Passing /dev/net/tun into multiple containers

[ymyinfinity]

Hello community,

I am trying to pass /dev/net/tun into multiple LXC containers.
I have tried it via editing the conf files through the cgroup method as well as directly adding device using the webGUI (which results in a dev0: /dev/net/tun entry in the conf file).

I am able to get the first container to boot and show the tun interface.

However when passing by cgroup method, subsequent containers fail to boot.
When adding device via the gui (dev0:... conf entry), the containers boot but do not show a tun interface.

Is what I am trying to do possible?
The goal is to have a container that is able to access vpn for p2p, and another container that is capable of serving as a tailscale exit node, and a third container for misc uses in the future.

thank you all in advance! -Ming

 

[markfree]

For this, I simply added the following lines to the LXC container configuration file.

Locate the configuration file for the specific LXC, which is typically found in the /etc/pve/lxc/, and append the two lines below to it.

lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file

By the way, I've successfully tested this with OCI images.

Reference

 

[Impact]

The GUI way, which uses dev[n]: under the hood, works perfectly fine.