storage: fix UID/GID map handling for shifting layers

when the driver supports shifting, set the rechown target to identity
instead of the container's maps.

Closes: https://redhat.atlassian.net/browse/RHEL-160859
Assisted-by: Claude Opus 4.6
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Author: giuseppe

storage/layers.go

@@ -1674,9 +1674,13 @@ func (r *layerStore) create(id string, parentLayer *Layer, names []string, mount
 		}
 	}
 
+	targetMappings := idMappings
+	if moreOptions.IDMappingOptions.HostUIDMapping && moreOptions.IDMappingOptions.HostGIDMapping {
+		targetMappings = &idtools.IDMappings{}
+	}
 	if oldMappings != nil &&
-		(!reflect.DeepEqual(oldMappings.UIDs(), idMappings.UIDs()) || !reflect.DeepEqual(oldMappings.GIDs(), idMappings.GIDs())) {
-		if err = r.driver.UpdateLayerIDMap(id, oldMappings, idMappings, mountLabel); err != nil {
+		(!reflect.DeepEqual(oldMappings.UIDs(), targetMappings.UIDs()) || !reflect.DeepEqual(oldMappings.GIDs(), targetMappings.GIDs())) {
+		if err = r.driver.UpdateLayerIDMap(id, oldMappings, targetMappings, mountLabel); err != nil {
 			cleanupFailureContext = "in UpdateLayerIDMap"
 			return nil, -1, err
 		}

storage/store.go

@@ -2001,9 +2001,10 @@ func (s *store) CreateContainer(id string, names []string, image, layer, metadat
 		// But in transient store mode, all container layers are volatile.
 		Volatile: options.Volatile || s.transientStore,
 	}
+	useHostMapping := idMappingsOptions.HostUIDMapping || s.canUseShifting(uidMap, gidMap)
 	layerOptions.IDMappingOptions = LayerIDMappingOptions{
-		HostUIDMapping: idMappingsOptions.HostUIDMapping,
-		HostGIDMapping: idMappingsOptions.HostGIDMapping,
+		HostUIDMapping: useHostMapping,
+		HostGIDMapping: useHostMapping,
 		UIDMap:         copySlicePreferringNil(uidMap),
 		GIDMap:         copySlicePreferringNil(gidMap),
 	}