static-subid: Deterministic subordinate UID/GID assignment for unprivileged containers

Abstract

static-subid calculates predictable subordinate UID and GID ranges for Linux users based on their UID, ensuring consistent ID mappings across multiple systems. Unlike shadow-utils' sequential allocation (which depends on creation order), static-subid uses a deterministic formula that guarantees the same user UID always receives the same subordinate ID range. Subordinate IDs enable user namespaces for unprivileged container runtimes (Podman, Docker rootless mode, LXC) by mapping container UIDs/GIDs to host subordinate IDs without requiring root privileges.