Best way to share host ZFS dataset to internal unprivileged LXC containers and VMs

[escher]

Hi guys,
what is the recommended way to share ZFS dataset from Proxmox host to:
- unprivileged LXC containers and/or VMs
- all guests Linux
- CTs and VMs in VLANs on vmbr1 (LAN), with local IPs from 10.0.1.0/24, 10.0.2.0/24,...
- Proxmox 6.2

Is there a way to use ZFS native NFS share for that?
I tried:
- in Proxmox CLI:

    apt-get install nfs-kernel-server
    zfs create tank/share
    pvesm add dir tank-share2 --path /tank/share
    pvesm set tank-share --content rootdir,iso,snippets,vztmpl,images
    zfs set sharenfs=on tank/share

- in Proxmox webgui:
- Datacenter > Storage > Add NFS >

        id:     share
        server: 127.0.0.1
        export: /tank/share

- in Proxmox CLI:
pct set CTID --mp0 /tank/share,mp=/shared
- or in /etc/pve/lxc/[CTID].conf:
mp0: /tank/share,mp=/shared

In the LXC container I can see the mounted share in /shared but I am getting read-only access.
Also, is a access whitelist like zfs set sharenfs="rw=@10.0.1.0/24" tank/share expected to be working in this scenario?

Am I missing some (safe) ZFS share parameters?
In terms of simplicity and security (privileged CTs running services are no go).

Or is there some alternative, better way to set up the sharing?

Thanks!

 

[H4R0]

zfs nfs is also using nfs-server there is no difference wheter its zfs commands or /etc/export.

For vm's, set up the nfs share and mount it inside the vm. Do not add it to the gui thats if you want to add a nfs share to proxmox for vm disks like qcow or raw.

For containers add it as mountpoint, for unprivileged containers you have to map the user ids to be able to write https://pve.proxmox.com/wiki/Unprivileged_LXC_containers

 

[leesteken]

I also use mountpoints for the containers. For VMs, I use 9p, which works fine but a bit more involved to setup (args: options in vm.conf).
It can be a bit of a hassle to setup userids and permissions In both cases, but I think this is also true for NFS.