Subordinate IDs
Central subuid and subgid allocation for rootless containers. Ranges are a fixed 65536, not selectable and never reclaimed; the statistics page shows what is left.
This page covers the Subordinate IDs page under Identity. Rootless containers (podman, rootless docker) need each user to own a subordinate ID range in /etc/subuid and /etc/subgid. Maintaining those files per host leads to collisions. IPA allocates the ranges centrally and sssd 2.5 or later serves them through its subid provider, so nothing is written on the host.
Allocation rules
| Item | Value |
|---|---|
| Range size per user | 65536, fixed |
| Start | Sequential from LINUX.IPA.TEST_subid_range (2147483648 upwards) |
| Ranges per user | At most one; subuid and subgid start at the same value |
| Reclaim | Never. After the user is deleted the range is dead and not reissued |
Add allocates a range for the chosen user. Users can also request their own if they hold the role Subordinate ID Selfservice User, which is empty by default. The CLI equivalent is ipa subid-generate --owner=<user>.
Statistics
| Column | Meaning |
|---|---|
| Base ID | Start of the subordinate range |
| Assigned subordinate IDs | Ranges handed out |
| Remaining subordinate IDs | Ranges still available |
| Range size | Total IDs the subordinate range holds |
| DNA remaining | Ranges this server's DNA plugin still holds unissued. Each master takes a slice |
The default range is 2147352576 IDs, enough for 32767 users.
Client
# /etc/nsswitch.conf
subid: sssSupported from sssd 2.5. podman unshare cat /proc/self/uid_map showing the mapping confirms it works. Older clients keep a hand-written /etc/subuid.
Boundaries
| Topic | Notes |
|---|---|
| Choosing a range value | Not supported. A specific value means bypassing IPA and writing the file locally |
| AD users | Cannot obtain subordinate IDs from IPA |
Automember
Attribute regexes that place users and hosts into groups automatically. Rules apply to new objects only; existing ones need a rebuild.
Host-based access control (HBAC)
Requires the hbac module. Who may log in to which host through which service, the four dimensions of a rule, what to do with allow_all, evaluation order, and simulating a login with ipa hbactest.