making mp's migratable (virtiofs on pve managed paths only)

[Johannes S]

One obvious attack @Johannes S slides point out is someone with root on their device creating an account with the same UID as another user. Then mount the share and su to the other user where you can peruse or alter their files.

Just to avoid wrong credits: They are not my slides but from the speaker Sergej Schmidt who did the talk For the rest I agree with you obviousvsly.
NFS is ok if you have no important data (aka my homelab where everything important is also stored on cloud storage) or for stuff like storage for ProxmoVE, where the whole cluster specific network (corosync, storage network for nfs etc) has it's own dedicated network infrastructure where users and their own devices don't have access.

 

[louiseanton]

once the dir mapping is available for containers (as "managed bind mounts"), enabling migration should be easy there. for live-migration of VMs, there are still some missing pieces AFAIK, once those become available and are proven to work, we will enable it as well of course. offline migration should already work, if you set up the dir mapping correctly.

Any progress for virtiofs live-migration of VMs ?

 

[ewsclass66]

This would also be a nice feature for us

 

[fabian]

I haven't seen any announcement, but I also haven't followed developments too closely.. maybe @fiona knows more?

 

[fiona]

There is upstream support for migration with virtiofs if the storage is shared, but there are issues at least with CIFS (and also with others if not using the find-paths migration method). See:
https://lore.proxmox.com/pve-devel/ded494f0-c008-468f-be12-12c62d530b63@proxmox.com/

 

[dmcgough]

Sorry to necro the thread, but I wanted to add my voice here in support of this feature. Right now I use cephfs, mounted via linux VMs, for highly available file storage. I can live migrate the system between any of my nodes, in prep for host patching or whatever I need to do. But it would reduce the network footprint (potential attack surface / lateral movement surface) if I were able to remove the vm-to-storage network path. It would also simply the configuration of the VMs - just add the virtiofs like any other mount and let the host OS handle all the translation.

For my needs I did some initial testing, and I was almost ready to make the migration... until I found the "no live migration" limitation. I don't need high performance for my use case, but I do want all the resiliency my little home lab can deliver. So I'll keep using cephfs IP-based mounts instead of virtiofs, but I'll look forward to the day that I see this new feature in the Proxmox patch notes.