Stgraber.org Website Review

As you may know, LXD uses unprivileged containers by default. The difference between an unprivileged container and a privileged one is whether the root user in the container is the “real” root user (uid 0 at the kernel level). The way unprivileged containers are created is by taking a set of normal UIDs and GIDs from the host, usually at least 65536 of each (to The most common example and what most LXD users will end up with by default is a map of 65536 UIDs and GIDs, with a host base id of 100000. This means that root in the container (uid 0) will be mapped to the host uid 100000 and uid 65535 in the container will be mapped From a security point of view, that means that anything which is not owned by the users and groups mapped into the container will be means that should there be a way to escape the container, even root in the container would find itself with just as much privileges on the LXD does offer a number of options related to unprivileged configuration: In most cases you won’t have to change that. There are however a few cases where you may have to: The default map is usually controlled by the “shadow” set of utilities and files. On systems where that’s the case, the On systems that do not have a recent enough version of the “shadow” package. LXD will as*ume that it doesn’t have to share But the common case, is a system with a recent version of shadow. An example of what the configuration may look like is: The maps for “lxd” and “root” should always be kept in sync. LXD itself is restricted by the “root” allocation. The “lxd” entry is used to track what needs to be removed if LXD is uninstalled. Now if you want to increase the size of the map available to LXD. Simply edit both of the files and bump the last value from 65536 to whatever size you need. I tend to bump it to a billion just so I don’t ever have to think about it again: After altering those files, you need to restart LXD to have it detect the new map: