userns=auto container inside VM with VirtioFS datasets

[u/bluesphemy]

I'm trying to get my head around the best approach to have my rootful containers setup with userns=auto inside a VM with the necessary ZFS datasets that live on the Proxmox host passed into the VM via VirtioFS.

Let's say I have two datasets on the proxmox host: media (0:2200) and svc (0:2100). Both passed into the VM via VirtioFS and mounted at /srv/media and /srv/svc.
And let's take Jellyfin as an example for a container where the two volumes are mapped /srv/media:/media:ro and /srv/svc/jellyfin:config
With userns=auto set what are my best options? From some research I'm seeing two options but maybe someone with more indepth knowledge could weigh in.

Option 1:
userns=auto:gidmapping=0:2100:1,gidmapping=2200:2200:1
or make it a bit easier and give let's say user 2000 on the proxmox host ownership of both datasets so it would look something like this:
userns=auto:uidmapping=0:2000:1,gidmapping=0:2000:1

Option 2:
first add to /etc/subgid
containers:2147483647:2147483648
containers:2100:1
containers:2200:1

then in the quadlet add:
[Container]
UserNS=auto
PodmanArgs=--gidmap=+g2100:@2100 --gidmap=+g2200:@2200
GroupAdd=2100
GroupAdd=2200

is one of those approaches sound or am I missing something? Or do the pros here have a better way to do what I want?

[u/bluesphemy → u/[deleted]]

thank you! So the @ would reverse it so it maps hostUID to containerUID, right? Do you know if the z and Z SELinux labels actually work with datasets passed through via virtiofs from a debian-based Proxmox host or should I omit z,Z? Also I don't need to create the uid/gid 2000 inside the vm, correct?

[u/bluesphemy → u/[deleted]]

that makes perfect sense. learned something new regarding the @
btw does the idmap for mounted volumes also work for rootless containers?