Cannot launch lxd instance with high uids
Metadata
Current evaluation
LXD launches failed for host UIDs above 65,535; commit 5717e2c and PR #780 now configure separate UID and GID raw.idmap entries, resolving the reported failure.
Suggested action: close resolved
Reason: The issue tracker identifies merged PR #780 as resolving this report, and git history identifies commit 5717e2c as the fix for setting UID and GID maps separately. Current code emits separate raw.idmap UID and GID entries, while the matching high-UID/GID issue #769 is also closed as fixed.
Evaluated by: mr-cal-bot
Impact:
65
Quick Win:
40
Complexity:
35
Confidence:
98
Actionability:
95
Issue body
### Overview
If the current user's uid (user id) is greater than 65,535, then craft-providers will fail to launch a LXD instance.
### Details
Craft-providers [sets the id map](https://github.com/canonical/craft-providers/blob/adc7860d52ba984957433e5331a98eb044239bc6/craft_providers/lxd/launcher.py#L381) so the host's working directory can be mounted in the instance. On the other side, LXD does UID/GID mapping for security reasons (see more [here](https://linuxcontainers.org/lxd/docs/latest/userns-idmap/)).
When craft-providers launches a container with the config `raw.idmap=both <uid> 0`, LXD fails with `Error: Failed instance creation: Failed creating instance record: Failed initialising instance: Host id is in the range of subids`.
High uids occur in enterprise deployments where technologies like NIS, SSSD, and/or Active Directory are being used.
### Possible solutions
If uid>65,535, then:
1. warn and provide a link to the documentation
2. update the `charmcraft` project in LXD to accommodate high uids (`security.idmap.base`, `security.idmap.size`)
### Source
- https://github.com/canonical/charmcraft/issues/1054
- https://github.com/canonical/lxd/issues/11600
- https://discourse.charmhub.io/t/using-charmcraft-with-very-high-uids/7208
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha |
Impact:
65
Quick Win:
40
Complexity:
35
Confidence:
98
Actionability:
95
|
close resolved | LXD launches failed for host UIDs above 65,535; commit 5717e2c and PR #780 now configure separate UID and GID raw.idmap entries, resolving the reported failure. | |
| stealth/space-bunny-alpha |
Impact:
52
Quick Win:
36
Complexity:
27
Confidence:
96
Actionability:
94
|
close resolved | Reported LXD launch failures for host UIDs above 65,535 were resolved by merged PR #780, which introduced separate UID/GID mapping; matching report #769 is closed. | |
| qwen3.6-35b-a3b-mtp-q6 |
Impact:
45
Quick Win:
20
Staleness:
65
Complexity:
55
Confidence:
75
Support Request:
15
|
keep open | Bug preventing LXD instance launch for users with UID > 65,535. Acknowledged by maintainer, no fix yet, workaround available. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
75
Complexity:
60
Confidence:
85
Support Request:
10
|
keep open | Bug where craft-providers fails to launch LXD instances for users with UIDs over 65,535 due to LXD mapping limits. Acknowledged by maintainer, currently stalled with a workaround available. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
75
Complexity:
45
Confidence:
85
Support Request:
10
|
keep open | Valid bug where craft-providers fails to launch LXD instances for users with UIDs > 65535. Acknowledged by maintainer, includes a workaround, but no progress has been made. |
Update history
No update history recorded yet.
Related work
-
Likely Fixed By:
craft-providers#780
(confidence 98%)
Commit 5717e2c changes LXD idmap handling to configure UID and GID separately, matching the reported raw.idmap failure.
-
Related To:
craft-providers#769
(confidence 98%)
Matching high-UID/GID LXD idmap report is closed as fixed.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #769 LXD idmap improperly set for high uids and gids | craft-providers | closed | Fixed by merged PR #98 (76a2d3a): LXD raw.idmap now maps the host UID and GID separately, correcting ownership for high, mismatched IDs. | |
| #97 Filesystem uid mapping incorrect in lxd instance | craft-providers | closed | LXD host-mount ID mapping was fixed by #98 (05d4834), then refined by merged #780 (5717e2c), which sets UID and GID maps separately. | |
| #1054 Charmcraft fails to launch LXD instance with high uid (`raw.idmap=both 595156457 0`) | charmcraft | open | High host UID causes LXD launch failure via raw.idmap=both; diagnosed as craft-providers idmap issue, fixed upstream by separate uid/gid maps and charmcraft now depends on fixed version. | |
| #1385 lxd: Don't assume user ID to 1000 for raw.idmap | snapcraft | merged | Merged PR #1385 as commit e85e0779b, removing LXD raw.idmap's hard-coded UID 1000 assumption for Launchpad bug 1700703; PR #1904 later corrected mapping order. |