Tools on DiyMediaServer

LXC UID/GID Mapping Tool

Mon, 01 Jan 0001 00:00:00 +0000

Enter the UIDs and GIDs you want to pass through from the host into your LXC container. The tool generates the lxc.idmap block for your container config, the /etc/subuid and /etc/subgid entries needed on the Proxmox host.

Privileged containers share host UIDs/GIDs directly — no lxc.idmap or subuid changes are needed. Only a host chown is required.

/etc/pve/lxc/<CTID>.conf

Enter a CTID and UID(s) to generate idmap lines.

/etc/subuid + /etc/subgid

Enter a CTID and UID(s) to generate subuid/subgid lines.

Finding IDs on the Proxmox Host

Run these commands in a Proxmox host shell to find the UID and GID you need:

# Your current user
id

# A specific service user (e.g. jellyfin, www-data)
id jellyfin

# Look up a user by name in the full user database
getent passwd jellyfin

The output looks like uid=1000(jellyfin) gid=1000(jellyfin) groups=.... The number after uid= is the UID; the number after gid= is the primary GID. Enter those numbers into the tool above.

Finding IDs inside the LXC Container

Run these commands from the Proxmox host to query IDs inside a running container (replace 101 with your CTID):

# Look up a user inside the container
pct exec 101 -- id jellyfin

# Check what uid_map the container is using
pct exec 101 -- cat /proc/self/uid_map

# Or enter the container shell directly
pct enter 101
id jellyfin

The id output inside the container shows the LXC-side IDs — these are what go into the lxc.idmap lines. The Proxmox host sees the mapped host IDs instead.

For the conceptual background on how UID/GID mapping works, the default offset layout, and common bind-mount troubleshooting.

Read the full guide

Proxmox Idmapped Mount & Permission Generator

Mon, 01 Jan 0001 00:00:00 +0000

Enter your container ID, mount point details, and the host UID/GID you want to share. The tool generates the exact mpX: config line for /etc/pve/lxc/<CTID>.conf, the command to create the directory inside the container, and a host ownership check — all ready to copy.

Idmapped mounts (available in Proxmox 8.1+ on kernel 6.x) let an unprivileged container see host files as if it owns them, without editing /etc/subuid or /etc/subgid. If you need selective pass-through of specific UID/GID ranges, use the LXC UID/GID Mapping Tool instead.

Mount settings

Container ID (CTID)

The numeric ID of your LXC container, e.g. 101.

Mount Point ID

The mpX index in the container config, e.g. mp0.

Source (Host Path)

Absolute path to the directory on the Proxmox host, e.g. /mnt/media.

Destination (LXC Path)

Absolute path where the data should appear inside the container, e.g. /media.

Host UID(s)

Numeric UIDs that own the host data. Used to generate the ownership check. Find with stat -c "%u" /path.

Host GID(s)

Numeric GIDs that own the host data. Often matches the UID. Find with stat -c "%g" /path.

/etc/pve/lxc/<CTID>.conf

Enter a CTID, host path, and LXC path to generate the config line.

Create directory inside container

Enter a CTID and LXC path to generate the mkdir command.

Verify host ownership

Enter a host path to generate the verification command.

The Permission Bridge

Step 1: Identify Host Owners

Find the numeric UID and GID that own your data on the Proxmox host:

stat -c "%u %g" /path/to/host/data

The two numbers in the output are the UID and GID. Enter them into the tool above.

Step 2: Identify Container Users

Look up the service-account ID inside the container (e.g. the user running Jellyfin or Sonarr):

pct exec CTID -- id -u username
pct exec CTID -- id -g username

The UID and GID printed here are what the container process expects to run as. The idmapped mount makes the host files appear to be owned by those IDs at the kernel level.

Compatibility Notes

Requires Proxmox 8.1 or newer (kernel 6.x or higher).
Backing filesystem must support idmapped mounts: ZFS, ext4, XFS. Some legacy network mounts (older NFS/CIFS exports) do not support this feature.

For the conceptual background on UID/GID mapping, default offset layouts, and when traditional lxc.idmap is still the right call.

Read the full guide