Incus does not respect /etc/sub*id

[FlyingWombat]

Describe the bug

Incus does not respect subuid/subgid mappings set in /etc/sub*id.

Steps To Reproduce

Steps to reproduce the behavior:

1. If you already have incus installed, run sudo mv /var/lib/incus /var/lib/incus.bk
2. nixos config

  users.users.root.subGidRanges = lib.mkForce [
    { count = 65536; startGid = 2000000; }
  ];
  users.users.root.subUidRanges = lib.mkForce [
    { count = 65536; startUid = 2000000; }
  ];
  virtualisation.incus.enable = true;
  virtualisation.lxc.defaultConfig = ''
    lxc.idmap = u 0 2000000 65536
    lxc.idmap = g 0 2000000 65536
  '';

3. check that /etc/sub*id is set correctly with cat /etc/sub{gid,uid}
4. run sudo incus admin init --minimal
5. run sudo incus launch images:archlinux/current/amd64 test
6. run sudo incus config show test

volatile.idmap.current: '[{"Isuid":true,"Isgid":false,"Hostid":1000000,"Nsid":0,"Maprange":1000000000},{"Isuid":false,"Isgid":true,"Hostid":1000000,"Nsid":0,"Maprange":1000000000}]'

Notice how Hostid and Maprange are wrong.

Expected behavior

volatile.idmap.current: '[{"Isuid":true,"Isgid":false,"Hostid":2000000,"Nsid":0,"Maprange":65536},{"Isuid":false,"Isgid":true,"Hostid":2000000,"Nsid":0,"Maprange":65536}]'

Additional context

My incus installation in Archlinux generates idmap correctly.
If the same is done with LXD, the idmap is generated correctly.

Incus docs /userns-idmap.md:40

If none of those files can be found, then Incus will assume a 1000000000
UID/GID range starting at a base UID/GID of 1000000.

BTW, docs for users.users.<name>.autoSubUidGidRange is misleading. It says "Default: false". This should read "Default: config.isNormalUser && config.subUidRanges == [] && config.subGidRanges == []"

Notify maintainers

@aanderse
@adamcstephens
@jnsgruk
@megheaiulian
@mkg20001

Metadata

• system: "x86_64-linux"
• host os: Linux 6.7.4, NixOS, 24.05 (Uakari), 24.05.20240212.aff1ac0
• multi-user?: yes
• sandbox: yes
• version: nix-env (Nix) 2.18.1
• channels(root): "nixos"
• nixpkgs: /run/current-system/nixpkgs commit d934204

---

Add a 👍 reaction to issues you find important.

[adamcstephens]

I wonder if this is related to lxc/incus#575 . I haven't had a chance to troubleshoot myself, but would like to get it resolved.

[adamcstephens]

I noticed errors around newuidmap missing, which could be related to this issue. Added in #307218

[adamcstephens]

Well I can confirm #307218 does in fact improve Incus's handling of the id ranges. Since it caused my containers to fail to start as I was missing a range I had manually added to instances.

[adamcstephens]

@FlyingWombat if you're able to confirm it fixes your described issue, I'd appreciate it.

[FlyingWombat]

@adamcstephens With the changes in the linked pull request, Incus seems to be working as expected.

[adamcstephens]

Thank you for testing!