Check ID mapping before print hints

domain-join.sh

@@ -230,6 +230,52 @@ detect_env() {
   echo "unknown"
 }
 
+id_map_covers_container_range() {
+  # Check whether a /proc/*/{uid,gid}_map covers container IDs 0..LXC_IDMAP_RANGE_SIZE-1.
+  # Format:
+  #   <container_start> <host_start> <length>
+  local map_file="$1"
+  local required_max=$((LXC_IDMAP_RANGE_SIZE - 1))
+  local container_start host_start length container_end
+
+  [[ -r "$map_file" ]] || return 1
+
+  while read -r container_start host_start length; do
+    [[ "$container_start" =~ ^[0-9]+$ ]] || continue
+    [[ "$host_start" =~ ^[0-9]+$ ]] || continue
+    [[ "$length" =~ ^[0-9]+$ ]] || continue
+
+    container_end=$((container_start + length - 1))
+
+    if [[ "$container_start" -le 0 && "$container_end" -ge "$required_max" ]]; then
+      return 0
+    fi
+  done <"$map_file"
+
+  return 1
+}
+
+lxc_idmap_is_sufficient() {
+  # The script runs inside the container, so the host-side mapping may already
+  # be configured. Verify that both UID and GID maps cover all container IDs
+  # required by the SSSD range before printing host instructions.
+  id_map_covers_container_range /proc/self/uid_map \
+    && id_map_covers_container_range /proc/self/gid_map
+}
+
+print_lxc_current_idmaps() {
+  # Print current namespace mappings for diagnostics.
+  if [[ -r /proc/self/uid_map ]]; then
+    log "Current /proc/self/uid_map:"
+    sed 's/^/  /' /proc/self/uid_map || true
+  fi
+
+  if [[ -r /proc/self/gid_map ]]; then
+    log "Current /proc/self/gid_map:"
+    sed 's/^/  /' /proc/self/gid_map || true
+  fi
+}
+
 print_lxc_idmap_host_instructions() {
   # Print host-side Proxmox/LXC idmap guidance for unprivileged containers.
   cat <<EOF
@@ -964,8 +1010,17 @@ apt_update_upgrade
 install_base_packages
 
 if [[ "$ENV_KIND" == "lxc" ]]; then
-  warn "LXC container detected. Host-side ID mapping configuration may be required."
+  log "LXC container detected. Checking current UID/GID namespace mappings."
+  print_lxc_current_idmaps
+
+  if lxc_idmap_is_sufficient; then
+    log "Current LXC UID/GID mappings already cover container IDs 0..$((LXC_IDMAP_RANGE_SIZE - 1))."
+    log "Host-side ID mapping instructions are not required."
+  else
+    warn "Current LXC UID/GID mappings do not cover container IDs 0..$((LXC_IDMAP_RANGE_SIZE - 1))."
+    warn "Host-side ID mapping configuration is required."
     print_lxc_idmap_host_instructions
+  fi
 else
   log "No LXC environment detected. VM/Baremetal: host ID mapping is not relevant."
 fi