Cant restore unprivileged container on another node

[TechHome]

I can't restore unprivileged container on another node. What can I do?

root@sunfish:~# pct restore 116 /mnt/pve/diskstation/dump/vzdump-lxc-116-2020_05_12-08_24_45.tar.gz -ignore-unpack-errors 1 -unprivileged --storage lvmthin
  Logical volume "vm-116-disk-0" created.
mke2fs 1.44.5 (15-Dec-2018)
Discarding device blocks: done                           
Creating filesystem with 6553600 4k blocks and 1638400 inodes
Filesystem UUID: 7f11ccd7-9587-4cd4-aee8-11f4faee9d0d
Superblock backups stored on blocks:
        32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
        4096000

Allocating group tables: done                           
Writing inode tables: done                           
Creating journal (32768 blocks): done
Multiple mount protection is enabled with update interval 5 seconds.
Writing superblocks and filesystem accounting information: done   

extracting archive '/mnt/pve/diskstation/dump/vzdump-lxc-116-2020_05_12-08_24_45.tar.gz'
tar: ./var/lib/docker/overlay2/00b7bc181e8dea0b1ffab317aab077f4aac50d9898a658fb5215cc29a25586eb/diff/etc/nginx/conf.d/dev.conf: Cannot mknod: Operation not permitted
tar: ./var/lib/docker/overlay2/00b7bc181e8dea0b1ffab317aab077f4aac50d9898a658fb5215cc29a25586eb/diff/etc/services.d/frontend: Cannot mknod: Operation not permitted
tar: ./var/lib/docker/overlay2/1be94c70e3a1401cc97c395d8d14ad976d27a4862f8dbb52bd776f490232c7b5/diff/etc/nginx: Cannot mknod: Operation not permitted
tar: ./var/lib/docker/overlay2/eb13c583bc2a43e4190ca3ba6d61b3c457f43d1bc6f45385d967fbdc18eb8dbe/diff/tmp/install-s6: Cannot mknod: Operation not permitted
tar: ./var/lib/docker/overlay2/9ebf46009159385fe4f8ce1cf626d96b9bfbe09c6ee2ad9a15245f9dfde8f227/diff/tmp/nginx: Cannot mknod: Operation not permitted
tar: ./var/lib/docker/overlay2/9ebf46009159385fe4f8ce1cf626d96b9bfbe09c6ee2ad9a15245f9dfde8f227/diff/tmp/install-nginx: Cannot mknod: Operation not permitted
tar: ./var/lib/docker/overlay2/9ebf46009159385fe4f8ce1cf626d96b9bfbe09c6ee2ad9a15245f9dfde8f227/diff/usr/bin/make: Cannot mknod: Operation not permitted
tar: ./var/lib/docker/overlay2/9ebf46009159385fe4f8ce1cf626d96b9bfbe09c6ee2ad9a15245f9dfde8f227/diff/usr/include: Cannot mknod: Operation not permitted
Total bytes read: 16122009600 (16GiB, 122MiB/s)
tar: Exiting with failure status due to previous errors
Detected container architecture: amd64

 

[dietmar]

This container contains device nodes (which needs mknod to create). This is only allowed inside privileged containers.

 

[TechHome]

This container contains device nodes (which needs mknod to create). This is only allowed inside privileged containers.

But how did that work in the other node? Is there a fix for that. Can I someway repair it.

 

[Stoiko Ivanov]

But how did that work in the other node? Is there a fix for that. Can I someway repair it.

simplest fix is to restore it as privileged container (just remove the checkbox 'Unprivileged' in the GUI before restoring)

 

[TechHome]

simplest fix is to restore it as privileged container (just remove the checkbox 'Unprivileged' in the GUI before restoring)

That won't work for me because I run docker containers in it.

 

[Stoiko Ivanov]

Are you sure that this container was unprivileged when you made the backup?!

 

[TechHome]

Are you sure that this container was unprivileged when you made the backup?!

Yes. I have that problem with multiple containers

 

[foche]

That won't work for me because I run docker containers in it.

Hello, sorry my english (translate.google).

It is correct, I have the same problem with my LXC containers running Docker inside it. The CT has to be unprivileged to be able to check the keyctl option and let me coordinate my Dockers.

The solution I found to recover the backup, was to delete the contents of the "/var/lib/docker/overlay2/" directory of the "Dump.tar.gz" and once inside the recovered CT run "docker system prune -a". This will remove all volumes, images and Dockers containers, so you will have to have well configured persistent data outside of your Docker app.

And once this is done, run your Docker app again.

I am still looking for a better solution.