Can I convert unprivileged to privileged container or otherwise allow use of security.* namespace?

[SInisterPisces]

i feel your pain

lxc containers imho is something which is more complicated from a management , feature and issue/caveats standpoint and there is not an easy entry into this.

for example/there is no easy/straightforward and secure way to have kernel based nfs server and the same applies to userspace based nfs (ganesha).

uid/gid handling of filesystem passthrough is complicated, too.

i would not recommend lxc for beginners.

(Emphasis added).

Agreed. However, in this case I'm running a node on a 10 watt, 4 core Intel Pentium Silver N6005. One simple VM eats 1/4 of my available CPU power, so I'm trying to avoid them.

Eventually, I'll have a second node up (a Ryzen 3700X), and be able to recreate my database server and a few other things as VMs, which I think will be easier to manage long term.

I'm still going to keep the 10 watt Proxtato around for things like my Unifi controller.

 

[BobhWasatch]

A VM does not "eat" anything unless it is actually doing something. It does not grab dedicated CPU resources. A vCPU is just a thread on the host scheduled the same as any other threads.