Idmapped Mounts
summary
Kernel support for per-mount UID/GID translation makes it possible to expose the same files at multiple mountpoints with different ownership without modifying on-disk metadata; implemented as idmap mounts (landed in kernel 5.12, with btrfs in 5.15) and supported by ext4, xfs and vfat. Demo uses an idmap map-mount tool and LXD device injection to show containers and portable home directories work without no recursive chown, mappings apply instantly and writes round-trip correctly.
AI-written summary · about
chapters (14)
- 0:00Start
- 7:43Superblocks & File Ownership
- 9:05Inodes & File Ownership
- 14:15User Namespaces & Changing File Ownership
- 16:39Mounting Filesystems inside User Namespaces
- 18:09Limitations of Recursive Chown
- 19:21Limitations of Mounting FS in User Namespace
- 21:21Modern Use Cases
- 24:58Root Filesystem Ownership
- 26:24Data sharing between host&container
- 27:47Data sharing between containers
- 28:29Solutions
- 31:37Idmapped Mounts
- 33:15Portable Home Directories & Containers
related talks
42mWhat's New in the User Namespace
42mSecuring Filesystem Images for Unprivileged Containers
29mFilesystem mounts in user namespaces
01h 03mLinux Namespaces for Fun and Isolation
32mBringing up FUSE mounts C/R support
12mEvery Mapping Counts in Large Amounts: Folio Accounting
31mIOMMUFD Discussion
48mState of Linux Kernel Container Features