids) and usermod -w (--add-sub-gids) can be used to manipulate the subuid and subgid ranges for a user account, but there appears to be ...
4
votes
1answer
2k views

Building unprivileged (userns) LXC container from scratch, by migrating a privileged container to be unprivileged

How can I build a privileged LXC (1.0.3) container (that part I know) and then migrate it successfully to be run unprivileged? That is, I'd like to debootstrap it myself or adjust the lxc-ubuntu ...