[SOLVED] NFS server in LXC

Mar 14, 2021
88
27
23
44
I have been researching and attempting this for a while now. Maybe it's impossible but I haven't given up completely.

What I want to accomplish is to create an LXC that does two things...NFS and TFTP server. I have a ZFS pool and a directory that successfully gets mounted inside my container and has rwx permissions.

I have only been testing on debian11 ct template but I can go back to 10 or 9 (really would like to stay current) if it is needed.

I want to do this with an unprivileged container and an apparmor profile (found a "default with nfsd" profile but it was back in proxmox5).

The closest I have gotten so far is the container has access to my ZFS pool directory and can r/w files to it. I cannot get the nfs-kernel-server to start. It keeps failing with "A dependency job for nfs-server.service failed" error.

Any ideas welcome. I feel I am close but not sure where to go next. Thanks.
 
  • Like
Reactions: duganth
I got it to work.

It requires a privileged container with an apparmor profile.

Also, the nfs container I got working is my tftp server for my raspberry pi network boots and smb shares. Really the only thing I use nfs for is the root filesystems for the network boot devices.

Compared to my old setup (omv on odroid hc2) the container is lot easier and faster for me to configure (from command line).
 
Last edited:
@moxmox I have to dig up my notes. It's been working and not giving me issues so I haven't revisited it in some time other than to update whatever needs it.

I will say off the top of my head that I had to create the apparmor profile needed for a privileged container to be able to use nfs services. I was able to get the information from the depths of this forum and other web searches.
 
@generalproxuser

yes I have tried some app amour settings but not managed to find the right combination. Yes if you can find it would be much appreciated, thanks!
 
This will be a bit long and is mainly how to get the container started. User and group permissions will depend on your environment which I cannot anticipate for. This might not even be entirely correct or secure so use at your own risk. This is how I got it to work for me.

Creating the apparmor profile from the proxmox host terminal (ssh or console shell):
Code:
sudo touch /etc/apparmor.d/lxc/lxc-default-with-nfsd

sudo nano /etc/apparmor.d/lxc/lxc-default-with-nfsd

Add the following contents and save the file:
Code:
# Do not load this file.  Rather, load /etc/apparmor.d/lxc-containers, which
# will source all profiles under /etc/apparmor.d/lxc

profile lxc-container-default-with-nfsd flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/lxc/container-base>

  # the container may never be allowed to mount devpts.  If it does, it
  # will remount the host's devpts.  We could allow it to do it with
  # the newinstance option (but, right now, we don't).
  deny mount fstype=devpts,
  mount fstype=nfsd,
  mount fstype=rpc_pipefs,
  mount fstype=cgroup -> /sys/fs/cgroup/**,
}

Next file to edit:
Code:
sudo nano /etc/apparmor.d/lxc/lxc-default
add to the end of the file and save:
Code:
mount fstype=nfs*,

Next file to edit:
Code:
sudo nano /etc/apparmor.d/lxc/lxc-default-with-mounting
add to the end of the file and save:
Code:
mount fstype=nfs*,

Next copy one file to another:
Code:
sudo cp -i /etc/apparmor.d/lxc/lxc-default-cgns /etc/apparmor.d/lxc/lxc-default-with-nfs

Edit the file:
Code:
sudo nano /etc/apparmor.d/lxc/lxc-default-with-nfs
Change the name in file from "default-cgns" to "default-with-nfs"
and add to end of file and save:
Code:
mount fstype=nfs*,
mount fstype=rpc_pipefs,

I forgot what this does but apparently it's needed:
Code:
sudo apparmor_parser -r /etc/apparmor.d/lxc-containers
Create a debian container as privileged > don't start after creation

Edit the container files:
Code:
sudo nano /etc/pve/nodes/nodeName/lxc/vmid.conf
- nodeName = name of your proxmox node
- vmid.conf = number of your ct container

add to end of file and save:
Code:
lxc.apparmor.profile = lxc-container-default-with-nfsd

Another file to edit:
Code:
sudo nano /var/lib/lxc/vmid/config
add to end of file and save:
Code:
lxc.apparmor.profile = lxc-container-default-with-nfsd

Another file to edit:
Code:
sudo nano /etc/pve/nodes/nodeName/lxc/vmid.conf
add your nfs directory mount point to the ct and save the file:
Code:
mp0: /directory/path/in/host,mp=/directory/mount/in/ct

start container and connect to shell and update the ct
Code:
apt update
apt upgrade -y
apt install nfs-kernel-server -y
--------------------------------------------------------------------
From there you can setup your nfs exports and user/group permissions per your environment.
 
thanks very much for writing this all out - much appreciated. will try it out tomorrow.
 
I forgot to add:

Inside the file:
Code:
/etc/pve/nodes/nodeName/lxc/vmid.conf

You also want to make sure you have the line:
Code:
features: nesting=1

So you would be adding three items total to that file.
 
  • Like
Reactions: endurance
How would a container run a kernel module (aka nfs-kernel-server)?

You may have better luck running a user space NFS server like Ganesha-NFS in the container.
I like this idea but am having a difficult time getting it working. I keep getting "clnt_create: RPC: Program not registered" . Do you have any tips on how to get this working on an ubuntu container?
 
Thanks from me too, had found a blog beginning after the container creation, I missed the nesting option
 

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!