[SOLVED] How to run Proxmox Backup Server as unprivileged container?

[Florius]

Hi,

I want to run Proxmox backup as an unprivileged container, which backups to an external HDD.
I got the external HDD part working:

arch: amd64
cmode: tty
console: 1
cpulimit: 0
cpuunits: 1024
hostname: backup
memory: 2048
mp0: /backup,mp=/backup
net0: name=eth0,bridge=vmbr0,hwaddr=96:CC:76:03:C6:0C,ip=dhcp,type=veth
onboot: 1
ostype: debian
protection: 0
rootfs: local-lvm:vm-110-disk-0,size=10G
swap: 512
tty: 2
unprivileged: 1
lxc.idmap: u 0 100000 34
lxc.idmap: g 0 100000 34
lxc.idmap: u 34 34 1
lxc.idmap: g 34 34 1
lxc.idmap: u 35 100035 65501
lxc.idmap: g 35 100035 65501

I mount the external HDD as a mount point.
This works fine, and I can see all the backups as they are owned by backup:backup (uid and gid 34).

However the problem is that /etc/proxmox-backup is also owned by backup:backup.
This goes wrong somehow and are actually owned by nobody/nogroup:

# ls -la /etc/ | grep back
drwx------  2 nobody nogroup  4096 May 22 10:50 proxmox-backup

Is it even possible to do something like this?
Thank you.

 

[fabian]

did you add the ID map(s) after you installed proxmox-backup-server inside the container?

 

[Florius]

did you add the ID map(s) after you installed proxmox-backup-server inside the container?

Yes, it was a privileged container at first, I made a backup and then restored it as unprivileged.

 

[fabian]

so the folder (and possibly some other things) is likely owned by the default unprivileged user 100033. you can use pct mount to mount the containers' FS and correct the owners (all files/dirs owned by user or group 100033 need to be owned by user 33 in your case).

e.g., find /var/lib/lxc/CTID/rootfs -uid 100033 after pct mount CTID might be a good starting point

 

[Florius]

so the folder (and possibly some other things) is likely owned by the default unprivileged user 100033. you can use pct mount to mount the containers' FS and correct the owners (all files/dirs owned by user or group 100033 need to be owned by user 33 in your case).

e.g., find /var/lib/lxc/CTID/rootfs -uid 100033 after pct mount CTID might be a good starting point

Thanks, that fixed it!

For whoever is reading this in the future, I also had to do a find . -gid 100033 as some files were owned by 100000 but group 100033.