Hi
I'm trying to setup my new environment, but have ran into some permission issues. I thought myself quite well-versed in the permissions' department by now, given all the issues I've had to solve before, but this one has left be dumbfounded.
On the host side I have several ZFS datasets that I would like to mount to a few **unprivileged** LXCs. Currently the approach is to set the group permissions on the mounts to a `container-data` group, with GID 101000. This group is mapped in `/etc/subgid` as 1000. The group is set to have full permissions (rwx) on the host. When I browse the files already present on the drive, I can see that the group indeed is set to have the right permissions, i.e.
The mount is added directly to `/etc/pve/lxc/<id>.conf` as:
At this point, I expected to be able to list the content of the mount `/storage/media' and add new files. However, I am only able to access the file system but not list the contents already present inside. Not the it throws me an error, the files/directories just won't show up.
If I create a file from the container as a user part of the `container-data` group (they are called the same on both host and guest), I get permission denied. But creating a file as root from the container works, but that file is only visible/present when viewing from the container. Browsing from the host won't show that new file.
Another bind (`rbind`) mount behaves similarly, but if I instead spin up a Docker container in the LXC, which in turn creates a file from within it will have written the files with the correct permissions on both ends. (While writing this, I realise that this could be because the files are created as root in the Docker container and then having their permissions changed after the fact...). Those files are persisting just fine to the host. But, from what I have setup, shouldn't only the user in the `container-data` group have write permissions? And what could I have done to make a bind mount appear to be working but no data is actually being stored properly. And where do my testfiles end up if not on the ZFS datasets?
So many questions! Any tips, hints, ideas or guesses are welcome! Thanks in advance!
I'm trying to setup my new environment, but have ran into some permission issues. I thought myself quite well-versed in the permissions' department by now, given all the issues I've had to solve before, but this one has left be dumbfounded.
On the host side I have several ZFS datasets that I would like to mount to a few **unprivileged** LXCs. Currently the approach is to set the group permissions on the mounts to a `container-data` group, with GID 101000. This group is mapped in `/etc/subgid` as 1000. The group is set to have full permissions (rwx) on the host. When I browse the files already present on the drive, I can see that the group indeed is set to have the right permissions, i.e.
Code:
root@proxmox:~# ls -lash /Tank2/Downloads/
17K drwxrws---+ 6 root container-data 6 Nov 3 2020 .
17K drwxrws---+ 6 root container-data 6 Aug 12 10:23 ..
41K drwxrwxr-x+ 113 _apt container-data 120 Apr 1 20:59 completed
33K drwxrwxr-x+ 2 _apt container-data 2 Apr 1 20:59 incompletelxc.mount.entry: /Tank2/Downloads storage/media none rbind,create=dir,optional 0 0At this point, I expected to be able to list the content of the mount `/storage/media' and add new files. However, I am only able to access the file system but not list the contents already present inside. Not the it throws me an error, the files/directories just won't show up.
If I create a file from the container as a user part of the `container-data` group (they are called the same on both host and guest), I get permission denied. But creating a file as root from the container works, but that file is only visible/present when viewing from the container. Browsing from the host won't show that new file.
Another bind (`rbind`) mount behaves similarly, but if I instead spin up a Docker container in the LXC, which in turn creates a file from within it will have written the files with the correct permissions on both ends. (While writing this, I realise that this could be because the files are created as root in the Docker container and then having their permissions changed after the fact...). Those files are persisting just fine to the host. But, from what I have setup, shouldn't only the user in the `container-data` group have write permissions? And what could I have done to make a bind mount appear to be working but no data is actually being stored properly. And where do my testfiles end up if not on the ZFS datasets?
So many questions! Any tips, hints, ideas or guesses are welcome! Thanks in advance!
Last edited:
. More details in the thread below, Thanks!