OpenStack Compute (Nova)
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

3.1 KiB


Tool used by Nova libvirt-lxc virt driver





OpenStack Foundation



Manual section


Manual group

cloud computing


nova-idmapshift [options] path


nova-idmapshift is a tool that properly sets the ownership of a filesystem for use with linux user namespaces. This tool can only be used with linux lxc containers.

When using user namespaces with linux lxc containers, the filesystem of the container must be owned by the targeted user and group ids being applied to that container. Otherwise, processes inside the container won't be able to access the filesystem.

For example: nova-idmapshift -i -u 0:10000:2000 -g 0:10000:2000 path

This command will idempotently shift path to proper ownership using the provided uid and gid mappings.

When using the uid map string '0:10000:2000', this means that user ids inside the container between 0 and 1999 will map to user ids on the host between 10000 and 11999. Root (0) becomes 10000, user 1 becomes 10001, user 50 becomes 10050 and user 1999 becomes 11999. This means that files that are owned by root need to actually be owned by user 10000, and files owned by 50 need to be owned by 10050, and so on.

nova-idmapshift will take the uid and gid strings used for user namespaces and properly set up the filesystem for use by those users. Uids and gids outside of provided ranges will be mapped to nobody-id (default is max uid/gid) so that they are inaccessible inside the container.


Positional arguments

path Root path of the filesystem to be shifted

Optional arguments

-h, --help Show this help message and exit. -u USER_MAPS, --uid=USER_MAPS User ID mappings, in the form: [[guest-uid:host-uid:count],...] -g GROUP_MAPS, --gid=GROUP_MAPS Group ID mappings, in the form: [[guest-gid:host-gid:count],...] -n nobody-id, --nobody nobody-id ID to map all unmapped uid and gids to. Defaults to 65534. -i, --idempotent Shift operation will only be performed if filesystem appears unshifted. Defaults to false. -c, --confirm Will perform check on the filesystem:

Returns 0 when filesystem appears shifted.

Returns 1 when filesystem appears unshifted.

Defaults to false.

-d, --dry-run Print chown operations, but won't perform them.

Defaults to false.

-v, --verbose Print chown operations while performing them.

Defaults to false.