Docker Container with CAP_NET_ADMIN error running inside LXC

[pixelwave]

Hi,

I have the following setup:

• Proxmox VE (8.0.3)
• Debian (12) as LXC container
  • Privileged
  • Nesting = 1
  • Running Docker / Portainer (2.18.4)

When I now try to deploy for example Jellyfin (jellyfin/jellyfin) I get the following error:



... I already tried to run the jellyfin container in privileged mode, host network but that did not work either.

In my Debian 12 VM it works without issues .. but I wanted to migrate that from VM to LXC ...

 

[pixelwave]

There is one discussion on github (https://github.com/portainer/portainer/issues/8478) that recommends to:

...add the following line to your /etc/pve/nodes/pve/lxc/xxx.conf  "lxc.cap.drop:"

This will clear the cap drops. Seems not the best solution for me but it works and Docker now gets what it needs.

I added this in my LXC and now it works. But is there a more permanent / update proof solution. Or is this "safe" to use ...

 

[Philipp Hufnagl]

Could you show the entire config please?

 

[pixelwave]

 

[pixelwave]

 

[LnxBil]

Or is this "safe" to use ...

Removing all restrictions safe? Just don't run Docker inside of LX(C) containers if you want your system to be safe. It has been said a thousand times before, KVM is the most secure option there is.

If you're fine with the possibility that each PVE upgrade will break your Docker-in-LXC and you don't care about security at all, you can use it in LXC.

 

[RolandK]

i you can't even run userspace nfs in a reasonable way in lxc - simply don't run docker there, too.

period.

 

[Philipp Hufnagl]

I am not 100% sure what I am looking at in your config but on "Advanced container settings" the capability "MAC_ADMIN" is not set. Have you tried setting it?

 

[pixelwave]

... tried setting NET_ADMIN, MAC_ADMIN as well as privileged. No success.

What worked in the end was adding "lxc.cap.drop:" at the end of the lxc config (/etc/pve/nodes/pve/lxc/xxx.conf).

But for now I am sticking with the VM approach due to concerns as raised above. But LXC would work as well now...