<html><head>
<style>blockquote.cite
{margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right: 0px; border-left-width: 1px; border-left-style: solid; border-left-color: rgb(204, 204, 204);}
blockquote.cite2
{margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right: 0px; border-left-width: 1px; border-left-style: solid; border-left-color: rgb(204, 204, 204); margin-top: 3px; padding-top: 0px;}
a img
{border: 0px;}
body
{font-family: Tahoma; font-size: 12pt;}
</style>
</head>
<body background=""><div>Hi,</div><div><br></div><div>I just faced a strange issue with LXD containers. I'm using them quite extensively, but never faced that before. Normally, the userID that are presented to the container (they're coming from SSSD with ActiveDirectory backend) are relatively low... 2000, 3000, that kind of ID's</div><div><br></div><div>Last friday, at the office, I built two containers (Ubuntu 16.04, CentOS 7.1) with the same kind of configuration regarding authentication; SSSD. And I notice that I wasn't able to log in via SSH. But one of my colleague was able to. We re-checke the config, just to make sure (but at the same time, it was impossible for this config to fail, as it is presented to the servers via Puppet. So the same config, and on the same OS level as other installs (we have numerous Ubuntu 16.04 with the same config, but the first one on LXD containers).</div><div><br></div><div>We were trying to find out what piece was missing when we discover that this is not just the logging that fails, but everything related to these high UserID's. They are coming from a calculation based on Windows SID's for the user, which gives a huge range of userID's, from a few thousands to tens, if not hundreds thousands. So with my user, I can't set a permission with it, and I can't login.In fact, I don't exist with this user other than using "getent passwd", or "id".</div><div><br></div><div>What can be the cause? Something to do with namespaces, maybe? cgroups?</div><div><br></div><div>We'ew in the dark. And until we can solve this, LXD containers aren't that helpful to us, unfortunately.</div><div id="signature_old"><div style="font-family: Tahoma; font-size: 12 pt;"><hr>
<p><strong>Christian Tardif</strong></p></div></div><div><br></div>
</body></html>