Check the map and matching grant file
Enter UID and GID map lines separately. Each line contains its u or g type, container start, host start, and length. Choose whether to query a UID or GID, then enter the container ID you want to resolve.
For an ID inside a mapped range, the host ID is host start + container ID - container start. The range starts at the supplied start and contains exactly the supplied length. Its last included ID is therefore start + length - 1, which is the inclusive endpoint shown in the result. IDs may not exceed 4,294,967,294; lengths must be positive and both endpoints must fit.
To check subordinate grants, paste owner:start:length rows into the matching grant field and supply the exact owner. UID grants come from /etc/subuid; GID grants come from /etc/subgid. One cannot substitute for the other. This checker requires one matching-owner grant to cover the entire matched host range, not just the queried ID.
Malformed lines, zero lengths, endpoint overflow, and overlapping container or host ranges prevent a result. Gaps are findings rather than automatic parse failures. A query outside the supplied map produces an unmapped answer. Editing clears the old diagnosis, so check again after changing a range or owner.
The supplied maps and grants are processed in browser memory. The tool does not read your host's files, send these inputs to a server, or save them in a URL or browser storage. Copying a report is explicit.
Mapping and grant results are separate
A map describes an ID translation. A subordinate grant describes a range allocated to an owner. Neither alone proves access to a file or mount. The LXC configuration reference defines the map format, while the subuid manual explains subordinate UID allocations.
| Result | What was checked | What remains unknown |
|---|---|---|
| Mapped host ID | The query falls inside a supplied range and its offset resolves | Whether this map is active on the host |
| Unmapped query | No supplied range contains the queried ID | Whether the running container uses a different map |
| Grant covered | One matching-owner grant of the correct type covers the full matched host range | Whether the host configuration permits the intended operation |
| Grant missing | Grants were supplied, but none meets that full-range coverage check | Whether the supplied grant text matches the current host files |
| Grant unknown | No grant evidence was supplied for the check | Whether the required allocation exists |
Check permissions on the actual host
If the arithmetic and grants look right but a bind mount still fails, inspect the running namespace, file ownership, and ACLs on the host. This tool does not inspect those states, infer default mappings, start a container, or test mount access. A covered grant is not a runtime permission verdict.