Proxmox LXC idmap Generator

Let an unprivileged container read and write a host folder as a real host user. Enter which container UIDs and GIDs should map to which host IDs, and get the lxc.idmap lines for /etc/pve/lxc/<ID>.conf, the /etc/subuid and /etc/subgid entries, the bind mount line and the chown command. Everything runs in your browser.

Container

Container ID (CTID)

Its config file is /etc/pve/lxc/<CTID>.conf. Use this on an unprivileged container (unprivileged: 1).

Advanced host base and range size

Host base ID

IDs per container

Proxmox maps unprivileged containers as u 0 100000 65536 and g 0 100000 65536: container ID 0–65535 becomes host ID 100000–165535. Change these only if you already run a different range.

User IDs (UID)

Each row maps container UIDs to host UIDs. Count maps a run of consecutive IDs. Every container UID you don’t list keeps the shifted host ID (base + ID).

Group IDs (GID)

Map groups the same way as users Untick to set GID pairs separately, for example a shared media group.

Bind mount

Mount point

Host path

Path in container

Proxmox allows mp0 to mp255. Use a folder reserved for sharing, never /, /etc or /var, and no symlinks in either path. Leave the host path empty to skip the mount.

Fix the errors above to see the generated config.

1 Container config

/etc/pve/lxc/100.conf

Add the lines to the main part of the file, above the first [snapshot] section if there is one. Don’t paste # comment lines: Proxmox turns lines that start with # into the container’s Notes.

2 Subordinate IDs for root

Proxmox starts containers as root and LXC hands IDs to them through newuidmap and newgidmap, so root needs every host ID of the map in these files. If a range is missing, the container fails to start.

/etc/subuid

/etc/subgid

default lines are already in both files on a standard Proxmox VE install (the lxc-pve package adds root:100000:65536). Add the lines marked add.

Add the missing lines (safe to run twice)

3 Bind mount and host owner

Mount point line for the same .conf file

…or add it with pct

Give the host folder to the mapped IDs

Enter a host path and a path in the container to get the mp line and the chown command.

4 Restart and check

Proxmox VE 9.2 and later: map on the mount point instead no lxc.idmap, no subuid changes

Proxmox VE 9.2 added an idmap option to mount points (type:container:disk:count). It changes the IDs on that one mount only and leaves the rest of the container on its normal mapping, so you skip steps 1 and 2. Use it instead of the lines above, not together with them.

Mount point line with idmap

…or with pct

Add at least one UID or GID pair and a host path to get the mount point line.

Works only in unprivileged containers; Proxmox ignores the option on privileged ones and logs a warning.
IDs you don’t list fall back to the container’s own mapping. The host folder still needs the owner from step 3, because the disk IDs here are the host IDs you entered.
It is built on Linux idmapped mounts, so the file system under the host path must support them. Check this first for network shares such as NFS or SMB.
Versions before 9.2 don’t know the option. Run man pct.conf on your node and look for idmap= under the mount point options.

Copied

This free Proxmox LXC idmap generator writes the UID and GID mapping that lets an unprivileged container read and write a host folder as a real host user. Enter the container ID and your container-to-host pairs, and you get the lxc.idmap lines, the /etc/subuid and /etc/subgid entries, the mp0 bind mount line and the chown command, each with a copy button.

Without a custom map, Proxmox shifts every ID in an unprivileged container by 100000: container UID 1000 writes as host UID 101000, and your host user’s files show up as nobody (65534) inside. The Proxmox LXC idmap generator splits the range 0–65535 around your IDs without gaps or overlaps and checks the result the way Proxmox and the kernel do.

What This Proxmox LXC idmap Generator Does

🧮 Covers the whole range. Every container ID from 0 to 65535 appears exactly once: your pairs pass through, every other ID keeps the shifted host ID (100000 + ID).
👥 UIDs and GIDs separately. Map groups like users, or give a shared media group its own GID pair. A count maps a run of IDs.
🚫 Rejects broken maps. Two rows on one container ID, two container IDs on one host ID, or a host ID inside the shifted range get an error that names the row and the fix.
⚠️ Warns about risky choices. Mapping to host root (UID or GID 0), remapping container root, or a pair that changes nothing.
📄 Explains every line. Each lxc.idmap line gets a plain-English note.
🔑 Subordinate IDs for root. The root:<start>:<count> lines root needs, plus commands that are safe to run twice.
📁 Mount and owner. The mp0: line or pct set command, a chown -R for the host folder, and restart and check commands.

How to Use the Proxmox LXC idmap Generator

Enter the container ID and adjust the host path and the path in the container.
Add a UID pair for each user that needs access, for example 1000 → 1000. Untick “Map groups the same way as users” if the groups differ.
Fix anything marked red, then copy the four steps: config lines, subuid and subgid lines, mount line and chown.
Restart the container with pct reboot <ID> and check the owner with pct exec <ID> -- ls -ln /shared.

For container 100 and user 1000, the Proxmox LXC idmap generator returns these six lines:

lxc.idmap: u 0 100000 1000
lxc.idmap: u 1000 1000 1
lxc.idmap: u 1001 101001 64535
lxc.idmap: g 0 100000 1000
lxc.idmap: g 1000 1000 1
lxc.idmap: g 1001 101001 64535

Why the Proxmox LXC idmap Generator Writes Both u and g Lines

These Proxmox details shape the output, checked against the Proxmox source code and documentation rather than forum threads:

No half maps. Without custom lines, Proxmox maps an unprivileged container as u 0 100000 65536 and g 0 100000 65536. Once the config has a single lxc.idmap line, Proxmox adds no default lines at all, so users and groups must both be listed. That is why the tool keeps a g line even when you only map users.
Root needs the host IDs. LXC hands IDs to the container through newuidmap and newgidmap, which only accept host ranges listed for root in /etc/subuid and /etc/subgid. The lxc-pve package adds root:100000:65536 to both files; passthrough IDs need their own lines, or the container fails to start.
No comments in the config. Proxmox turns lines that start with # into the container’s Notes, so paste the bare lines, above any [snapshot] section.
Overlaps fail. The kernel rejects maps with overlapping ranges, and Proxmox warns about them at start. The Proxmox LXC idmap generator refuses them before you touch the file.
Existing files keep their owner. Files that container UID 1000 already owns stay host UID 101000 and show up as nobody. Map before you create the user.

The Proxmox LXC idmap generator reproduces the Proxmox wiki example (UID 1005 for an NFS share) line for line.

Proxmox VE 9.2: Mapping on the Mount Point

Proxmox VE 9.2 added an idmap option to mount points, documented in pct.conf. It remaps IDs on that one mount and leaves the container’s own mapping alone, so you skip the lxc.idmap lines and the subuid changes. The Proxmox LXC idmap generator prints this variant too, for example idmap=u:1000:1000:1;g:1000:1000:1.

It works only in unprivileged containers and relies on Linux idmapped mounts, so check that the file system under the host path supports them, especially for NFS or SMB shares. On nodes older than 9.2, stay with the classic lines.

Practical Use Cases

A few situations where the Proxmox LXC idmap generator saves a round of trial and error:

🎬 Media server reading your library. Let Jellyfin in an unprivileged LXC read a host media folder owned by your usual user.
📸 Photo libraries. In my Immich on Proxmox with ZFS guide I chowned the folders to the shifted IDs (100999:100000). A mapping from the Proxmox LXC idmap generator works the other way round: the container user writes as a normal host user that other machines recognise.
☁️ Sync containers without privileged mode. My OneDrive ZFS mirror container runs privileged, and the guide notes that an unprivileged setup needs UID/GID remapping. This is that remapping for the sync user.
👪 One shared group. Map only a media GID, keep users on the shifted range, and give several containers group access with chown -R :1001 plus group permissions from the chmod calculator.
🧰 New and moved containers. Plan the mapping right after you create the LXC from the web UI and check the mp0 row when you edit the LXC config. The lines live in the container config, so they stay put when you move its disk to LVM-thin storage; on another node, add the subuid and subgid lines there too.

Privacy, Ads, and Data Policy

✅ 100% free: no registration and no limits.
✅ No data storage: IDs and paths never leave your browser; they only sit in the page address so you can bookmark a mapping.
✅ No ads in results: the generated lines are plain text with nothing added.
✅ Client-side only: no external requests and no libraries; the Proxmox LXC idmap generator is plain JavaScript with no build step.

Open Source and Self-Hosting

The Proxmox LXC idmap generator is open source on GitHub: three files (index.html, style.css and script.js) with no dependencies, so you can drop it onto any static web server in your homelab. Its unit tests check every generated map for full coverage and overlaps, including the Proxmox wiki example.

Like this tool, everything on the Tools page runs in your browser, for example the IP subnet calculator for planning container networks.

Built by VahaC — 100% client-side, no data sent anywhere.