[SOLVED] LXC - Application needs sys_time, sys_nice and net_raw capabilities

[kokoticek]

Hello everybody,

Running in a problem with an application inside LXC container, which demands following capabilities:

• CAP_SYS_TIME
• CAP_SYS_NICE
• CAP_NET_RAW

The application is "VDR - Video Disk Recorder" and you can see the code for checking the caps here:
https://github.com/bviefhues/vdr/blob/9ab55b409054d94216f4c0e77fafaf13c4d18531/vdr.c#L128

Error message of target application is: vdr: cap_set_proc failed: Operation not permitted

What I tried so far, setting in either /etc/pve/lxc/node_name.conf or /var/lib/lxc/node_name/config (with matching : or = syntax ofc):

• lxc.aa_profile = unconfined
• lxc.cap.keep = sys_nice sys_time net

lxc.cap.keep gives the following error when attempting to start the container: Simultaneously requested dropping and keeping caps

lxc.aa_profile allows to start the container, does not give the capabilities to the guest though.

If I can provide more info, please let me know.
Thanks in advance!

UPDATE: Running the service as root seems to be an acceptable workaround, problem solved