Skip to content

Please point out the upstream "id-mapped mount" feature #186

Description

@thejh

Upstream Linux now has a feature to create "id-mapped mounts", which remap UID and GID ranges if the filesystem supports it. That partly addresses the same problem as bindfs. It might be useful to point this out on the bindfs homepage.

See the mount manpage: https://man7.org/linux/man-pages/man8/mount.8.html

       --map-groups, --map-users inner:_outer_:_count_
           Add the specified user/group mapping to an X-mount.idmap map.
           These options can be given multiple times to build up complete
           mappings for users and groups. For more details see
           X-mount.idmap below.
[...]
       X-mount.idmap=id-type:id-mount:id-host:id-range
       [id-type:id-mount:id-host:id-range], X-mount.idmap=file
           Use this option to create an idmapped mount. An idmapped mount
           allows to change ownership of all files located under a mount
           according to the ID-mapping associated with a user namespace.
           The ownership change is tied to the lifetime and localized to
           the relevant mount. The relevant ID-mapping can be specified
           in two ways:

           •   A user can specify the ID-mapping directly.

               The ID-mapping must be specified using the syntax
               id-type:id-mount:id-host:id-range. Specifying u as the
               id-type prefix creates a UID-mapping, g creates a
               GID-mapping and omitting id-type or specifying b creates
               both a UID- and GID-mapping. The id-mount parameter
               indicates the starting ID in the new mount. The id-host
               parameter indicates the starting ID in the filesystem. The
               id-range parameter indicates how many IDs are to be
               mapped. It is possible to specify multiple ID-mappings.

               The individual ID mappings must be separated by spaces.
               Please note that in the /etc/fstab file, spaces are
               interpreted as separators between fields. To avoid this,
               you must escape them using \040. For example,
               X-mount.idmap=0:0:1\040500:1000:1.

               For example, the ID-mapping X-mount.idmap=u:1000:0:1
               g:1001:1:2 5000:1000:2 creates an idmapped mount where UID
               0 is mapped to UID 1000, GID 1 is mapped to GUID 1001, GID
               2 is mapped to GID 1002, UID and GID 1000 are mapped to
               5000, and UID and GID 1001 are mapped to 5001 in the
               mount.

               When an ID-mapping is specified directly a new user
               namespace will be allocated with the requested ID-mapping.
               The newly created user namespace will be attached to the
               mount.
[...]

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions