Mounting SMB share to unpriviledged container.

[RValentin]

Hi,
I am in a bit of a dilema. I am running PVE on top of which I am running a VM with TrueNAS among other things. I would like to also run Frigate on Docker in an unpriviledged container running debian 12. The tricky bit is this: I would like for Frigate to record on the NAS using a SMB share, only accessible to the specific SMB user created for Frigate.
Being an unpriviledged container, I firstly mount the SMB to PVE, then bind-mount it to the container. But this way, even though the SMB is mounted using the correct credentials on the PVE host, in the container the permisions change and the share is readonly.
How could I map the share so that the only thing that has access to that SMB share is the user in the container?

 

[Johannes S]

You shouldn't run docker inside a lxc like written in the ProxmoxVE and frigate doc:

If you want to run application containers, for example, Docker images, it is recommended that you run them inside a Proxmox QEMU VM. This will give you all the advantages of application containerization, while also providing the benefits that VMs offer, such as strong isolation from the host and the ability to live-migrate, which otherwise isn’t possible with containers. https://pve.proxmox.com/wiki/Linux_Container

In this forum people reported several times that an update broke their docker instances inside a lxc.

For this reason frigate doesn't support that:

If you choose to run Frigate via LXC in Proxmox the setup can be complex so be prepared to read the Proxmox and LXC documentation, Frigate does not officially support running inside of an LXC....

They also mention a github discussion for further information:

See the Proxmox LXC discussion for more general information.

The quotes are from
https://docs.frigate.video/frigate/installation/#proxmox

I would suggest to use a vm instead, maybe together with Hone Assistant and Frigates HomeAssistant-Addon.

The frigate manual also recommends using a bare metal debian server instead of virtualization, a used Mini PC with HoneAssistant OS should do imho.