Can I ask an uid range not to be mapped in an unprivileged container? Yes, and it’s not that complicated once you see the idmap config. The trick is splitting the mapping so a specific UID range on the host is never mapped into the container.
Why you’d want to exclude a UID range
Unprivileged containers map a high host UID range (like 100000-165535) to the container’s root UID 0. That’s great for security, but sometimes you need a range on the host to stay untouched—maybe it’s used by a service, or you want to reserve it for another container. The default mapping grabs everything, so you have to carve out a hole.
The mapping that works
You do this by adding lxc.idmap entries to the container config file (/etc/pve/lxc/<CTID>.conf). The idea: map everything except the range you want to skip. Here’s an example that excludes host UIDs 2000-2999:
# Map container root to host UID 100000
lxc.idmap: u 0 100000 2000
# Skip host UIDs 102000-102999 (which correspond to host 2000-2999)
# Map the remaining container UIDs starting from 2000
lxc.idmap: u 2000 103000 63036
# Same for GID
lxc.idmap: g 0 100000 2000
lxc.idmap: g 2000 103000 63036
Let’s break that down. The first line maps container UIDs 0-1999 to host UIDs 100000-101999. The second line maps container UIDs 2000-65035 to host UIDs 103000-165035, effectively skipping host UIDs 102000-102999. Those host UIDs (102000-102999) correspond to the original host UIDs 2000-2999 you wanted to exclude. Same pattern for GIDs.
Important: you also need to allow the ranges
Proxmox won’t let you just add idmap entries—you have to tell it which host UID ranges the container is allowed to use. Add these lines to the same config:
lxc.idmap: u 0 100000 2000
lxc.idmap: u 2000 103000 63036
lxc.idmap: g 0 100000 2000
lxc.idmap: g 2000 103000 63036
And in /etc/subuid and /etc/subgid on the host, make sure the container’s user (usually root) has the full range allowed:
root:100000:65536
If you don’t do this, the container won’t start and you’ll get a permission error. Annoying, but at least it fails fast.
My take
This is one of those things that sounds harder than it is. The Proxmox docs don’t give a clear example for excluding a range, and the forum threads are a mess. Just split the mapping, update the subuid files, and you’re done. If you’re messing with idmaps, you probably already know why you need it—don’t overthink it.
If you’re sharing datasets from TrueNAS into an unprivileged container, you’ll hit similar UID mapping headaches. I wrote about that here.
