LXC wont start after adding mp0: for shared storage

eagle275 · Wednesday at 11:10

So, I added a line to my /etc/pve/lxc/101.conf to get access to a storage Zpool on the pve host.

Code:

mp0: /myZpool,mp=/datastore,backup=0,shared=1

After first reboot that WAS successful - but listed the storage with nogroup ownership.

I then followed the WIKI article https://pve.proxmox.com/wiki/Unprivileged_LXC_containers#Using_local_directory_bind_mount_points

Now my lxc wont start..

Error message

Code:

lxc-start: 101: ../src/lxc/idmap_utils.c: lxc_map_ids: 245 newuidmap failed to write mapping "newuidmap: uid range [0-1005) -> [100000-101005) not allowed": newuidmap 238354 0 100000 1005 1005 1005 1 1006 101006 64530
lxc-start: 101: ../src/lxc/start.c: lxc_spawn: 1985 Failed to set up id mapping.
lxc-start: 101: ../src/lxc/start.c: __lxc_start: 2288 Failed to spawn container "101"
lxc-start: 101: ../src/lxc/tools/lxc_start.c: lxc_start_main: 307 The container failed to start

when I repeat start the number behind newuidmap changes ... so I assume its dynamically generated on LXC startup ..

What can I do to salvage the situation?

dcsapak · Wednesday at 11:42

can you post your container config as well as the output when starting with debug on:

Code:

pct start <id> --debug

eagle275 · Wednesday at 12:06

pct ... --debug gives

Code:

# pct start 101 --debug
lxc_map_ids: 245 newuidmap failed to write mapping "newuidmap: uid range [0-65536) -> [100000-165536) not allowed": newuidmap 258968 0 100000 65536
lxc_spawn: 1985 Failed to set up id mapping.
__lxc_start: 2288 Failed to spawn container "101"
c/lxc/lsm/lsm.c:lsm_init_static:38 - Initialized LSM security driver AppArmor
INFO     utils - ../src/lxc/utils.c:run_script_argv:585 - Executing script "/usr/share/lxc/hooks/lxc-pve-prestart-hook" for container "101", config section "lxc"
INFO     cgfsng - ../src/lxc/cgroups/cgfsng.c:unpriv_systemd_create_scope:1268 - Running privileged, not using a systemd unit
DEBUG    seccomp - ../src/lxc/seccomp.c:parse_config_v2:664 - Host native arch is [3221225534]
INFO     seccomp - ../src/lxc/seccomp.c:parse_config_v2:815 - Processing "reject_force_umount  # comment this to allow umount -f;  not recommended"
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:532 - Set seccomp rule to reject force umounts
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:532 - Set seccomp rule to reject force umounts
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:532 - Set seccomp rule to reject force umounts
INFO     seccomp - ../src/lxc/seccomp.c:parse_config_v2:815 - Processing "[all]"
INFO     seccomp - ../src/lxc/seccomp.c:parse_config_v2:815 - Processing "kexec_load errno 1"
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding native rule for syscall[246:kexec_load] action[327681:errno] arch[0]
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding compat rule for syscall[246:kexec_load] action[327681:errno] arch[1073741827]
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding compat rule for syscall[246:kexec_load] action[327681:errno] arch[1073741886]
INFO     seccomp - ../src/lxc/seccomp.c:parse_config_v2:815 - Processing "open_by_handle_at errno 1"
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding native rule for syscall[304:open_by_handle_at] action[327681:errno] arch[0]
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding compat rule for syscall[304:open_by_handle_at] action[327681:errno] arch[1073741827]
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding compat rule for syscall[304:open_by_handle_at] action[327681:errno] arch[1073741886]
INFO     seccomp - ../src/lxc/seccomp.c:parse_config_v2:815 - Processing "init_module errno 1"
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding native rule for syscall[175:init_module] action[327681:errno] arch[0]
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding compat rule for syscall[175:init_module] action[327681:errno] arch[1073741827]
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding compat rule for syscall[175:init_module] action[327681:errno] arch[1073741886]
INFO     seccomp - ../src/lxc/seccomp.c:parse_config_v2:815 - Processing "finit_module errno 1"
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding native rule for syscall[313:finit_module] action[327681:errno] arch[0]
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding compat rule for syscall[313:finit_module] action[327681:errno] arch[1073741827]
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding compat rule for syscall[313:finit_module] action[327681:errno] arch[1073741886]
INFO     seccomp - ../src/lxc/seccomp.c:parse_config_v2:815 - Processing "delete_module errno 1"
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding native rule for syscall[176:delete_module] action[327681:errno] arch[0]
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding compat rule for syscall[176:delete_module] action[327681:errno] arch[1073741827]
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding compat rule for syscall[176:delete_module] action[327681:errno] arch[1073741886]
INFO     seccomp - ../src/lxc/seccomp.c:parse_config_v2:815 - Processing "ioctl errno 1 [1,0x9400,SCMP_CMP_MASKED_EQ,0xff00]"
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:555 - arg_cmp[0]: SCMP_CMP(1, 7, 65280, 37888)
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding native rule for syscall[16:ioctl] action[327681:errno] arch[0]
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:555 - arg_cmp[0]: SCMP_CMP(1, 7, 65280, 37888)
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding compat rule for syscall[16:ioctl] action[327681:errno] arch[1073741827]
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:555 - arg_cmp[0]: SCMP_CMP(1, 7, 65280, 37888)
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding compat rule for syscall[16:ioctl] action[327681:errno] arch[1073741886]
INFO     seccomp - ../src/lxc/seccomp.c:parse_config_v2:815 - Processing "socket errno 97 [0,38,SCMP_CMP_EQ]"
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:555 - arg_cmp[0]: SCMP_CMP(0, 4, 0, 38)
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding native rule for syscall[41:socket] action[327777:errno] arch[0]
DEBUG    seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:549 - The syscall[41:socket] is not supported on compat arch[1073741827]
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:555 - arg_cmp[0]: SCMP_CMP(0, 4, 0, 38)
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding compat rule for syscall[41:socket] action[327777:errno] arch[1073741886]
INFO     seccomp - ../src/lxc/seccomp.c:parse_config_v2:1036 - Merging compat seccomp contexts into main context
INFO     start - ../src/lxc/start.c:lxc_init:1074 - Container "101" is initialized
INFO     cgfsng - ../src/lxc/cgroups/cgfsng.c:cgfsng_monitor_create:1442 - The monitor process uses "lxc.monitor/101" as cgroup
DEBUG    storage - ../src/lxc/storage/storage.c:storage_query:231 - Detected rootfs type "dir"
DEBUG    storage - ../src/lxc/storage/storage.c:storage_query:231 - Detected rootfs type "dir"
INFO     cgfsng - ../src/lxc/cgroups/cgfsng.c:cgfsng_payload_create:1550 - The container process uses "lxc/101/ns" as inner and "lxc/101" as limit cgroup
INFO     start - ../src/lxc/start.c:lxc_spawn:1959 - Cloned CLONE_NEWUSER
INFO     start - ../src/lxc/start.c:lxc_spawn:1959 - Cloned CLONE_NEWNS
INFO     start - ../src/lxc/start.c:lxc_spawn:1959 - Cloned CLONE_NEWPID
INFO     start - ../src/lxc/start.c:lxc_spawn:1959 - Cloned CLONE_NEWUTS
INFO     start - ../src/lxc/start.c:lxc_spawn:1959 - Cloned CLONE_NEWIPC
INFO     start - ../src/lxc/start.c:lxc_spawn:1959 - Cloned CLONE_NEWCGROUP
DEBUG    start - ../src/lxc/start.c:lxc_try_preserve_namespace:172 - Preserved user namespace via fd 17 and stashed path as user:/proc/258943/fd/17
DEBUG    start - ../src/lxc/start.c:lxc_try_preserve_namespace:172 - Preserved mnt namespace via fd 18 and stashed path as mnt:/proc/258943/fd/18
DEBUG    start - ../src/lxc/start.c:lxc_try_preserve_namespace:172 - Preserved pid namespace via fd 19 and stashed path as pid:/proc/258943/fd/19
DEBUG    start - ../src/lxc/start.c:lxc_try_preserve_namespace:172 - Preserved uts namespace via fd 20 and stashed path as uts:/proc/258943/fd/20
DEBUG    start - ../src/lxc/start.c:lxc_try_preserve_namespace:172 - Preserved ipc namespace via fd 21 and stashed path as ipc:/proc/258943/fd/21
DEBUG    start - ../src/lxc/start.c:lxc_try_preserve_namespace:172 - Preserved cgroup namespace via fd 22 and stashed path as cgroup:/proc/258943/fd/22
DEBUG    idmap_utils - ../src/lxc/idmap_utils.c:idmaptool_on_path_and_privileged:93 - The binary "/usr/bin/newuidmap" does have the setuid bit set
DEBUG    idmap_utils - ../src/lxc/idmap_utils.c:idmaptool_on_path_and_privileged:93 - The binary "/usr/bin/newgidmap" does have the setuid bit set
DEBUG    idmap_utils - ../src/lxc/idmap_utils.c:lxc_map_ids:178 - Functional newuidmap and newgidmap binary found
ERROR    idmap_utils - ../src/lxc/idmap_utils.c:lxc_map_ids:245 - newuidmap failed to write mapping "newuidmap: uid range [0-65536) -> [100000-165536) not allowed": newuidmap 258968 0 100000 65536
ERROR    start - ../src/lxc/start.c:lxc_spawn:1985 - Failed to set up id mapping.
DEBUG    network - ../src/lxc/network.c:lxc_delete_network:4493 - Deleted network devices
ERROR    start - ../src/lxc/start.c:__lxc_start:2288 - Failed to spawn container "101"
WARN     start - ../src/lxc/start.c:lxc_abort:1229 - No such process - Failed to send SIGKILL via pidfd 16 for process 258968
startup for container '101' failed

101.conf

Code:

arch: amd64
cores: 4
features: nesting=1,keyctl=1,fuse=1
hostname: cosmos
memory: 8192
mp0: /myZpool,mp=/datastore,backup=0,shared=1
net0: name=eth0,bridge=vmbr0,gw=192.168.178.1,hwaddr=BC:24:11:E6:FC:66,ip=192.168.178.202/24,ip6=dhcp,type=veth
onboot: 1
ostype: debian
rootfs: local-lvm:vm-101-disk-0,size=32G
swap: 512
tags: cloud;community-script;docker
timezone: Europe/Berlin
unprivileged: 1

I removed the uid mapping stuff from the wiki page I linked in original post

Do you need something else?

Impact · Wednesday at 13:00

If you share debug output it should match the config you post or it's useless.
For help with the ID mapping the output of this would be useful too

Bash:

tail -n+1 /etc/sub*id

Note that modern PVE versions have ID mapping functionality in the GUI

eagle275 · Wednesday at 14:15

Solved - I deleted the cosmos lxc as I had it setup just before that problem occured and recreated it, this time I issued
# pct set 101 -mp0 /myZpool,mp=/datastore,shared=1,backup=0,idmap=passthrough

and now the storage is owned by root inside the lxc ^^

LXC wont start after adding mp0: for shared storage

eagle275

New Member

dcsapak

Proxmox Staff Member

eagle275

New Member

Impact

Distinguished Member

eagle275

New Member

We value your privacy