<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 10pt; color: #000000"><div>Hello Fajar,</div><div><br data-mce-bogus="1"></div><div>Thanks , "<span style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 13.3333px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 13.3333px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;">fuidshift" is what I was looking for :)<br>It's working . I already made my own script to move it from one host (LXC) to the other one (LXD) . I guess the one that you were talking about is : https://github.com/lxc/lxd/blob/master/scripts/lxc-to-lxd</span></div><div><span style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 13.3333px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 13.3333px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;"><br data-mce-bogus="1"></span></div><div><span style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 13.3333px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 13.3333px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;">Have a nice day</span></div><div><br></div><div data-marker="__SIG_PRE__"><div><span style="color: rgb(51, 51, 51); font-family: times new roman,new york,times,serif;" data-mce-style="color: #333333; font-family: times new roman,new york,times,serif;">Cordialement,</span><span style="color: rgb(51, 51, 51); font-family: times new roman,new york,times,serif; font-weight: bold;" data-mce-style="color: #333333; font-family: times new roman,new york,times,serif; font-weight: bold;"><span style="color: rgb(51, 51, 51); font-family: times new roman,new york,times,serif; font-weight: bold;" data-mce-style="color: #333333; font-family: times new roman,new york,times,serif; font-weight: bold;"><br></span></span></div><div><br></div><div><span style="color: rgb(51, 51, 51); font-family: times new roman,new york,times,serif; font-weight: bold;" data-mce-style="color: #333333; font-family: times new roman,new york,times,serif; font-weight: bold;">Benoît</span><span style="color: rgb(51, 51, 51); font-family: times new roman,new york,times,serif; font-weight: bold;" data-mce-style="color: #333333; font-family: times new roman,new york,times,serif; font-weight: bold;"><br></span></div></div><br><hr id="zwchr" data-marker="__DIVIDER__"><div data-marker="__HEADERS__"><b>De: </b>"Fajar A. Nugraha" <list@fajar.net><br><b>À: </b>"lxc-users" <lxc-users@lists.linuxcontainers.org><br><b>Envoyé: </b>Lundi 11 Juillet 2016 02:16:34<br><b>Objet: </b>Re: [lxc-users] move unprivileged containers - uid/gid map<br></div><br><div data-marker="__QUOTED_TEXT__"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Sun, Jul 10, 2016 at 7:20 AM, Benoit GEORGELIN - Association Web4all <span dir="ltr"><<a href="mailto:benoit.georgelin@web4all.fr" target="_blank">benoit.georgelin@web4all.fr</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left: 1px solid #cccccc; padding-left: 1ex;" data-mce-style="margin: 0px 0px 0px 0.8ex; border-left: 1px solid #cccccc; padding-left: 1ex;"><div><div style="font-family: arial,helvetica,sans-serif; font-size: 10pt; color: #000000;" data-mce-style="font-family: arial,helvetica,sans-serif; font-size: 10pt; color: #000000;"><div>Hi,</div><br><div>I'm looking to move unprivileged containers from one host to another. <br>I'm actually moving pure LXC containers to a new LXD/LXC host</div><br><div>I would like to know how should I deal with the uid/gid inside the container.</div><div>The root uid/gid is différent on the new host. But I can simply remplace the old UID/GUID by the new one with a find request but how should I do with the other users id used inside the container ?</div><br></div></div></blockquote><br><div>use fuidshift from lxd-tools package</div><br><div> </div><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left: 1px solid #cccccc; padding-left: 1ex;" data-mce-style="margin: 0px 0px 0px 0.8ex; border-left: 1px solid #cccccc; padding-left: 1ex;"><div><div style="font-family: arial,helvetica,sans-serif; font-size: 10pt; color: #000000;" data-mce-style="font-family: arial,helvetica,sans-serif; font-size: 10pt; color: #000000;"><div>I did not understand where the uid/gid map is done </div><div><br>Inside the container</div><div>root@w4a:~# id ubuntu<br>uid=1000(ubuntu) gid=1000(ubuntu) </div><br><div>Folder :</div><div>drwxr-xr-x 2 ubuntu ubuntu 6 Jul 8 23:17 ubuntu</div><br><div>Outside the container </div><div>drwxr-xr-x 2 166536 166536 6 Jul 8 23:17 ubuntu</div><br><div>How the system know about uid/gid 1000 inside container = uid/gid <span style="color: #000000; font-family: arial,helvetica,sans-serif; font-size: 13.3333px; font-style: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; float: none; display: inline!important; background-color: #ffffff;" data-mce-style="color: #000000; font-family: arial,helvetica,sans-serif; font-size: 13.3333px; font-style: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; float: none; display: inline!important; background-color: #ffffff;">166536 outside the container </span></div><div>It look like root uid = 165536 outside the container and it is defined by lxc configuration <br>id 1000 inside the container will be root uid + user id , so 165536 + 1000 = <span style="color: #000000; font-family: arial,helvetica,sans-serif; font-size: 13.3333px; font-style: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; float: none; display: inline!important; background-color: #ffffff;" data-mce-style="color: #000000; font-family: arial,helvetica,sans-serif; font-size: 13.3333px; font-style: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; float: none; display: inline!important; background-color: #ffffff;">166536 </span></div><div><span style="color: #000000; font-family: arial,helvetica,sans-serif; font-size: 13.3333px; font-style: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; float: none; display: inline!important; background-color: #ffffff;" data-mce-style="color: #000000; font-family: arial,helvetica,sans-serif; font-size: 13.3333px; font-style: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; float: none; display: inline!important; background-color: #ffffff;"><br></span></div></div></div></blockquote><br><div>yes</div><br><div> </div><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left: 1px solid #cccccc; padding-left: 1ex;" data-mce-style="margin: 0px 0px 0px 0.8ex; border-left: 1px solid #cccccc; padding-left: 1ex;"><div><div style="font-family: arial,helvetica,sans-serif; font-size: 10pt; color: #000000;" data-mce-style="font-family: arial,helvetica,sans-serif; font-size: 10pt; color: #000000;"><div><span style="color: #000000; font-family: arial,helvetica,sans-serif; font-size: 13.3333px; font-style: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; float: none; display: inline!important; background-color: #ffffff;" data-mce-style="color: #000000; font-family: arial,helvetica,sans-serif; font-size: 13.3333px; font-style: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; float: none; display: inline!important; background-color: #ffffff;"></span></div><div><span style="color: #000000; font-family: arial,helvetica,sans-serif; font-size: 13.3333px; font-style: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; float: none; display: inline!important; background-color: #ffffff;" data-mce-style="color: #000000; font-family: arial,helvetica,sans-serif; font-size: 13.3333px; font-style: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; float: none; display: inline!important; background-color: #ffffff;">But what is two container have a user uid 100 ? they will both avec the same uid outside the container ? </span></div><div><span style="color: #000000; font-family: arial,helvetica,sans-serif; font-size: 13.3333px; font-style: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; float: none; display: inline!important; background-color: #ffffff;" data-mce-style="color: #000000; font-family: arial,helvetica,sans-serif; font-size: 13.3333px; font-style: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; float: none; display: inline!important; background-color: #ffffff;"><br></span></div></div></div></blockquote><br><div>short version, yes.</div><br><div> <br></div><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left: 1px solid #cccccc; padding-left: 1ex;" data-mce-style="margin: 0px 0px 0px 0.8ex; border-left: 1px solid #cccccc; padding-left: 1ex;"><div><div style="font-family: arial,helvetica,sans-serif; font-size: 10pt; color: #000000;" data-mce-style="font-family: arial,helvetica,sans-serif; font-size: 10pt; color: #000000;"><div><span style="color: #000000; font-family: arial,helvetica,sans-serif; font-size: 13.3333px; font-style: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; float: none; display: inline!important; background-color: #ffffff;" data-mce-style="color: #000000; font-family: arial,helvetica,sans-serif; font-size: 13.3333px; font-style: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; float: none; display: inline!important; background-color: #ffffff;"></span></div><div><span style="font-size: 13.3333px;" data-mce-style="font-size: 13.3333px;">About migrate the container from, how should I manage it ?</span></div><div><span style="font-size: 13.3333px;" data-mce-style="font-size: 13.3333px;">Should I re-do the mapping myself ? Like looking into /etc/passwd inside the container then use the root uid + the id found for that user in /etc/passwd and replace the old uid/gid by the new one ? Maybe there is faster/better solution ?</span></div><div><span style="font-size: 13.3333px;" data-mce-style="font-size: 13.3333px;"><br></span></div></div></div></blockquote><br><div>Don't mess with passwd/group inside the container. Just use fuidshift.</div><br><div> </div><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left: 1px solid #cccccc; padding-left: 1ex;" data-mce-style="margin: 0px 0px 0px 0.8ex; border-left: 1px solid #cccccc; padding-left: 1ex;"><div><div style="font-family: arial,helvetica,sans-serif; font-size: 10pt; color: #000000;" data-mce-style="font-family: arial,helvetica,sans-serif; font-size: 10pt; color: #000000;"><div><span style="font-size: 13.3333px;" data-mce-style="font-size: 13.3333px;"></span></div><div><span style="font-size: 13.3333px;" data-mce-style="font-size: 13.3333px;">I was looking to add an uid/gid mapping to match the container configuration as it was before, but it does not look to work </span></div><div><span style="font-size: 13.3333px;" data-mce-style="font-size: 13.3333px;"><br></span></div><div><span style="font-size: 13.3333px;" data-mce-style="font-size: 13.3333px;">I have this as an example in a config file dedicated for the container on the LXC pure host. </span></div><div><span style="font-size: 13.3333px;" data-mce-style="font-size: 13.3333px;"># Container specific configuration<br>lxc.id_map = u 0 951968 65536<br>lxc.id_map = g 0 951968 65536<br></span></div><div><span style="font-size: 13.3333px;" data-mce-style="font-size: 13.3333px;"><br></span></div><div>Here is what I did to the new host : </div><div>cat /etc/subuid<br>gxd:100000:65536<br>root:165536:65536<br>root:951968:65536<br></div><br></div></div></blockquote><br><br><div>The easiest way is to NOT change anything. lxd currently only supports one uid range for unpriv containers. Undo your changes.</div><br><div> </div><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left: 1px solid #cccccc; padding-left: 1ex;" data-mce-style="margin: 0px 0px 0px 0.8ex; border-left: 1px solid #cccccc; padding-left: 1ex;"><div><div style="font-family: arial,helvetica,sans-serif; font-size: 10pt; color: #000000;" data-mce-style="font-family: arial,helvetica,sans-serif; font-size: 10pt; color: #000000;"><div>I also tried to set lxc.raw </div><br><div>cat << EOF |lxc config set test-ct raw.lxc -<br>lxc.id_map = u 0 <span style="color: #000000; font-family: arial,helvetica,sans-serif; font-size: 13.3333px; font-style: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; float: none; display: inline!important; background-color: #ffffff;" data-mce-style="color: #000000; font-family: arial,helvetica,sans-serif; font-size: 13.3333px; font-style: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; float: none; display: inline!important; background-color: #ffffff;">951968 65536</span><br>lxc.id_map = g 0 <span style="color: #000000; font-family: arial,helvetica,sans-serif; font-size: 13.3333px; font-style: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; float: none; display: inline!important; background-color: #ffffff;" data-mce-style="color: #000000; font-family: arial,helvetica,sans-serif; font-size: 13.3333px; font-style: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; float: none; display: inline!important; background-color: #ffffff;">951968 65536</span><br>EOF<br></div><div><span style="font-size: 13.3333px;" data-mce-style="font-size: 13.3333px;"><br></span></div><div><span style="font-size: 13.3333px;" data-mce-style="font-size: 13.3333px;">But in that case, container does't start.</span></div><div><span style="font-size: 13.3333px;" data-mce-style="font-size: 13.3333px;"><br></span></div></div></div></blockquote><br></div><br></div><div class="gmail_extra">... which, as you've found out, doesn't work.</div><div class="gmail_extra"><br></div><div class="gmail_extra"><br></div><div class="gmail_extra">There's a script to convert lxc -> lxd somewhere on this list, but I usually do things manually:</div><div class="gmail_extra">(1) create a container in lxd. Start it, stop it, then look at its uid mapping (i.e. "which u/gid owns /var/lib/lxd/containers/container_name/rootfs")</div><div class="gmail_extra">(2) use fuidshift with "-r" to shift your lxc container u/gid back to privileged, using the starting u/gid value in your original lxc config (should be <span style="color: #000000; font-family: arial,helvetica,sans-serif; font-size: 13.3333px;" data-mce-style="color: #000000; font-family: arial,helvetica,sans-serif; font-size: 13.3333px;">951968)</span></div><div class="gmail_extra"><span color="#000000" face="arial, helvetica, sans-serif" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif;" style="color: #000000; font-family: arial, helvetica, sans-serif;"><span style="font-size: 13.3333px;" data-mce-style="font-size: 13.3333px;">(3) use fuidshift again, but this time without "-r", to shift your lxc container to unprivileged, using the starting u/gid value from (1)</span></span></div><div class="gmail_extra"><span color="#000000" face="arial, helvetica, sans-serif" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif;" style="color: #000000; font-family: arial, helvetica, sans-serif;"><span style="font-size: 13.3333px;" data-mce-style="font-size: 13.3333px;">(4) move your new lxd container's original rootfs somewhere else (or delete it if you want), then replace it with rootfs from (3)</span></span></div><div class="gmail_extra"><span color="#000000" face="arial, helvetica, sans-serif" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif;" style="color: #000000; font-family: arial, helvetica, sans-serif;"><span style="font-size: 13.3333px;" data-mce-style="font-size: 13.3333px;">(5) start your lxd containers</span></span></div><div class="gmail_extra"><br></div><div class="gmail_extra">-- </div><div class="gmail_extra">Fajar</div></div>
<br>_______________________________________________<br>lxc-users mailing list<br>lxc-users@lists.linuxcontainers.org<br>http://lists.linuxcontainers.org/listinfo/lxc-users<br></div></div></body></html>