[libvirt-users] understanding --idmap for containers (v2.5.0)

Hello, I'm testing containers on a host machine without selinux so I'm trying use the idmap feature, but I must be missing something because all that I get is a readonly container for the root user. # virsh version --daemon Compiled against library: libvirt 2.5.0 Using library: libvirt 2.5.0 Using API: QEMU 2.5.0 Running hypervisor: QEMU 2.8.1 Running against daemon: 2.5.0 # virsh --connect lxc:/// dumpxml lab-gentoo-01 <domain type='lxc'>   <name>lab-gentoo-01</name>   <uuid>a9f73091-b716-4b61-95ad-fa1d0c061bef</uuid>   <memory unit='KiB'>524288</memory>   <currentMemory unit='KiB'>524288</currentMemory>   <vcpu placement='static'>2</vcpu>   <resource>     <partition>/machine</partition>   </resource>   <os>     <type arch='x86_64'>exe</type>     <init>/bin/sh</init>   </os>   <idmap>     <uid start='0' target='900' count='10'/>     <gid start='0' target='900' count='10'/>   </idmap>   <features>     <privnet/>   </features>   <cpu mode='host-model'>     <model fallback='allow'/>   </cpu>   <clock offset='utc'/>   <on_poweroff>destroy</on_poweroff>   <on_reboot>restart</on_reboot>   <on_crash>destroy</on_crash>   <devices>     <emulator>/usr/libexec/libvirt_lxc</emulator>     <filesystem type='mount' accessmode='passthrough'>       <source dir='/media/containers/lab-gentoo-01/'/>       <target dir='/'/>     </filesystem>     <interface type='bridge'>       <mac address='00:16:3e:c8:13:14'/>       <source bridge='bridge-01'/>     </interface>     <console type='pty'>       <target type='lxc' port='0'/>     </console>   </devices> </domain> # ls -l /media/containers/lab-gentoo-01/ total 36 drwxr-xr-x  2 root root 4096 Apr 13 07:33 bin drwxr-xr-x  2 root root   18 Apr 13 03:28 boot drwxr-xr-x  7 root root 4096 Apr 18 12:45 dev drwxr-xr-x 31 root root 4096 Apr 18 12:49 etc drwxr-xr-x  2 root root   18 Apr 13 03:28 home lrwxrwxrwx  1 root root    5 Apr 13 06:13 lib -> lib64 drwxr-xr-x  2 root root 4096 Apr 13 06:14 lib32 drwxr-xr-x  9 root root 4096 Apr 13 07:33 lib64 drwxr-xr-x  2 root root   18 Apr 13 03:28 media drwxr-xr-x  2 root root   18 Apr 13 03:28 mnt drwxr-xr-x  2 root root   18 Apr 13 03:28 opt drwxr-xr-x  2 root root    6 Apr 13 03:18 proc drwx------  2 root root   18 Apr 13 03:28 root drwxr-xr-x  2 root root   31 Apr 13 07:32 run drwxr-xr-x  2 root root 4096 Apr 13 07:36 sbin drwxr-xr-x  2 root root   18 Apr 13 03:28 sys drwxrwxrwt  2 root root   18 Apr 13 07:36 tmp drwxr-xr-x 13 root root 4096 Apr 18 12:49 usr drwxr-xr-x  9 root root  102 Apr 13 03:28 var # virsh --connect lxc:/// start --console lab-gentoo-01 Domain lab-gentoo-01 started Connected to domain lab-gentoo-01 Escape character is ^] sh-4.3# /usr/bin/id uid=0(root) gid=0(root) groups=0(root) sh-4.3# pwd / sh-4.3# touch asdf touch: cannot touch 'asdf': Permission denied sh-4.3# indeed the container is using the idmap feature because the efective uid/gid map (900/900) is not allowing writes in the filesystem, but it doesn't seems very usefull. is it possible to have read/write containers while using idmap?