From 8dfcad291ed9f2ed6d1e530e5a6cfa509f7359c0 Mon Sep 17 00:00:00 2001
From: CyberMind-FR <gandalf@Gk2.net>
Date: Tue, 28 Jul 2026 16:25:26 +0200
Subject: [PATCH] fix(torrent): only add lxc.idmap if absent (default.conf
 already provides it; duplicate aborts container) (ref #917)

Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
---
 packages/secubox-torrent/lxc/install-lxc.sh | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/packages/secubox-torrent/lxc/install-lxc.sh b/packages/secubox-torrent/lxc/install-lxc.sh
index 4df5968a..40f0f97d 100755
--- a/packages/secubox-torrent/lxc/install-lxc.sh
+++ b/packages/secubox-torrent/lxc/install-lxc.sh
@@ -37,10 +37,16 @@ if [ -f "$SENTINEL" ]; then log "already provisioned; skipping create"; else
   # secubox-peertube).
   lxc-create -n "$LXC_NAME" -t download -P "$LXC_PATH" -- \
     --dist debian --release bookworm --arch "$(dpkg --print-architecture)"
-  # unprivileged idmap + static IP on br-lxc (config appended)
+  # idmap: the download template copies /etc/lxc/default.conf, which on gk2
+  # already provides the unprivileged u/g 0->100000 65536 mapping. Only add it
+  # if absent — a DUPLICATE mapping makes newuidmap fail ("write to uid_map
+  # failed: Invalid argument") and the container ABORTS at start.
+  if ! grep -q '^lxc.idmap' "$LXC_PATH/$LXC_NAME/config"; then
+    printf 'lxc.idmap = u 0 %s 65536\nlxc.idmap = g 0 %s 65536\n' \
+      "$LXC_ROOT_UID" "$LXC_ROOT_UID" >> "$LXC_PATH/$LXC_NAME/config"
+  fi
+  # static IP on br-lxc (config appended)
   cat >> "$LXC_PATH/$LXC_NAME/config" <<EOF
-lxc.idmap = u 0 $LXC_ROOT_UID 65536
-lxc.idmap = g 0 $LXC_ROOT_UID 65536
 lxc.net.0.type = veth
 lxc.net.0.link = $LXC_BRIDGE
 lxc.net.0.flags = up