Repository: containers/podman (go)

Issue:
Rootless managing of additional host groups
### Feature request description

This feature request describes how podman could allow rootless management of
additional host groups using better semantics.

One of the current issues with `--group-add keep-groups` is that while groups
are added, the groups are not mapped, so when listing the groups or a 
mounted volume the overflowgid `nobody` appears. This is confusing.

Besides, some container images need the users to be mapped to operate, for
instance because they create processes based on user logins into the container and
those created processes do not have the unmapped groups set (because they
can't appear in the container's `/etc/groups`). As an example the `rocker/rstudio` image
expects users to login to rstudio server through a web interface, and the web logged in user
does not have those groups kept.


### Suggest potential solution

This problem can be addressed if the system administrator is willing to give
some additional trust to users (giving the group as a subordinate GID) and
if podman improves its semantics a bit. This is what this feature request is
about.

## Asking permission to the system administrator

The system administrator is able to subordinate arbitrary GID usage to a user
through `/etc/subgid`.

The most common usage of subordinate GIDs is for the sysadmin to give a large
non-overlapping chunk of unused GIDs to each user. Large GIDs are usually available
so we can easily give them away to users.

However, the sysadmin may consider giving as well an existing GID as subordinate to
several users. These users can act as if they owned that GID.

```
$ cat /etc/subgid

alice:100000:50000
alice:1001:1
```

Reads as:

> The sysadmin grants a block of 50k GIDs, starting at 100000 to user alice.
> The sysadmin grants GID 1001 to user alice.

This has security implications, as it essentially means that user `alice` can
"impersonate" GID 1001.


## Telling rootless podman to map GID 1001

To run a container, we need to be able to act as if we had many users and groups
available. For instance, container images may include files owned by different
users and groups and as a regular user we should be able to create and manage
those files. The way to do this is for us (regular users) to create a mapping
between the UIDs and GIDs our container needs (or may need) and a subordinate
UID (GID) range we have.

By default, we may also want to map the root user and root group to our UID/GID
at the host.

This is what rootless podman essentially does: 

| container GID |  host GID | Comment                                      |
| --------------|-----------|----------------------------------------------|
|             0 |  $(id -g) | Map our GID to the root GID in the container |
|             1 | 1st subid | Any GID our container needs to use goes to   |
|             2 | 2nd subid | our subordinate block of GIDs                |
|             n | nth subid |                                              |

There is no need for podman to map all the subordinate GIDs we have, as long
as all the GIDs the container needs are mapped to some GID we have.

What we would like to do is to have control over host GID 1001. However, we
would like to map it not to an arbitrary GID in the 1-n range, but to a higher stable 
GID the container does not actually use.

By choosing to map to a high GID (e.g. container GID 100000+1001), we avoid the risk of 
overlapping with GIDs the container needs.

| container GID |  host GID | Comment                                      |
| --------------|-----------|----------------------------------------------|
|             0 |  $(id -g) | Map our GID to the root GID in the container |
|             1 | 1st subid | Any GID our container needs to use goes to   |
|             2 | 2nd subid | our **50k** subordinate block of GIDs        |
|             n | nth subid |                                              |
|        101001 |      1001 | A host group we want to access and we have   |

Podman should add a group entry into the containers `/etc/groups`, with
the same group name as the host group 1001, with group id 101001 and with
the root user (or whatever user we have mapped onto) as a member, if we are
members of group 1001 in the host.

## Suggested improvement

Semantically, it would be helpful defining something in `containers.conf ` that 
would tell podman to use host GID 1001 as a "higher container GID", that would not
collide with existing GIDs in the container image, and let podman add the
corresponding entry in `/etc/groups`.

For instance, the `containers.conf` could have a field like:

```
[containers]

# List the subordinate group IDs that should be mapped as additional groups
# in the container

local_group_mappings = [
 1001
]

local_group_offset = 100000
```

If 1001 is in the `subgid` for the user running the container, this setting would tell podman to map
1001 to `local_group_offset+1001`.



### Have you considered any alternatives?

Currently podman treats all subordinate GIDs the same. This means that with
the `/etc/subgid` defined above, podman would map the host group 1001 to
the container GID 1, and the rest of subordinate GIDs would follow.

This is confusing, because GID1 is usually assigned in many containers and it
is defined as the `bin` or `daemon` group or some other system group.

Besides, as proven in the reproducible example below, the usage of `--gidmap` is not invariant to changes on subgids, making the scripts of the rootless user unnecessarily dependant on the subordinate GIDs available.

### Additional context

_No response_

Pull request description:
Mapping improvements to add additional groups
This topic has been discussed at length at https://github.com/containers/podman/issues/18333, with
@giuseppe, @Luap99 and with the feedback from @rhatdan. The requirements were defined there and
this aims to be the implementation.

Status

- [x] Implementation
- [x] Unit testing
- [x] Documentation

This is my first go contribution and my first podman contribution. I would appreciate help in terms on where to define unit tests and an example on how to define them, as well as pointers to documentation sources so I can improve docs.

I know further work is needed, but I'd rather have some early feedback if possible (and help).

Closes #18333

Motivation
===========

These commits aim to make --uidmap and --gidmap easier to use, especially in rootless podman setups.

So to map our additional GID 1001, that has been subordinated to us, into  GID 100000 in the container, instead of doing:

```
podman unshare cat /proc/self/gid_map
# Find that GID 1001 was subordinated to intermediate GID 1
# Map 1001->1 to 100000
podman run \
  --rm \
  --uidmap "0:0:65535" \
  --gidmap "0:0:1" \
  --gidmap "100000:1:1" \
  --gidmap "1:2:65534" \
  alpine id
```

We can just:

```
podman run \
  --rm \
  --gidmap "+100000:@1001:1" \
  alpine
```

A real use case can be found at: https://rocker-project.org/use/rootless.html#ask-the-system-administrator-to-subordinate-the-group. I hope to eventually simplify the explanation in that page once this is merged and released.

## Long explanation follows

(I will focus here on the --gidmap option, although the same applies for --uidmap.)

In rootless podman, the user namespace mapping happens in two steps, through an intermediate mapping.

See https://docs.podman.io/en/latest/markdown/podman-run.1.html#uidmap-container-uid-from-uid-amount
for further detail, here is a summary:

First the user GID is mapped to 0 (root), and all subordinate GIDs (defined at /etc/subgid, and
usually >100000) are mapped starting at 1.

If we want to change it further, we can use the --gidmap option, to map that intermediate mapping
to the final mapping that will be seen by the container.

As an example, let's say we have as main GID the group 1000, and we also belong to the additional GID 2000,
that we want to make accessible inside the container.

We first ask the sysadmin to subordinate the group to us, by adding "$user:2000:1" to /etc/subgid.

Then we need to use --gidmap to specify that we want to map GID 2000 into some GID inside the container.

And here is the first trouble:

Since the --gidmap option operates on the intermediate mapping, we first need to figure out where has
podman placed our GID 2000 in that intermediate mapping using:

    podman unshare cat /proc/self/gid_map

Then, we may see that GID 2000 was mapped intermediate GID 5. So our --gidmap option should include:

    --gidmap 20000:5:1

This intermediate mapping may change in the future if further groups are subordinated to us (or we stop
having its subordination), so we are forced to verify the mapping with
`podman unshare cat /proc/self/gid_map` every time, and parse it if we want to script it.

**The first usability improvement** we agreed on #18333 is to be able to use:

    --gidmap 20000:@2000:1

so podman does this lookup in the parent user namespace for us.

But this is only part of the problem. We must specify a full gidmap and not only what we want:

    --gidmap 0:0:5 --gidmap 5:6:15000 --gidmap 20000:5:1

This is becoming complicated. We had to break the gidmap at 5, because the intermediate 5 had to
be mapped to another value (20000), and then we had to keep mapping all other subordinate ids... up to
close to the maximum number of subordinate ids that we have (or some reasonable value). This is hard
to explain to someone who does not understand how the mappings work internally.

**The second usability improvement** is to be able to use:

   --gidmap "+20000:@2000:1"

where the plus sign (`+`) states that we want to start with an identity mapping, and break it where
necessary so this mapping gets included.

One final improvement related to this is the following:

By default, when podman  gets a --gidmap argument but not a --uidmap argument, it copies the mapping.
With the new syntax this copying does not make sense. Having a GID subordinated to us does not imply
that the same UID will be subordinated as well. This means, that when we wanted to use:

    --gidmap 0:0:5 --gidmap 5:6:15000 --gidmap 20000:5:1

We also had to include:

    --gidmap 0:0:5 --gidmap 5:6:15000 --gidmap 20000:5:1 --uidmap 0:0:65000

making everything even harder to understand without proper context.

In this series of patches, when a "break and insert" gidmap is given (using the described `+` syntax)
without a --uidmap, we assume that we want the "identity mapping" as --uidmap (0:0:65000).

To preserve backwards compatibility, this different default mapping is only used when the `+` syntax
is used, so users who rely on the previous behaviour don't suffer any changes.


#### Does this PR introduce a user-facing change?

<!--
If no, just write `None` in the release-note block below. If yes, a release note
is required: Enter your extended release note in the block below. If the PR
requires additional action from users switching to the new release, include the
string "action required".

For more information on release notes, please follow the Kubernetes model:
https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
Extended the syntax of `--uidmap` and `--gidmap` so it accepts flags and becomes more expressive, especially in rootless containers. The 
syntax has been extended to be able to lookup the parent user namespace, and to extend default
mappings. Now mapping an additional subordinated group (e.g. GID 2000) can be done with
just `--gidmap +g102000:@2000:1`. See
https://github.com/containers/podman/blob/main/docs/tutorials/rootless_tutorial.md#giving-access-to-additional-groups 
for details  (#18333, #18713, @zeehio)
```


Patch:
diff --git a/docs/source/markdown/options/gidmap.container.md b/docs/source/markdown/options/gidmap.container.md
index ac6bfdecac..0f4cfa86b0 100644
--- a/docs/source/markdown/options/gidmap.container.md
+++ b/docs/source/markdown/options/gidmap.container.md
@@ -2,11 +2,11 @@
 ####>   podman create, run
 ####> If file is edited, make sure the changes
 ####> are applicable to all of those.
-#### **--gidmap**=*container_gid:host_gid:amount*
+#### **--gidmap**=*[flags]container_uid:from_uid[:amount]*
 
 Run the container in a new user namespace using the supplied GID mapping. This
 option conflicts with the **--userns** and **--subgidname** options. This
 option provides a way to map host GIDs to container GIDs in the same way as
 __--uidmap__ maps host UIDs to container UIDs. For details see __--uidmap__.
 
-Note: the **--gidmap** flag cannot be called in conjunction with the **--pod** flag as a gidmap cannot be set on the container level when in a pod.
+Note: the **--gidmap** option cannot be called in conjunction with the **--pod** option as a gidmap cannot be set on the container level when in a pod.
diff --git a/docs/source/markdown/options/uidmap.container.md b/docs/source/markdown/options/uidmap.container.md
index 940ca6e26f..8f9ef7afcc 100644
--- a/docs/source/markdown/options/uidmap.container.md
+++ b/docs/source/markdown/options/uidmap.container.md
@@ -2,16 +2,23 @@
 ####>   podman create, run
 ####> If file is edited, make sure the changes
 ####> are applicable to all of those.
-#### **--uidmap**=*container_uid:from_uid:amount*
+#### **--uidmap**=*[flags]container_uid:from_uid[:amount]*
 
 Run the container in a new user namespace using the supplied UID mapping. This
 option conflicts with the **--userns** and **--subuidname** options. This
 option provides a way to map host UIDs to container UIDs. It can be passed
 several times to map different ranges.
 
+The possible values of the optional *flags* are discussed further down on this page.
+The *amount* value is optional and assumed to be **1** if not given.
+
 The *from_uid* value is based upon the user running the command, either rootful or rootless users.
-* rootful user:  *container_uid*:*host_uid*:*amount*
-* rootless user: *container_uid*:*intermediate_uid*:*amount*
+
+* rootful user:  [*flags*]*container_uid*:*host_uid*[:*amount*]
+* rootless user: [*flags*]*container_uid*:*intermediate_uid*[:*amount*]
+
+  `Rootful mappings`
+
 
 When **podman <<subcommand>>** is called by a privileged user, the option **--uidmap**
 works as a direct mapping between host UIDs and container UIDs.
@@ -28,6 +35,8 @@ If for example _amount_ is **4** the mapping looks like:
 | *from_uid* + 2 | *container_uid* + 2 |
 | *from_uid* + 3 | *container_uid* + 3 |
 
+  `Rootless mappings`
+
 When **podman <<subcommand>>** is called by an unprivileged user (i.e. running rootless),
 the value *from_uid* is interpreted as an "intermediate UID". In the rootless
 case, host UIDs are not mapped directly to container UIDs. Instead the mapping
@@ -76,8 +85,112 @@ Every additional range is added sequentially afterward:
 | 1                     | $FIRST_RANGE_ID         | $FIRST_RANGE_LENGTH |
 | 1+$FIRST_RANGE_LENGTH | $SECOND_RANGE_ID        | $SECOND_RANGE_LENGTH|
 
+  `Referencing a host ID from the parent namespace`
+
+As a rootless user, the given host ID in **--uidmap** or **--gidmap**
+is mapped from the *intermediate namespace* generated by Podman. Sometimes
+it is desirable to refer directly at the *host namespace*. It is possible
+to manually do so, by running `podman unshare cat /proc/self/gid_map`,
+finding the desired host id at the second column of the output, and getting
+the corresponding intermediate id from the first column.
+
+Podman can perform all that by preceding the host id in the mapping
+with the `@` symbol. For instance, by specifying `--gidmap 100000:@2000:1`,
+podman will look up the intermediate id corresponding to host id `2000` and
+it will map the found intermediate id to the container id `100000`. The
+given host id must have been subordinated (otherwise it would not be mapped
+into the intermediate space in the first place).
+
+If the length is greater than one, for instance with `--gidmap 100000:@2000:2`,
+Podman will map host ids `2000` and `2001` to `100000` and `100001`, respectively,
+regardless of how the intermediate mapping is defined.
+
+  `Extending previous mappings`
+
+Some mapping modifications may be cumbersome. For instance, a user
+starts with a mapping such as `--gidmap="0:0:65000"`, that needs to be
+changed such as the parent id `1000` is mapped to container id `100000`
+instead, leaving container id `1` unassigned. The corresponding `--gidmap`
+becomes `--gidmap="0:0:1" --gidmap="2:2:65534" --gidmap="100000:1:1"`.
+
+This notation can be simplified using the `+` flag, that takes care of
+breaking previous mappings removing any conflicting assignment with
+the given mapping. The flag is given before the container id
+as follows: `--gidmap="0:0:65000" --gidmap="+100000:1:1"`
+
+
+ Flag      | Example       | Description
+-----------|---------------|-------------
+ `+`       | `+100000:1:1` | Extend the previous mapping
+
+This notation leads to gaps in the assignment, so it may be convenient to
+fill those gaps afterwards: `--gidmap="0:0:65000" --gidmap="+100000:1:1" --gidmap="1:65001:1"`
+
+One specific use case for this flag is in the context of rootless
+users. A rootless user may specify mappings with the `+` flag as
+in `--gidmap="+100000:1:1"`. Podman will then "fill the gaps" starting
+from zero with all the remaining intermediate ids. This is convenient when
+a user wants to map a specific intermediate id to a container id, leaving
+the rest of subordinate ids to be mapped by Podman at will.
+
+  `Passing only one of --uidmap or --gidmap`
+
+Usually, subordinated user and group ids are assigned simultaneously, and
+for any user the subordinated user ids match the subordinated group ids.
+For convenience, if only one of **--uidmap** or **--gidmap** is given,
+podman assumes the mapping refers to both UIDs and GIDs and applies the
+given mapping to both. If only one value of the two needs to be changed,
+the mappings should include the `u` or the `g` flags to specify that
+they only apply to UIDs or GIDs and should not be copied over.
+
+ flag    | Example         | Description
+---------|-----------------|-----------------
+  `u`    | `u20000:2000:1` |The mapping only applies to UIDs
+  `g`    | `g10000:1000:1` |The mapping only applies to GIDs
+
+For instance given the command
+
+    podman <<subcommand>> --gidmap "0:0:1000" --gidmap "g2000:2000:1"
+
+Since no **--uidmap** is given, the **--gidmap** is copied to **--uidmap**,
+giving a command equivalent to
+
+    podman <<subcommand>> --gidmap "0:0:1000" --gidmap "2000:2000:1" --uidmap "0:0:1000"
+
+The `--gidmap "g2000:2000:1"` used the `g` flag and therefore it was
+not copied to **--uidmap**.
+
+  `Rootless mapping of additional host GIDs`
+
+A rootless user may desire to map a specific host group that has already been
+subordinated within _/etc/subgid_ without specifying the rest of the mapping.
+
+This can be done with **--gidmap "+g*container_gid*:@*host_gid*"**
+
+Where:
+
+- The host GID is given through the `@` symbol
+- The mapping of this GID is not copied over to **--usermap** thanks to the `g` flag.
+- The rest of the container IDs will be mapped starting from 0 to n,
+  with all the remaining subordinated GIDs, thanks to the `+` flag.
+
+For instance, if a user belongs to the group `2000` and that group is
+subordinated to that user (with `usermod --add-subgids 2000-2000 $USER`),
+the user can map the group into the container with: **--gidmap=+g100000:@2000**.
+
+If this mapping is combined with the option, **--group-add=keep-groups**, the
+process in the container will belong to group `100000`, and files belonging
+to group `2000` in the host will appear as being owned by group `100000`
+inside the container.
+
+    podman run --group-add=keep-groups --gidmap="+100000:@2000" ...
+
+  `No subordinate UIDs`
+
 Even if a user does not have any subordinate UIDs in  _/etc/subuid_,
 **--uidmap** can be used to map the normal UID of the user to a
 container UID by running `podman <<subcommand>> --uidmap $container_uid:0:1 --user $container_uid ...`.
 
-Note: the **--uidmap** flag cannot be called in conjunction with the **--pod** flag as a uidmap cannot be set on the container level when in a pod.
+  `Pods`
+
+The **--uidmap** option cannot be called in conjunction with the **--pod** option as a uidmap cannot be set on the container level when in a pod.
diff --git a/docs/tutorials/rootless_tutorial.md b/docs/tutorials/rootless_tutorial.md
index de7896bcfe..c77135f463 100644
--- a/docs/tutorials/rootless_tutorial.md
+++ b/docs/tutorials/rootless_tutorial.md
@@ -87,6 +87,34 @@ grep johndoe /etc/subuid /etc/subgid
 /etc/subgid:johndoe:100000:65536
 ```
 
+#### Giving access to additional groups
+
+Users can fully map additional groups to a container namespace if
+those groups subordinated to the user:
+
+```
+usermod --add-subgids 2000-2000 johndoe
+grep johndoe /etc/subgid
+```
+
+This means the user `johndoe` can "impersonate" the group `2000` inside the
+container. Note that it is usually not a good idea to subordinate active
+user ids to other users, because it would allow user impersonation.
+
+`johndoe` can use `--group-add keep-groups` to preserve the additional
+groups, and `--gidmap="+g102000:@2000"` to map the group `2000` in the host
+to the group `102000` in the container:
+
+```
+podman run \
+  --rm \
+  --group-add keep-groups \
+  --gidmap="+g102000:@2000" \
+  --volume "$PWD:/data:ro" \
+  --workdir /data \
+  alpine ls -lisa
+```
+
 ### Enable unprivileged `ping`
 
 Users running in a non-privileged container may not be able to use the `ping` utility from that container.
diff --git a/pkg/domain/infra/runtime_libpod.go b/pkg/domain/infra/runtime_libpod.go
index a6022c846c..9171c4ed6a 100644
--- a/pkg/domain/infra/runtime_libpod.go
+++ b/pkg/domain/infra/runtime_libpod.go
@@ -7,6 +7,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"io/fs"
 	"os"
 	"os/signal"
 	"sync"
@@ -17,6 +18,7 @@ import (
 	"github.com/containers/podman/v4/pkg/domain/entities"
 	"github.com/containers/podman/v4/pkg/namespaces"
 	"github.com/containers/podman/v4/pkg/rootless"
+	"github.com/containers/podman/v4/pkg/util"
 	"github.com/containers/storage/pkg/idtools"
 	"github.com/containers/storage/types"
 	"github.com/sirupsen/logrus"
@@ -333,11 +335,22 @@ func ParseIDMapping(mode namespaces.UsernsMode, uidMapSlice, gidMapSlice []strin
 		options.UIDMap = mappings.UIDs()
 		options.GIDMap = mappings.GIDs()
 	}
-	parsedUIDMap, err := idtools.ParseIDMap(uidMapSlice, "UID")
+
+	parentUIDMap, parentGIDMap, err := rootless.GetAvailableIDMaps()
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			// The kernel-provided files only exist if user namespaces are supported
+			logrus.Debugf("User or group ID mappings not available: %s", err)
+		} else {
+			return nil, err
+		}
+	}
+
+	parsedUIDMap, err := util.ParseIDMap(uidMapSlice, "UID", parentUIDMap)
 	if err != nil {
 		return nil, err
 	}
-	parsedGIDMap, err := idtools.ParseIDMap(gidMapSlice, "GID")
+	parsedGIDMap, err := util.ParseIDMap(gidMapSlice, "GID", parentGIDMap)
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/util/utils.go b/pkg/util/utils.go
index ac7553e95f..ec3fc67541 100644
--- a/pkg/util/utils.go
+++ b/pkg/util/utils.go
@@ -3,11 +3,14 @@ package util
 import (
 	"errors"
 	"fmt"
+	"io/fs"
 	"math"
+	"math/bits"
 	"os"
 	"os/user"
 	"path/filepath"
 	"regexp"
+	"sort"
 	"strconv"
 	"strings"
 	"sync"
@@ -28,11 +31,19 @@ import (
 	"github.com/containers/storage/pkg/idtools"
 	stypes "github.com/containers/storage/types"
 	securejoin "github.com/cyphar/filepath-securejoin"
+	ruser "github.com/opencontainers/runc/libcontainer/user"
 	"github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/sirupsen/logrus"
 	"golang.org/x/term"
 )
 
+// The flags that an [ug]id mapping can have
+type idMapFlags struct {
+	Extends  bool // The "+" flag
+	UserMap  bool // The "u" flag
+	GroupMap bool // The "g" flag
+}
+
 var containerConfig *config.Config
 
 func init() {
@@ -224,13 +235,6 @@ func GetKeepIDMapping(opts *namespaces.KeepIDUserNsOptions) (*stypes.IDMappingOp
 		return &options, uid, gid, nil
 	}
 
-	min := func(a, b int) int {
-		if a < b {
-			return a
-		}
-		return b
-	}
-
 	uid := rootless.GetRootlessUID()
 	gid := rootless.GetRootlessGID()
 	if opts.UID != nil {
@@ -303,6 +307,530 @@ func GetNoMapMapping() (*stypes.IDMappingOptions, int, int, error) {
 	return &options, 0, 0, nil
 }
 
+// Map a given ID to the Parent/Host ID of a given mapping, and return
+// its corresponding ID/ContainerID.
+// Returns an error if the given ID is not found on the mapping parents
+func mapIDwithMapping(id uint64, mapping []ruser.IDMap, mapSetting string) (mappedid uint64, err error) {
+	for _, v := range mapping {
+		if v.Count == 0 {
+			continue
+		}
+		if id >= uint64(v.ParentID) && id < uint64(v.ParentID+v.Count) {
+			offset := id - uint64(v.ParentID)
+			return uint64(v.ID) + offset, nil
+		}
+	}
+	return uint64(0), fmt.Errorf("parent ID %s %d is not mapped/delegated", mapSetting, id)
+}
+
+// Parse flags from spec
+// The `u` and `g` flags can be used to enforce that the mapping applies
+// exclusively to UIDs or GIDs.
+//
+// The `+` flag is interpreted as if the mapping replaces previous mappings
+// removing any conflicting mapping from those before adding this one.
+func parseFlags(spec []string) (flags idMapFlags, read int, err error) {
+	flags.Extends = false
+	flags.UserMap = false
+	flags.GroupMap = false
+	for read, char := range spec[0] {
+		switch {
+		case '0' <= char && char <= '9':
+			return flags, read, nil
+		case char == '+':
+			flags.Extends = true
+		case char == 'u':
+			flags.UserMap = true
+		case char == 'g':
+			flags.GroupMap = true
+		case true:
+			return flags, 0, fmt.Errorf("invalid mapping: %v. Unknown flag %v", spec, char)
+		}
+	}
+	return flags, read, fmt.Errorf("invalid mapping: %v, parsing flags", spec)
+}
+
+// Extension of idTools.parseTriple that parses idmap triples.
+// The triple should be a length 3 string array, containing:
+// - Flags and ContainerID
+// - HostID
+// - Size
+//
+// parseTriple returns the parsed mapping, the mapping flags and
+// any possible error. If the error is not-nil, the mapping and flags
+// are not well-defined.
+//
+// idTools.parseTriple is extended here with the following enhancements:
+//
+// HostID @ syntax:
+// =================
+// HostID may use the "@" syntax: The "101001:@1001:1" mapping
+// means "take the 1001 id from the parent namespace and map it to 101001"
+//
+// Flags:
+// ======
+// Flags can be used to tell the caller how should the mapping be interpreted
+func parseTriple(spec []string, parentMapping []ruser.IDMap, mapSetting string) (mappings []idtools.IDMap, flags idMapFlags, err error) {
+	if len(spec[0]) == 0 {
+		return mappings, flags, fmt.Errorf("invalid empty container id at %s map: %v", mapSetting, spec)
+	}
+	var cids, hids, sizes []uint64
+	var cid, hid uint64
+	var hidIsParent bool
+	flags, i, err := parseFlags(spec)
+	if err != nil {
+		return mappings, flags, err
+	}
+	// If no "u" nor "g" flag is given, assume the mapping applies to both
+	if !flags.UserMap && !flags.GroupMap {
+		flags.UserMap = true
+		flags.GroupMap = true
+	}
+	// Parse the container ID, which must be an integer:
+	cid, err = strconv.ParseUint(spec[0][i:], 10, 32)
+	if err != nil {
+		return mappings, flags, fmt.Errorf("parsing id map value %q: %w", spec[0], err)
+	}
+	// Parse the host id, which may be integer or @<integer>
+	if len(spec[1]) == 0 {
+		return mappings, flags, fmt.Errorf("invalid empty host id at %s map: %v", mapSetting, spec)
+	}
+	if spec[1][0] != '@' {
+		hidIsParent = false
+		hid, err = strconv.ParseUint(spec[1], 10, 32)
+	} else {
+		// Parse @<id>, where <id> is an integer corresponding to the parent mapping
+		hidIsParent = true
+		hid, err = strconv.ParseUint(spec[1][1:], 10, 32)
+	}
+	if err != nil {
+		return mappings, flags, fmt.Errorf("parsing id map value %q: %w", spec[1], err)
+	}
+	// Parse the size of the mapping, which must be an integer
+	sz, err := strconv.ParseUint(spec[2], 10, 32)
+	if err != nil {
+		return mappings, flags, fmt.Errorf("parsing id map value %q: %w", spec[2], err)
+	}
+
+	if hidIsParent {
+		if (mapSetting == "UID" && flags.UserMap) || (mapSetting == "GID" && flags.GroupMap) {
+			for i := uint64(0); i < sz; i++ {
+				cids = append(cids, cid+i)
+				mappedID, err := mapIDwithMapping(hid+i, parentMapping, mapSetting)
+				if err != nil {
+					return mappings, flags, err
+				}
+				hids = append(hids, mappedID)
+				sizes = append(sizes, 1)
+			}
+		}
+	} else {
+		cids = []uint64{cid}
+		hids = []uint64{hid}
+		sizes = []uint64{sz}
+	}
+
+	// Avoid possible integer overflow on 32bit builds
+	if bits.UintSize == 32 {
+		for i := range cids {
+			if cids[i] > math.MaxInt32 || hids[i] > math.MaxInt32 || sizes[i] > math.MaxInt32 {
+				return mappings, flags, fmt.Errorf("initializing ID mappings: %s setting is malformed expected [\"[+ug]uint32:[@]uint32[:uint32]\"] : %q", mapSetting, spec)
+			}
+		}
+	}
+	for i := range cids {
+		mappings = append(mappings, idtools.IDMap{
+			ContainerID: int(cids[i]),
+			HostID:      int(hids[i]),
+			Size:        int(sizes[i]),
+		})
+	}
+	return mappings, flags, nil
+}
+
+func min(a, b int) int {
+	if a < b {
+		return a
+	}
+	return b
+}
+
+func max(a, b int) int {
+	if a > b {
+		return a
+	}
+	return b
+}
+
+// Remove any conflicting mapping from mapping present in extension, so
+// extension can be appended to mapping without conflicts.
+// Returns the resulting mapping, with extension appended to it.
+func breakInsert(mapping []idtools.IDMap, extension idtools.IDMap) (result []idtools.IDMap) {
+	// Two steps:
+	// 1. Remove extension regions from mapping
+	//    For each element in mapping, remove those parts of the mapping
+	//    that overlap with the extension, both in the container range
+	//    or in the host range.
+	// 2. Add extension to mapping
+	// Step 1: Remove extension regions from mapping
+	for _, mapPiece := range mapping {
+		// Make container and host ranges comparable, by computing their
+		// extension relative to the start of the mapPiece:
+		range1Start := extension.ContainerID - mapPiece.ContainerID
+		range2Start := extension.HostID - mapPiece.HostID
+
+		// Range end relative to mapPiece range
+		range1End := range1Start + extension.Size
+		range2End := range2Start + extension.Size
+
+		// mapPiece range:
+		mapPieceStart := 0
+		mapPieceEnd := mapPiece.Size
+
+		if range1End < mapPieceStart || range1Start >= mapPieceEnd {
+			// out of range, forget about it
+			range1End = -1
+			range1Start = -1
+		} else {
+			// clip limits removal to mapPiece
+			range1End = min(range1End, mapPieceEnd)
+			range1Start = max(range1Start, mapPieceStart)
+		}
+
+		if range2End < mapPieceStart || range2Start >= mapPieceEnd {
+			// out of range, forget about it
+			range2End = -1
+			range2Start = -1
+		} else {
+			// clip limits removal to mapPiece
+			range2End = min(range2End, mapPieceEnd)
+			range2Start = max(range2Start, mapPieceStart)
+		}
+
+		// If there is nothing to remove, append the original and continue:
+		if range1Start == -1 && range2Start == -1 {
+			result = append(result, mapPiece)
+			continue
+		}
+
+		// If there is one range to remove, save it at range1:
+		if range1Start == -1 && range2Start != -1 {
+			range1Start = range2Start
+			range1End = range2End
+			range2Start = -1
+			range2End = -1
+		}
+
+		// If we have two valid ranges, merge them into range1 if possible
+		if range2Start != -1 {
+			// Swap ranges so always range1Start is <= range2Start
+			if range2Start < range1Start {
+				range1Start, range2Start = range2Start, range1Start
+				range1End, range2End = range2End, range1End
+			}
+			// If there is overlap, merge them:
+			if range1End >= range2Start {
+				range1End = max(range1End, range2End)
+				range2Start = -1
+				range2End = -1
+			}
+		}
+
+		if range1Start > 0 {
+			// Append everything before range1Start
+			result = append(result, idtools.IDMap{
+				ContainerID: mapPiece.ContainerID,
+				HostID:      mapPiece.HostID,
+				Size:        range1Start,
+			})
+		}
+		if range2Start == -1 {
+			// Append everything after range1
+			if mapPiece.Size-range1End > 0 {
+				result = append(result, idtools.IDMap{
+					ContainerID: mapPiece.ContainerID + range1End,
+					HostID:      mapPiece.HostID + range1End,
+					Size:        mapPiece.Size - range1End,
+				})
+			}
+		} else {
+			// Append everything between range1 and range2
+			result = append(result, idtools.IDMap{
+				ContainerID: mapPiece.ContainerID + range1End,
+				HostID:      mapPiece.HostID + range1End,
+				Size:        range2Start - range1End,
+			})
+			// Append everything after range2
+			if mapPiece.Size-range2End > 0 {
+				result = append(result, idtools.IDMap{
+					ContainerID: mapPiece.ContainerID + range2End,
+					HostID:      mapPiece.HostID + range2End,
+					Size:        mapPiece.Size - range2End,
+				})
+			}
+		}
+	}
+	// Step 2. Add extension to mapping
+	result = append(result, extension)
+	return result
+}
+
+// A multirange is a list of [start,end) ranges and is expressed as
+// an array of length-2 integers.
+//
+// This function computes availableRanges = fullRanges - usedRanges,
+// where all variables are multiranges.
+// The subtraction operation is defined as "return the multirange
+// containing all integers found in fullRanges and not found in usedRanges.
+func getAvailableIDRanges(fullRanges, usedRanges [][2]int) (availableRanges [][2]int) {
+	// Sort them
+	sort.Slice(fullRanges, func(i, j int) bool {
+		return fullRanges[i][0] < fullRanges[j][0]
+	})
+
+	if len(usedRanges) == 0 {
+		return fullRanges
+	}
+
+	sort.Slice(usedRanges, func(i, j int) bool {
+		return usedRanges[i][0] < usedRanges[j][0]
+	})
+
+	// To traverse usedRanges
+	i := 0
+	nextUsedID := usedRanges[i][0]
+	nextUsedIDEnd := usedRanges[i][1]
+
+	for _, fullRange := range fullRanges {
+		currentIDToProcess := fullRange[0]
+		for currentIDToProcess < fullRange[1] {
+			switch {
+			case nextUsedID == -1:
+				// No further used ids, append all the remaining ranges
+				availableRanges = append(availableRanges, [2]int{currentIDToProcess, fullRange[1]})
+				currentIDToProcess = fullRange[1]
+			case currentIDToProcess < nextUsedID:
+				// currentIDToProcess is not used, append:
+				if fullRange[1] <= nextUsedID {
+					availableRanges = append(availableRanges, [2]int{currentIDToProcess, fullRange[1]})
+					currentIDToProcess = fullRange[1]
+				} else {
+					availableRanges = append(availableRanges, [2]int{currentIDToProcess, nextUsedID})
+					currentIDToProcess = nextUsedID
+				}
+			case currentIDToProcess == nextUsedID:
+				// currentIDToProcess and all ids until nextUsedIDEnd are used
+				// Advance currentIDToProcess
+				currentIDToProcess = min(fullRange[1], nextUsedIDEnd)
+			default: // currentIDToProcess > nextUsedID
+				// Increment nextUsedID so it is >= currentIDToProcess
+				// Go to next used block if this one is all behind:
+				if currentIDToProcess >= nextUsedIDEnd {
+					i += 1
+					if i == len(usedRanges) {
+						// No more used ranges
+						nextUsedID = -1
+					} else {
+						nextUsedID = usedRanges[i][0]
+						nextUsedIDEnd = usedRanges[i][1]
+					}
+					continue
+				} else { // currentIDToProcess < nextUsedIDEnd
+					currentIDToProcess = min(fullRange[1], nextUsedIDEnd)
+				}
+			}
+		}
+	}
+	return availableRanges
+}
+
+// Gets the multirange of subordinated ids from parentMapping and the
+// multirange of already assigned ids from idmap, and returns the
+// multirange of unassigned subordinated ids.
+func getAvailableIDRangesFromMappings(idmap []idtools.IDMap, parentMapping []ruser.IDMap) (availableRanges [][2]int) {
+	// Get all subordinated ids from parentMapping:
+	fullRanges := [][2]int{} // {Multirange: [start, end), [start, end), ...}
+	for _, mapPiece := range parentMapping {
+		fullRanges = append(fullRanges, [2]int{int(mapPiece.ID), int(mapPiece.ID + mapPiece.Count)})
+	}
+
+	// Get the ids already mapped:
+	usedRanges := [][2]int{}
+	for _, mapPiece := range idmap {
+		usedRanges = append(usedRanges, [2]int{mapPiece.HostID, mapPiece.HostID + mapPiece.Size})
+	}
+
+	// availableRanges = fullRanges - usedRanges
+	availableRanges = getAvailableIDRanges(fullRanges, usedRanges)
+	return availableRanges
+}
+
+// Fills unassigned idmap ContainerIDs, starting from zero with all
+// the available ids given by availableRanges.
+// Returns the filled idmap.
+func fillIDMap(idmap []idtools.IDMap, availableRanges [][2]int) (output []idtools.IDMap) {
+	idmapByCid := append([]idtools.IDMap{}, idmap...)
+	sort.Slice(idmapByCid, func(i, j int) bool {
+		return idmapByCid[i].ContainerID < idmapByCid[j].ContainerID
+	})
+
+	if len(availableRanges) == 0 {
+		return idmapByCid
+	}
+
+	i := 0 // to iterate through availableRanges
+	nextCid := 0
+	nextAvailHid := availableRanges[i][0]
+
+	for _, mapPiece := range idmapByCid {
+		// While there are available IDs to map and unassigned
+		// container ids, map the available ids:
+		for nextCid < mapPiece.ContainerID && nextAvailHid != -1 {
+			size := min(mapPiece.ContainerID-nextCid, availableRanges[i][1]-nextAvailHid)
+			output = append(output, idtools.IDMap{
+				ContainerID: nextCid,
+				HostID:      nextAvailHid,
+				Size:        size,
+			})
+			nextCid += size
+			if nextAvailHid+size < availableRanges[i][1] {
+				nextAvailHid += size
+			} else {
+				i += 1
+				if i == len(availableRanges) {
+					nextAvailHid = -1
+					continue
+				}
+				nextAvailHid = availableRanges[i][0]
+			}
+		}
+		// The given mapping does not change
+		output = append(output, mapPiece)
+		nextCid += mapPiece.Size
+	}
+	// After the last given mapping is mapped, we use all the remaining
+	// ids to map the rest of the space
+	for nextAvailHid != -1 {
+		size := availableRanges[i][1] - nextAvailHid
+		output = append(output, idtools.IDMap{
+			ContainerID: nextCid,
+			HostID:      nextAvailHid,
+			Size:        size,
+		})
+		nextCid += size
+		i += 1
+		if i == len(availableRanges) {
+			nextAvailHid = -1
+			continue
+		}
+		nextAvailHid = availableRanges[i][0]
+	}
+	return output
+}
+
+func addOneMapping(idmap []idtools.IDMap, fillMap bool, mapping idtools.IDMap, flags idMapFlags, mapSetting string) ([]idtools.IDMap, bool) {
+	// If we are mapping uids and the spec doesn't have the usermap flag, ignore it
+	if mapSetting == "UID" && !flags.UserMap {
+		return idmap, fillMap
+	}
+	// If we are mapping gids and the spec doesn't have the groupmap flag, ignore it
+	if mapSetting == "GID" && !flags.GroupMap {
+		return idmap, fillMap
+	}
+
+	// Zero-size mapping is ignored
+	if mapping.Size == 0 {
+		return idmap, fillMap
+	}
+
+	// Not extending, just append:
+	if !flags.Extends {
+		idmap = append(idmap, mapping)
+		return idmap, fillMap
+	}
+	// Break and extend the last mapping:
+
+	// Extending without any mapping, if rootless, we will fill
+	// the space with the remaining IDs:
+	if len(idmap) == 0 && rootless.IsRootless() {
+		fillMap = true
+	}
+
+	idmap = breakInsert(idmap, mapping)
+	return idmap, fillMap
+}
+
+// Extension of idTools.ParseIDMap that parses idmap triples from string.
+// This extension accepts additional flags that control how the mapping is done
+func ParseIDMap(mapSpec []string, mapSetting string, parentMapping []ruser.IDMap) (idmap []idtools.IDMap, err error) {
+	stdErr := fmt.Errorf("initializing ID mappings: %s setting is malformed expected [\"[+ug]uint32:[@]uint32[:uint32]\"] : %q", mapSetting, mapSpec)
+	// When fillMap is true, the given mapping will be filled with the remaining subordinate available ids
+	fillMap := false
+	for _, idMapSpec := range mapSpec {
+		if idMapSpec == "" {
+			continue
+		}
+		idSpec := strings.Split(idMapSpec, ":")
+		// if it's a length-2 list assume the size is 1:
+		if len(idSpec) == 2 {
+			idSpec = append(idSpec, "1")
+		}
+		if len(idSpec)%3 != 0 {
+			return nil, stdErr
+		}
+		for i := range idSpec {
+			if i%3 != 0 {
+				continue
+			}
+			if len(idSpec[i]) == 0 {
+				return nil, stdErr
+			}
+			// Parse this mapping:
+			mappings, flags, err := parseTriple(idSpec[i:i+3], parentMapping, mapSetting)
+			if err != nil {
+				return nil, err
+			}
+			for _, mapping := range mappings {
+				idmap, fillMap = addOneMapping(idmap, fillMap, mapping, flags, mapSetting)
+			}
+		}
+	}
+	if fillMap {
+		availableRanges := getAvailableIDRangesFromMappings(idmap, parentMapping)
+		idmap = fillIDMap(idmap, availableRanges)
+	}
+
+	if len(idmap) == 0 {
+		return idmap, nil
+	}
+	idmap = sortAndMergeConsecutiveMappings(idmap)
+	return idmap, nil
+}
+
+// Given a mapping, sort all entries by their ContainerID then and merge
+// entries that are consecutive.
+func sortAndMergeConsecutiveMappings(idmap []idtools.IDMap) (finalIDMap []idtools.IDMap) {
+	idmapByCid := append([]idtools.IDMap{}, idmap...)
+	sort.Slice(idmapByCid, func(i, j int) bool {
+		return idmapByCid[i].ContainerID < idmapByCid[j].ContainerID
+	})
+	for i, mapPiece := range idmapByCid {
+		if i == 0 {
+			finalIDMap = append(finalIDMap, mapPiece)
+			continue
+		}
+		lastMap := finalIDMap[len(finalIDMap)-1]
+		containersMatch := lastMap.ContainerID+lastMap.Size == mapPiece.ContainerID
+		hostsMatch := lastMap.HostID+lastMap.Size == mapPiece.HostID
+		if containersMatch && hostsMatch {
+			finalIDMap[len(finalIDMap)-1].Size += mapPiece.Size
+		} else {
+			finalIDMap = append(finalIDMap, mapPiece)
+		}
+	}
+	return finalIDMap
+}
+
 // ParseIDMapping takes idmappings and subuid and subgid maps and returns a storage mapping
 func ParseIDMapping(mode namespaces.UsernsMode, uidMapSlice, gidMapSlice []string, subUIDMap, subGIDMap string) (*stypes.IDMappingOptions, error) {
 	options := stypes.IDMappingOptions{
@@ -349,14 +877,38 @@ func ParseIDMapping(mode namespaces.UsernsMode, uidMapSlice, gidMapSlice []strin
 		options.UIDMap = mappings.UIDs()
 		options.GIDMap = mappings.GIDs()
 	}
-	parsedUIDMap, err := idtools.ParseIDMap(uidMapSlice, "UID")
+
+	parentUIDMap, parentGIDMap, err := rootless.GetAvailableIDMaps()
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			// The kernel-provided files only exist if user namespaces are supported
+			logrus.Debugf("User or group ID mappings not available: %s", err)
+		} else {
+			return nil, err
+		}
+	}
+
+	parsedUIDMap, err := ParseIDMap(uidMapSlice, "UID", parentUIDMap)
 	if err != nil {
 		return nil, err
 	}
-	parsedGIDMap, err := idtools.ParseIDMap(gidMapSlice, "GID")
+	parsedGIDMap, err := ParseIDMap(gidMapSlice, "GID", parentGIDMap)
 	if err != nil {
 		return nil, err
 	}
+
+	// When running rootless, if one of UID/GID mappings is provided, fill the other one:
+	if rootless.IsRootless() {
+		switch {
+		case len(parsedUIDMap) != 0 && len(parsedGIDMap) == 0:
+			availableRanges := getAvailableIDRangesFromMappings(parsedGIDMap, parentGIDMap)
+			parsedGIDMap = fillIDMap(parsedGIDMap, availableRanges)
+		case len(parsedUIDMap) == 0 && len(parsedGIDMap) != 0:
+			availableRanges := getAvailableIDRangesFromMappings(parsedUIDMap, parentUIDMap)
+			parsedUIDMap = fillIDMap(parsedUIDMap, availableRanges)
+		}
+	}
+
 	options.UIDMap = append(options.UIDMap, parsedUIDMap...)
 	options.GIDMap = append(options.GIDMap, parsedGIDMap...)
 	if len(options.UIDMap) > 0 {


Test patch:
diff --git a/pkg/util/utils_test.go b/pkg/util/utils_test.go
index 0ef48a6f3a..993cea74ec 100644
--- a/pkg/util/utils_test.go
+++ b/pkg/util/utils_test.go
@@ -7,6 +7,8 @@ import (
 	"time"
 
 	"github.com/containers/storage/pkg/homedir"
+	"github.com/containers/storage/pkg/idtools"
+	ruser "github.com/opencontainers/runc/libcontainer/user"
 	"github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/stretchr/testify/assert"
 )
@@ -15,6 +17,438 @@ var (
 	sliceData = []string{"one", "two", "three", "four"}
 )
 
+func BreakInsert(mapping []idtools.IDMap, extension idtools.IDMap) (result []idtools.IDMap) {
+	result = breakInsert(mapping, extension)
+	result = sortAndMergeConsecutiveMappings(result)
+	return result
+}
+
+//#####################
+
+func TestBreakInsert1(t *testing.T) {
+	// extension below mapping
+	mapping := []idtools.IDMap{
+		{
+			ContainerID: 1000,
+			HostID:      1000,
+			Size:        1,
+		},
+	}
+	extension := idtools.IDMap{
+		ContainerID: 2,
+		HostID:      2,
+		Size:        1,
+	}
+	expectedResult := []idtools.IDMap{
+		{
+			ContainerID: 2,
+			HostID:      2,
+			Size:        1,
+		},
+		{
+			ContainerID: 1000,
+			HostID:      1000,
+			Size:        1,
+		},
+	}
+	result := BreakInsert(mapping, extension)
+	assert.Equal(t, result, expectedResult)
+}
+
+func TestBreakInsert2(t *testing.T) {
+	// extension below mapping
+	mapping := []idtools.IDMap{
+		{
+			ContainerID: 1000,
+			HostID:      1001,
+			Size:        2,
+		},
+	}
+	extension := idtools.IDMap{
+		ContainerID: 2,
+		HostID:      3,
+		Size:        2,
+	}
+	expectedResult := []idtools.IDMap{
+		{
+			ContainerID: 2,
+			HostID:      3,
+			Size:        2,
+		},
+		{
+			ContainerID: 1000,
+			HostID:      1001,
+			Size:        2,
+		},
+	}
+	result := BreakInsert(mapping, extension)
+	assert.Equal(t, expectedResult, result)
+}
+
+func TestBreakInsert3(t *testing.T) {
+	// extension above mapping
+	mapping := []idtools.IDMap{
+		{
+			ContainerID: 2,
+			HostID:      3,
+			Size:        2,
+		},
+	}
+	extension := idtools.IDMap{
+		ContainerID: 1000,
+		HostID:      1001,
+		Size:        2,
+	}
+	expectedResult := []idtools.IDMap{
+		{
+			ContainerID: 2,
+			HostID:      3,
+			Size:        2,
+		},
+		{
+			ContainerID: 1000,
+			HostID:      1001,
+			Size:        2,
+		},
+	}
+	result := BreakInsert(mapping, extension)
+	assert.Equal(t, expectedResult, result)
+}
+
+func TestBreakInsert4(t *testing.T) {
+	// extension right below mapping
+	mapping := []idtools.IDMap{
+		{
+			ContainerID: 4,
+			HostID:      5,
+			Size:        4,
+		},
+	}
+	extension := idtools.IDMap{
+		ContainerID: 1,
+		HostID:      1,
+		Size:        3,
+	}
+	expectedResult := []idtools.IDMap{
+		{
+			ContainerID: 1,
+			HostID:      1,
+			Size:        3,
+		},
+		{
+			ContainerID: 4,
+			HostID:      5,
+			Size:        4,
+		},
+	}
+	result := BreakInsert(mapping, extension)
+	assert.Equal(t, expectedResult, result)
+}
+
+func TestSortAndMergeConsecutiveMappings(t *testing.T) {
+	// Extension and mapping are consecutive
+	mapping := []idtools.IDMap{
+		{
+			ContainerID: 1,
+			HostID:      1,
+			Size:        3,
+		},
+		{
+			ContainerID: 4,
+			HostID:      4,
+			Size:        4,
+		},
+	}
+	expectedResult := []idtools.IDMap{
+		{
+			ContainerID: 1,
+			HostID:      1,
+			Size:        7,
+		},
+	}
+	result := sortAndMergeConsecutiveMappings(mapping)
+	assert.Equal(t, expectedResult, result)
+}
+
+//#####################
+
+func TestParseIDMap(t *testing.T) {
+	mapSpec := []string{"+100000:@1002:1"}
+
+	parentMapping := []ruser.IDMap{
+		{
+			ID:       int64(20),
+			ParentID: int64(1002),
+			Count:    1,
+		},
+	}
+	expectedResult := []idtools.IDMap{
+		{
+			ContainerID: 100000,
+			HostID:      20,
+			Size:        1,
+		},
+	}
+	result, err := ParseIDMap(
+		mapSpec,
+		"UID",
+		parentMapping,
+	)
+	assert.Equal(t, nil, err)
+	assert.Equal(t, expectedResult, result)
+}
+
+func TestParseIDMapSizeMissing(t *testing.T) {
+	// Size is 1 if not provided
+	mapSpec := []string{"+100000:@1002"}
+
+	parentMapping := []ruser.IDMap{
+		{
+			ID:       int64(20),
+			ParentID: int64(1002),
+			Count:    1,
+		},
+	}
+	expectedResult := []idtools.IDMap{
+		{
+			ContainerID: 100000,
+			HostID:      20,
+			Size:        1,
+		},
+	}
+	result, err := ParseIDMap(
+		mapSpec,
+		"UID",
+		parentMapping,
+	)
+	assert.Equal(t, nil, err)
+	assert.Equal(t, expectedResult, result)
+}
+
+func TestParseIDMap2(t *testing.T) {
+	mapSpec := []string{"0:2000:100000", "+1:100:1"}
+	parentMapping := []ruser.IDMap(nil)
+	expectedResult := []idtools.IDMap{
+		{
+			ContainerID: 0,
+			HostID:      2000,
+			Size:        1,
+		},
+		{
+			ContainerID: 1,
+			HostID:      100,
+			Size:        1,
+		},
+		{
+			ContainerID: 2,
+			HostID:      2002,
+			Size:        99998,
+		},
+	}
+	result, err := ParseIDMap(
+		mapSpec,
+		"UID",
+		parentMapping,
+	)
+	assert.Equal(t, nil, err)
+	assert.Equal(t, expectedResult, result)
+}
+
+func TestParseIDMap3(t *testing.T) {
+	mapSpec := []string{"0:0:20", "24:24:6", "+7:1000:2", "+12:2000:3", "+18:3000:7"}
+	parentMapping := []ruser.IDMap(nil)
+	expectedResult := []idtools.IDMap{
+		{
+			ContainerID: 0,
+			HostID:      0,
+			Size:        7,
+		},
+		{
+			ContainerID: 7,
+			HostID:      1000,
+			Size:        2,
+		},
+		{
+			ContainerID: 9,
+			HostID:      9,
+			Size:        3,
+		},
+		{
+			ContainerID: 12,
+			HostID:      2000,
+			Size:        3,
+		},
+		{
+			ContainerID: 15,
+			HostID:      15,
+			Size:        3,
+		},
+		{
+			ContainerID: 18,
+			HostID:      3000,
+			Size:        7,
+		},
+		{
+			ContainerID: 25,
+			HostID:      25,
+			Size:        5,
+		},
+	}
+	result, err := ParseIDMap(
+		mapSpec,
+		"UID",
+		parentMapping,
+	)
+	assert.Equal(t, nil, err)
+	assert.Equal(t, expectedResult, result)
+}
+
+func TestParseIDMap4(t *testing.T) {
+	mapSpec := []string{"0:0:20", "+10:1:1"}
+	parentMapping := []ruser.IDMap(nil)
+	expectedResult := []idtools.IDMap{
+		{
+			ContainerID: 0,
+			HostID:      0,
+			Size:        1,
+		},
+		{
+			ContainerID: 2,
+			HostID:      2,
+			Size:        8,
+		},
+		{
+			ContainerID: 10,
+			HostID:      1,
+			Size:        1,
+		},
+		{
+			ContainerID: 11,
+			HostID:      11,
+			Size:        9,
+		},
+	}
+	result, err := ParseIDMap(
+		mapSpec,
+		"UID",
+		parentMapping,
+	)
+	assert.Equal(t, nil, err)
+	assert.Equal(t, expectedResult, result)
+}
+
+func TestParseIDMap5(t *testing.T) {
+	mapSpec := []string{"0:20:10", "15:35:10", "+8:23:16"}
+	parentMapping := []ruser.IDMap(nil)
+	expectedResult := []idtools.IDMap{
+		{
+			ContainerID: 0,
+			HostID:      20,
+			Size:        3,
+		},
+		{
+			ContainerID: 8,
+			HostID:      23,
+			Size:        16,
+		},
+		{
+			ContainerID: 24,
+			HostID:      44,
+			Size:        1,
+		},
+	}
+	result, err := ParseIDMap(
+		mapSpec,
+		"UID",
+		parentMapping,
+	)
+	assert.Equal(t, nil, err)
+	assert.Equal(t, expectedResult, result)
+}
+
+func TestParseIDMapUserGroupFlags(t *testing.T) {
+	mapSpec := []string{"u1:3:1", "g2:4:2"}
+	parentMapping := []ruser.IDMap(nil)
+	expectedResultUser := []idtools.IDMap{
+		{
+			ContainerID: 1,
+			HostID:      3,
+			Size:        1,
+		},
+	}
+	expectedResultGroup := []idtools.IDMap{
+		{
+			ContainerID: 2,
+			HostID:      4,
+			Size:        2,
+		},
+	}
+	result, err := ParseIDMap(mapSpec, "UID", parentMapping)
+	assert.Equal(t, nil, err)
+	assert.Equal(t, expectedResultUser, result)
+	result, err = ParseIDMap(mapSpec, "GID", parentMapping)
+	assert.Equal(t, err, nil)
+	assert.Equal(t, expectedResultGroup, result)
+}
+
+func TestFillIDMap(t *testing.T) {
+	availableRanges := [][2]int{{0, 10}, {10000, 20000}}
+	idmap := []idtools.IDMap{
+		{
+			ContainerID: 1,
+			HostID:      1000,
+			Size:        10,
+		},
+		{
+			ContainerID: 30,
+			HostID:      2000,
+			Size:        20,
+		},
+	}
+	expectedResult := []idtools.IDMap{
+		{
+			ContainerID: 0,
+			HostID:      0,
+			Size:        1,
+		},
+		{
+			ContainerID: 1,
+			HostID:      1000,
+			Size:        10,
+		},
+		{
+			ContainerID: 11,
+			HostID:      1,
+			Size:        9,
+		},
+		{
+			ContainerID: 20,
+			HostID:      10000,
+			Size:        10,
+		},
+		{
+			ContainerID: 30,
+			HostID:      2000,
+			Size:        20,
+		},
+		{
+			ContainerID: 50,
+			HostID:      10010,
+			Size:        9990,
+		},
+	}
+	result := fillIDMap(idmap, availableRanges)
+	assert.Equal(t, expectedResult, result)
+}
+
+func TestGetAvailableIDRanges(t *testing.T) {
+	all := [][2]int{{0, 30}, {50, 70}}
+	used := [][2]int{{2, 4}, {25, 55}}
+	expectedResult := [][2]int{{0, 2}, {4, 25}, {55, 70}}
+	result := getAvailableIDRanges(all, used)
+	assert.Equal(t, expectedResult, result)
+}
+
 func TestStringInSlice(t *testing.T) {
 	// string is in the slice
 	assert.True(t, StringInSlice("one", sliceData))
diff --git a/test/e2e/run_userns_test.go b/test/e2e/run_userns_test.go
index 05a4728987..810e0060a8 100644
--- a/test/e2e/run_userns_test.go
+++ b/test/e2e/run_userns_test.go
@@ -304,7 +304,7 @@ var _ = Describe("Podman UserNS support", func() {
 
 	It("podman --userns=container:CTR", func() {
 		ctrName := "userns-ctr"
-		session := podmanTest.Podman([]string{"run", "-d", "--uidmap=0:0:1", "--uidmap=1:1:4998", "--name", ctrName, "alpine", "top"})
+		session := podmanTest.Podman([]string{"run", "-d", "--uidmap=0:0:1", "--uidmap=1:2:4998", "--name", ctrName, "alpine", "top"})
 		session.WaitWithDefaultTimeout()
 		Expect(session).Should(Exit(0))