UID mapping for disk sharing and UID process

[toby63]

Hi,

I recommend shiftfs.

@Olivier

I see shiftfs , but is it a viable solution? I didn’t see much documentation about it and this looks relatively new.

It is in use and activated by default in Ubuntu, it is considered stable.
See for example: Trying out `shiftfs` - #58 by brauner

“Documentation” is in the Forum (for now):

Share folders and volumes between host and containers

Note: In recent kernels (>5.12) a new approach called “idmapped mounts” is directly included in the Linux kernel. It acts as a replacement/sucessor of shiftfs and uses all the below mentioned commands as well. It only supports ext4, xfs, vfat and btrfs (>5.15) for the underlying filesystems of LXD for now, but ZFS and cephfs are planned to be included as well. If you use unsupported filesystems or older kernels, stick with shiftfs for now. Usecases: General Advantages: faster startup o…

Regarding Security of shiftfs:

@Olivier

Does it mean that if someone breaks out of the container they will have access to the host as the 1000 user? Does not this defeat the goal of UID-shifting?

Note: This explanation is for shiftfs!
Not really, It’s more complicated than that.
Users from the container will not have host access.
But a root or sudo user inside a container can set the uid of a file on the host and then a user on the host could use it to get root access.
But there are ways to prevent it.
See:
Trying out shiftfs - comment 48
Trying out shiftfs - comment 54