Subordinate IDs
Central subuid / subgid allocation for rootless containers; ranges are a fixed 65536, not selectable, never reclaimed; the statistics page shows what is left.
Rootless containers (podman, rootless docker) need each user to own a subordinate ID range in /etc/subuid and /etc/subgid. Maintaining those files per host leads to collisions; IPA allocates the ranges centrally and sssd 2.5+ serves them through its subid provider, so nothing is written on the host.
Allocation rules
| Item | Value |
|---|---|
| Range size per user | 65536, fixed |
| Start | sequential from LINUX.IPA.TEST_subid_range (2147483648 upwards) |
| Per user | at most one range; subuid and subgid start at the same value |
| Reclaim | never. After the user is deleted the range is dead, not reissued |
Add allocates a range for the chosen user; users can also request their own (role Subordinate ID Selfservice User, empty by default). CLI: ipa subid-generate --owner=<user>.
Statistics
| Column | Meaning |
|---|---|
| Base ID | start of the subordinate range |
| Assigned subordinate IDs | ranges handed out |
| Remaining subordinate IDs | ranges still available |
| Range size | total IDs the subordinate range holds |
| DNA remaining | ranges this server's DNA plugin still holds unissued (each master takes a slice) |
The default range is 2147352576 IDs, enough for 32767 users.
Client
# /etc/nsswitch.conf
subid: sssSupported from sssd 2.5; podman unshare cat /proc/self/uid_map showing the mapping means it works. Older clients keep hand-written /etc/subuid.
Boundaries
- Range values cannot be chosen; a specific value means bypassing IPA and writing the file locally.
- AD users cannot obtain subordinate IDs from IPA.
Automember
Attribute regexes that place users / hosts into groups automatically; rules apply to new objects only, existing ones need a rebuild.
Host-based access control (HBAC)
Requires the hbac module. Who may log in to which host through which service, the four dimensions of a rule, what to do with allow_all, evaluation order, and simulating a login with ipa hbactest.