Add get-lxc-idmap-config script

This script handles uid/gid ranges for creating unprivileged containers as root.
This commit is contained in:
MasterofJOKers 2023-02-25 17:13:12 +01:00
parent 2f9f69ec77
commit 271d7009cf
1 changed files with 80 additions and 0 deletions

80
lxc/get-lxc-idmap-config Executable file
View File

@ -0,0 +1,80 @@
#!/bin/sh
# Manage uid/gid maps for containers
#
# This script manages uids/gids assigned to certain containers or groups of containers. It uses /etc/subuid and
# /etc/subgid by default to save the information. All the ranges are owned by root as we don't want to support creation
# of containers by unprivileged users, but rather want to create unprivileged containers as root user.
USER_ID=0
FIRST_ID=1000000
DEFAULT_COUNT=65536
FILENAME="/etc/sub_____id"
get_filename () (
TYPE="${1}"
echo "${FILENAME}" | sed "s/_____/${TYPE}/"
)
find_range () (
TYPE="${1}"
NAME="${2}"
FILENAME="$(get_filename ${TYPE})"
grep -A 1 "^# ${NAME}$" "${FILENAME}" -A 1 | tail -n 1
)
get_last_range () (
TYPE="${1}"
grep "^${USER_ID}:" "$(get_filename ${TYPE})" | tail -n 1
)
get_new_range () (
TYPE="${1}"
LAST_RANGE=$(get_last_range "${TYPE}")
if [ "${LAST_RANGE}" = "" ]; then
NEW_ID=$FIRST_ID;
else
LAST_ID=$(echo "${LAST_RANGE}" | cut -d : -f 2)
LAST_COUNT=$(echo "${LAST_RANGE}" | cut -d : -f 3)
NEW_ID=$(( $LAST_ID + $LAST_COUNT ))
fi
echo "${USER_ID}:${NEW_ID}:${DEFAULT_COUNT}"
)
append_range () (
TYPE="${1}"
FILENAME="$(get_filename ${TYPE})"
NAME="${2}"
RANGE="${3}"
printf "# ${NAME}\n${RANGE}\n" >> "${FILENAME}"
)
usage () {
echo "usage: get-lxc-idmap-config <u|g> <container-group-name>"
exit 1
}
TYPE="${1}"
if [ "${TYPE}" = "" || "${TYPE}" == "--help" || "${TYPE}" == "-h" ]; then
usage
fi
NAME="${2}"
if [ "${NAME}" = "" ]; then
usage
fi
RANGE=$(find_range "${TYPE}" "${NAME}")
if [ "${RANGE}" = "" ]; then
RANGE=$(get_new_range "${TYPE}")
if [ "${RANGE}" = "" ]; then
exit 1
fi
append_range "${TYPE}" "${NAME}" "${RANGE}"
fi
RANGE_START=$(echo ${RANGE} | cut -d : -f 2)
RANGE_COUNT=$(echo ${RANGE} | cut -d : -f 3)
printf "lxc.idmap = %s 0 %s %s\n" "${TYPE}" "${RANGE_START}" "$(( ${RANGE_COUNT} - 1))"