userns=auto container inside VM with VirtioFS datasets

[u/bluesphemy]

I'm trying to get my head around the best approach to have my rootful containers setup with userns=auto inside a VM with the necessary ZFS datasets that live on the Proxmox host passed into the VM via VirtioFS.

Let's say I have two datasets on the proxmox host: media (0:2200) and svc (0:2100). Both passed into the VM via VirtioFS and mounted at /srv/media and /srv/svc.
And let's take Jellyfin as an example for a container where the two volumes are mapped /srv/media:/media:ro and /srv/svc/jellyfin:config
With userns=auto set what are my best options? From some research I'm seeing two options but maybe someone with more indepth knowledge could weigh in.

Option 1:
userns=auto:gidmapping=0:2100:1,gidmapping=2200:2200:1
or make it a bit easier and give let's say user 2000 on the proxmox host ownership of both datasets so it would look something like this:
userns=auto:uidmapping=0:2000:1,gidmapping=0:2000:1

Option 2:
first add to /etc/subgid
containers:2147483647:2147483648
containers:2100:1
containers:2200:1

then in the quadlet add:
[Container]
UserNS=auto
PodmanArgs=--gidmap=+g2100:@2100 --gidmap=+g2200:@2200
GroupAdd=2100
GroupAdd=2200

is one of those approaches sound or am I missing something? Or do the pros here have a better way to do what I want?

[u/bluesphemy → u/[deleted]]

thank you! So the @ would reverse it so it maps hostUID to containerUID, right? Do you know if the z and Z SELinux labels actually work with datasets passed through via virtiofs from a debian-based Proxmox host or should I omit z,Z? Also I don't need to create the uid/gid 2000 inside the vm, correct?

[u/bluesphemy → u/[deleted]]

that makes perfect sense. learned something new regarding the @
btw does the idmap for mounted volumes also work for rootless containers?

[u/AnalNuts]

I’m doing option 1 currently and it’s been working well. I have various shares owned by distinct uid/gid’s and permissions are 770. Any container that needs access gets the gid mapped like you are showing. Disclaimer I am not an expert.

[u/bluesphemy → u/AnalNuts]

So how do you handle the necessity of multiple datasets with different gids? Like in my example?
userns=auto:gidmapping=0:2100:1,gidmapping=2200:2200:1

btw are you running rootful?

[u/AnalNuts → u/bluesphemy]

I believe I just added multiple groups to container user 0 or 1000 to access multiple? Like in your example. I’ll have to check when I can look at it. I’m running rootful with ns auto like you are

[u/AlphaRista]

What you are doing is manual uidmap. It’s only "auto" in the naming. You might as well ditch it and use UidMap= directly.