Issue with cPanel on lxc container

[powersupport]

Recently, I set up a container in Proxmox, which is unprivileged, and installed cPanel on it, but there are certain functions that are not working, for example, the account usage quota not showing. when we checked the same with cPanel support they mentioned we need to make the container to privileged.

1 ) Is there any issue if we run a privileged container on production?

2) If there are issues, how we can change unprivileged to privileged?

3) Is there any workaround in unprivileged container to work it with all featured without changing to privileged

Any help apreciated

Thank you.

 

[shanreich]

1 ) Is there any issue if we run a privileged container on production?

Privileged containers pose additional security risks and should only be ran in trusted environments. This means this depends on whether you only want to use cPanel for yourself and whether it is reachable from the outside. To quote from our wiki article [1]:

Privileged Containers​

Security in containers is achieved by using mandatory access control AppArmor restrictions, seccomp filters and Linux kernel namespaces. The LXC team considers this kind of container as unsafe, and they will not consider new container escape exploits to be security issues worthy of a CVE and quick fix. That’s why privileged containers should only be used in trusted environments.

2) If there are issues, how we can change unprivileged to privileged?

Backup + Restore is the recommended way of converting an unprivileged container to a privileged container and vice-versa.

3) Is there any workaround in unprivileged container to work it with all featured without changing to privileged

If cPanel support couldn't provide any workaround, then probably no. At least their documentation [2] also recommends running as privileged. If the security implications of this are okay, is for you to decide.

[1] https://pve.proxmox.com/wiki/Linux_Container#_security_considerations
[2] https://docs.cpanel.net/knowledge-base/general-systems-administration/linux-containers/