LXC: How to deal with /lib/modules

[simonszu]

I have created some LXC containers based on Debian 9 which needed access to /lib/modules. Since the hypervisor handles kernel stuff, i have mounted the hypervisor's /lib/modules to the container's /lib/modules as read-only. This worked quite well, until recently Debian has some updates about the linux-headers package, which tries to modify /lib/modules - which is mounted as read-only. So for now, each apt upgrade in each LXC container fails.

How should i handle this situation? I cannot set /lib/modules to rw, since it will break the host, i fear, and i also cannot uninstall linux-headers in the containers at all, since there are packages installed which have this package as a dependency, so they would be uninstalled by apt as well. Has anyone an idea?

 

[dcsapak]

I have created some LXC containers based on Debian 9 which needed access to /lib/modules.

what exactly does the container need from the hosts /lib/modules ?

 

[simonszu]

I had Docker installed in the LXC container. One could argue that it isn't a good idea, but i tried it - it's not a productive system. And sometimes Docker crashed due to some files in /lib/modules not available.