nested mounting points on a ZFS with two containers

[inbouto]

Hi.
I have an idea that I'm not sure is feasible.
I have a ZFS Pool called POOL1, as well as a container running SAMBA (a SMB server) and another container running twistd (a simple HTTP file server).
My goal is to be able to drop a file in a special "public" folder on the SMB (lets say /SAMBA/public/) and have it show up immediately on the HTTP server.

Currently I'm doing this by having both the Samba AND twistd servers run on the same container. All I do is run twistd on the /SAMBA/public/ folder while Samba runs on the /SAMBA/ folder.
However I would like to run those 2 services in 2 different containers, and for twistd to only have access to that public folder in read-only.

I looked up how to mount a ZFS directly onto a container. Now I want to know if it would be possible to have two containers with two mounting points in the ZFS, but one inside the other.
the first container running on the ZFS pool directory : /POOL1/SAMBA
and the second container running on this ZFS pool directory in read-only : /POOL1/subvol-<vmid>-disk-0/SAMBA/public

I have attempted this with no success (getting "permission denied" when trying to write on the container running /POOL1/SAMBA) , but I don't really understand what I'm doing so maybe something has eluded me. It seems to me like it shouldnt be possible though.


Another question is : can I make it so that the extra "subvol-<vmid>-disk-0" directory isnt automatically created ? Just to make things more user-friendly when navigating the SMB server.

If it turns out to not be possible, I am considering just creating a read-only user on Samba and running a SMB client on my twistd server (but I'd rather not put unnecessary strain on the Samba server itself)

 

[wolfgang]

Hi,

yes, it is possible and you can achieve this with bind mounts.
The assumption is that both containers are privileged or privileged. If not you get uid/gid mapping problems.
I would recommend you to use unprivileged to enhance security.

SMB Container:
pct set <vmid> --mp<x> /path/at/host,mp=/inside/conteiner

Web:
pct set <vmid> --mp<x> /path/at/host,mp=/inside/conteiner,ro=1

The path/at/host can be a normal dir or also an extra created zfs dataset.

 

[inbouto]

Thank you wolfgang, that worked like a charm (did not create a sub-volume and everything).
Only thing I had to fiddle with was some uid mapping to get the SMB container permission to write.
I referred to this thread : https://forum.proxmox.com/threads/writing-to-bind-mount-inside-of-an-unprivileged-container.38898/