uid_map limit workaround

[micha2025]

Hello, my nested container that I want to be running podman in rootless mode has available only 65536 uid/gid.

cat /proc/self/uid_map                              
         0     100000      65536

So I can't give namespace range 100000-165536 to my user as documentation recommends.
I would rather like to avoid increasing number of uid/gid in my container, is there any workaround?
I tried to put into /etc/subuid and /etc/subgid this:

user:1100:64436 

But it doesn't seem to be working.
Is there any workaround for this problem?

[eriksjolund]

as documentation recommends.

Are you referring to troubleshooting tip 10 rootless setup user: invalid argument?

If you want to map a very high container UID and GID ( $uid:$gid) to the regular user on the host you can
add --userns=keep-id:uid=$uid,gid=$gid

$ uid=1000000
$ gid=1000000
$ podman run --rm --userns=keep-id:uid=$uid,gid=$gid --user $uid:$gid alpine id
uid=1000000(1000000) gid=1000000(1000000) groups=1000000(1000000)

[micha2025]

Hi, thank you for the answer! The problem is, I cannot even run podman ps as a non-root user.

podman ps
ERRO[0000] running `/usr/bin/newuidmap 1500649 0 1000 1 1 1100 64400`: newuidmap: open of uid_map failed: Permission denied 
Error: cannot setup namespace using "/usr/bin/newuidmap": exit status 1

cat /etc/subgid
user:1100:64400

[eriksjolund]

Hi, thank you for the answer! The problem is, I cannot even run podman ps as a non-root user.

podman ps
ERRO[0000] running `/usr/bin/newuidmap 1500649 0 1000 1 1 1100 64400`: newuidmap: open of uid_map failed: Permission denied 
Error: cannot setup namespace using "/usr/bin/newuidmap": exit status 1

cat /etc/subgid
user:1100:64400

As an experiment I tried rootless single mapping

1. Create user

   sudo useradd test
   

2. Remove the lines for the user test in the files /etc/subuid and /etc/subgid
3. Start a login shell for the user test

   sudo machinectl shell --uid=test
   

4. Create directory

   mkdir ~/dir
   

5. Set shell variable

   uid=100000
   

6. Set shell variable

   gid=100000
   

7. Run command

   podman \
      --storage-driver=overlay \
      --storage-opt overlay.mount_program=/usr/bin/fuse-overlayfs \
      --storage-opt overlay.ignore_chown_errors=true \
      run \
         --rm \
         --uidmap +${uid}:@$(id -u):1 \
         --gidmap +${gid}:@$(id -g):1 \
         --user ${uid}:${gid} \
         --sysctl="net.ipv4.ping_group_range=$uid $uid" \
         -v ./dir:/dir:Z docker.io/library/alpine \
           sh -c "id ; touch /dir/file"
   

   The following output is printed

   uid=100000(100000) gid=100000(100000) groups=100000(100000)
   

8. List files in directory

    ls -l ~/dir/
   

   The following output is printed

   total 0
   -rw-r--r--. 1 test test 0 Nov 30 17:11 file
   

result The file that was created has the ownership of the regular user on the host. The container ran as the container user 100000:100000.