lxd: raw.idmap expects host and container id respectively
Metadata
Current evaluation
Merged PR #1904 fixed LXD `raw.idmap` argument order so host UID maps to container root (0), instead of mapping both IDs to the host user; commit 6bd4c9e59.
Resolution: closed resolved
Reason: The PR was merged into snapcraft as commit 6bd4c9e59 ("lxd: raw.idmap expects host and container id respectively (#1904)"). The `lxc config` call had used `both USER_ID USER_ID` instead of `both HOST_ID CONTAINER_ID`, so built files ended up owned by root. Related autopkgtest flakes were separately addressed in #1907 and #1908.
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [x] Have you followed the [guidelines for contributing](https://github.com/snapcore/snapcraft/blob/master/CONTRIBUTING.md)?
- [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [x] If this is a bugfix. Have you checked that there is a bug report open for the issue you are trying to fix on [bug reports](https://bugs.launchpad.net/snapcraft)?
- [x] If this is a new feature. Have you discussed the design on the [forum](https://forum.snapcraft.io)?
- [x] Have you successfully run `./runtests.sh static`?
- [x] Have you successfully run `./runtests.sh unit`?
-----
Fixes: [LP: #1741753](https://bugs.launchpad.net/snapcraft/+bug/1741753)
The `lxc config` call is not setting `raw.idmap` correctly. The syntax being used here is `both HOST_ID CONTAINER_ID` which means the user and group ID from the host will be mapped to the user in the container. The latter is always root, hence 0 is correct.
Without the fix, files will be written with the actual user ID from the container, so they're effectively owned by root, causing the problem.
Manual steps to test:
> SNAPCRAFT_CONTAINER_BUILDS=1 snapcraft
# Wait until Snapcraft creates stage/prime/parts folders
# See that they're owned by the user
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #1904 fixed LXD `raw.idmap` argument order so host UID maps to container root (0), instead of mapping both IDs to the host user; commit 6bd4c9e59. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #1904 corrected LXD raw.idmap to map the host ID to container ID 0, preventing built files from being owned by root (commit 6bd4c9e59). | |
| qwen/qwen3.6-35b-a3b | — | — | Merged a fix correcting raw.idmap syntax in LXD configuration. The change maps host and container IDs correctly, preventing container files from being owned by root. Resolves LP: #1741753 with a four-line adjustment across two files. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged fix correcting LXD raw.idmap syntax to properly map host and container IDs. Resolves Launchpad bug #1741753 where container files were incorrectly owned by root. Related test failures were addressed in separate PRs. |
Update history
No update history recorded yet.
Related work
-
Related To:
snapcraft#1385
(confidence 55%)
Earlier commit e85e0779b 'lxd: do not assume user ID of 1000 for raw.idmap' introduced the incorrect argument order fixed here.
-
Related To:
canonical/snapcraft#1907
(confidence 50%)
Referenced in review comments as fixing the autopkgtest venv setup failure that blocked CI for this PR.
-
Related To:
canonical/snapcraft#1908
(confidence 50%)
Referenced in review comments as fixing the test_opencv patchelf_command AttributeError failure seen alongside this PR.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #769 LXD idmap improperly set for high uids and gids | craft-providers | closed | Fixed by merged PR #98 (76a2d3a): LXD raw.idmap now maps the host UID and GID separately, correcting ownership for high, mismatched IDs. | |
| #1385 lxd: Don't assume user ID to 1000 for raw.idmap | snapcraft | merged | Merged PR #1385 as commit e85e0779b, removing LXD raw.idmap's hard-coded UID 1000 assumption for Launchpad bug 1700703; PR #1904 later corrected mapping order. | |
| #388 LXD config set raw.idmap random not applied | craft-providers | closed | Fixed by merged PR #386, which corrected LXC instance locking during creation so raw.idmap is applied. | |
| #98 lxd: pass id for host mount uid mapping | craft-providers | merged | Merged #98 added an application-provided ID for LXD host-mount UID mapping while retaining the running user's UID as the default, resolving #97. | |
| #18 providers: fix id mapping in lxd project mount | rockcraft | merged | Merged PR #18 fixed LXD project mounts to map the host directory owner rather than the current UID, preventing file-creation failures when their IDs differ. | |
| #97 Filesystem uid mapping incorrect in lxd instance | craft-providers | closed | LXD host-mount ID mapping was fixed by #98 (05d4834), then refined by merged #780 (5717e2c), which sets UID and GID maps separately. |