[SOLVED] Folder permissions using groups/roles

[Deft1]

Good morning everyone,

I need your help in order to finish my config and get it work because I'm going crazy.
I tried so much ways to achieve my goal but never achieved it ! But I keep going on trying...
So let me explain to you.

In my PVE (only one node/host), I have an nvme (ext4/lvm) and a sata hdd 2To.
I've created some unprivileged lxcs (shinobi/jellyfin/nextcloud...), and if I can I prefer staying with unprivileged. But only if it isn't too annoying to me to make things work.
For sharing the hdd to the lxcs the only thing that ever worked was when I created a truenas or omv vm, passthrough the hdd and create smb shares. But I prefer the less overhead of lxc as my host is a nuc, and I tried to make the same thing with an debian lxc with webmin and created the smb shares but get stucked with permissions and uid/gid mapping etc...

And as I'm going crazy with that setup since months, and after some months seeking tutorials or forums, I've found that maybe I can skip the FileServer lxc and just create a group&role in the proxmox host with some rights (datastore.XXX and Pool.XX roles) and apply the group/role in the permissions tab on the folder on the pve host (Hdd2To), and also on the lxcs that must have access to the subfolders (in their permissions tab in pve gui), and let my mount in the lxcs config files (mp0: /mnt/pve/Hdd,mp=/mnt/Hdd).
I thought that was a great idea !! Very easy to setup and to maintain. I follow the guide on the guy's blog who explains that solution. He says that it works with nfs/folders. So I wanted to make the thing work with my hdd which is declared as a folder in the datacenter/storage. But I have a permission denied when trying to create a file from the lxc's shell.

I have subfolders in it : camera, videos, music, nextcloud. And I would like to write in it (Nextcloud has to write in its subfolder for the datas, jellyfin has to read contents in the videos and music folders, shinobi to write in the camera folder), and perhabs mount only the subfolder in the lxc conf to minimize access if needed.
Can you tell me if this is possible with this method, and if it's a good solution (and the best) to achieve my goal ?

Thank you very much for your help

 

[Deft1]

I think that the only way to write in the folder by the lxc shell is when I changed the owner of the Hdd folder on the host.
So I don't understand the group and roles thing, I think it's not meant to be used for that purpose...
For information on the pve host the folder of the hdd has "drwxr-xr-x 7 0 0" and the subfolders I created "drwxr-xr-x 2 0 0"
and on the lxc the folder of the hdd has "drwxr-xr-x 7 65534 65534" and the subfolders I created "drwxr-xr-x 2 65534 65534"
I haven't yet changed Access rights, and I understand only root on pve host can write and the lxc has no write access as it has 65534, but the group/roles trick doesn't work.
I have the feeling that I MUST change the folder owner in order to write in it with a vm or container... And it can't be an other way ?

 

[Deft1]

As I didn't have any advice (I can understand that posts about permissions don't interest people), I eventually bind/mount the appropriate subfolder in the appropriate lxc, and change owner of the subfolders when the lxc need write access.
I also created a fileserver in a privileged lxc (all others lxc are unprivileged) to copy easily my medias/files thanks to smb shares (for Jellyfin for example). And I start that fileserver on demand.
I just wonder if that method is better than only use smb shares with write access in every lxc instead of bind/mounts ?
I'm just disappointed that I cannot use permissions group instead of changing owner of the subfolders, and not to know if it may work ?