Can't restore or create LXC container on new PVE7 node

[gkovacs]

Upon upgrading (reinstalling one-by-one) our cluster to PVE 7.0, I ran into the following problem: restoring an LXC container shows an error.

recovering backed-up configuration from 'NFS:backup/vzdump-lxc-321-2021_11_12-04_38_58.tar.lzo'
restoring 'NFS:backup/vzdump-lxc-321-2021_11_12-04_38_58.tar.lzo' now..
extracting archive '/mnt/pve/NFS/dump/vzdump-lxc-321-2021_11_12-04_38_58.tar.lzo'
cmd/lxc_usernsexec.c: 417: main - Operation not permitted - Failed to unshare mount and user namespace
cmd/lxc_usernsexec.c: 462: main - Inappropriate ioctl for device - Failed to read from pipe file descriptor 3
TASK ERROR: unable to restore CT 321 - command 'lxc-usernsexec -m u:0:100000:65536 -m g:0:100000:65536 -- tar xpf - --lzop --totals --one-file-system -p --sparse --numeric-owner --acls --xattrs '--xattrs-include=user.*' '--xattrs-include=security.capability' '--warning=no-file-ignored' '--warning=no-xattr-write' -C /var/lib/lxc/321/rootfs --skip-old-files --anchored --exclude './dev/*'' failed: exit code 1

I tried restoring to different storages (all ZFS), but with the same error.

Creating a new container gives a similar error:

extracting archive '/mnt/pve/NFS/template/cache/proxmox-mailgateway-7.0-standard_7.0-1_amd64.tar.gz'
cmd/lxc_usernsexec.c: 417: main - Operation not permitted - Failed to unshare mount and user namespace
cmd/lxc_usernsexec.c: 462: main - Inappropriate ioctl for device - Failed to read from pipe file descriptor 3
TASK ERROR: unable to create CT 9876 - command 'lxc-usernsexec -m u:0:100000:65536 -m g:0:100000:65536 -- tar xpf - -z --totals --one-file-system -p --sparse --numeric-owner --acls --xattrs '--xattrs-include=user.*' '--xattrs-include=security.capability' '--warning=no-file-ignored' '--warning=no-xattr-write' -C /var/lib/lxc/9876/rootfs --skip-old-files --anchored --exclude './dev/*'' failed: exit code 1

Any idea what could be wrong?

 

[Moayad]

Could you please post the full output of pveversion -v and the container config from the backup storage by going to the {Backup Storage (NFS:backup)} - select the vzdump-lxc-321-2021_11_12-04_38_58.tar.lzo - then click on [Show Configuration]

 

[gkovacs]

Could you please post the full output of pveversion -v and the container config from the backup storage by going to the {Backup Storage} - select the lxc-backup.tar.zst - then click on [Show Configuration]

pveversion

# pveversion -v
proxmox-ve: 7.0-2 (running kernel: 5.11.22-7-pve)
pve-manager: 7.0-14+1 (running version: 7.0-14+1/08975a4c)
pve-kernel-helper: 7.1-4
pve-kernel-5.11: 7.0-10
pve-kernel-5.11.22-7-pve: 5.11.22-12
pve-kernel-5.11.22-4-pve: 5.11.22-9
ceph-fuse: 15.2.14-pve1
corosync: 3.1.5-pve2
criu: 3.15-1+pve-1
glusterfs-client: 9.2-1
ifupdown2: 3.1.0-1+pmx3
ksm-control-daemon: 1.4-1
libjs-extjs: 7.0.0-1
libknet1: 1.22-pve2
libproxmox-acme-perl: 1.4.0
libproxmox-backup-qemu0: 1.2.0-1
libpve-access-control: 7.0-6
libpve-apiclient-perl: 3.2-1
libpve-common-perl: 7.0-12
libpve-guest-common-perl: 4.0-2
libpve-http-server-perl: 4.0-3
libpve-storage-perl: 7.0-13
libspice-server1: 0.14.3-2.1
lvm2: 2.03.11-2.1
lxc-pve: 4.0.9-4
lxcfs: 4.0.8-pve2
novnc-pve: 1.2.0-3
proxmox-backup-client: 2.0.13-1
proxmox-backup-file-restore: 2.0.13-1
proxmox-mini-journalreader: 1.2-1
proxmox-widget-toolkit: 3.3-6
pve-cluster: 7.0-3
pve-container: 4.1-1
pve-docs: 7.0-5
pve-edk2-firmware: 3.20210831-1
pve-firewall: 4.2-5
pve-firmware: 3.3-3
pve-ha-manager: 3.3-1
pve-i18n: 2.5-1
pve-qemu-kvm: 6.1.0-1
pve-xtermjs: 4.12.0-1
qemu-server: 7.0-18
smartmontools: 7.2-1
spiceterm: 3.2-2
vncterm: 1.7-1
zfsutils-linux: 2.1.1-pve3

Not sure I see the point of posting the config of the container to be restored, as it gave the exact same error when trying to create a new container from template (proxmox mail gateway).

 

[Moayad]

Is the result is the same when you create an unprivileged container or a privileged one?