privileged lxc container for torrent

[0zw00d]

Hello together,
I created a lxc before I reinstalled my proxmox installation, which was working before without trouble.
if I try to download a torrent file everything was okay.

At first I explain how it should work:

I have a openmediavault installation with smb shares, say I try to expose the cifs share "transmission".
I mount this share with gifs-utils in my privileged lxc container with:
mount -t cifs -o username=whatever //server/share /mnt/transmission.

at first everything looks good, with the logged in account "root" it's possible to create files and folder (no error message like: Permission Denied).
But if I download a torrent (in my example the newest proxmox iso) I get this error: Permission denied (/mnt/transmission/down/proxmox-ve_8.0-2.iso) in transmission.

How can I get rid of this problem?

My config looks like this:

arch: amd64
cores: 2
features: mount=cifs,nesting=1
hostname: ptransmission
memory: 2048
mp1: /mnt/transmission,mp=/mnt/transmission
net0: name=eth0,bridge=vmbr0,gw=10.0.0.1,hwaddr=82:81:C9:F9:88:4D,ip=10.0.0.87/24,ip6=auto,type=veth
ostype: ubuntu
rootfs: smb04:106/vm-106-disk-0.raw,size=10G
swap: 512

the cifs share is mounted in pve directly.

I'm really confused why this doesn't work.

 

[0zw00d]

no one?

 

[ardeny]

Unprivileged LXC doesn't allow NFS, SMB/CIFS direct mounting.
You can either privilege the container or use some workarounds like https://forum.proxmox.com/threads/tutorial-unprivileged-lxcs-mount-cifs-shares.101795/

 

[Admiral Awesome]

From my notebook

To set up NFS in a container:
Before creating the container:
1- on the first "Create CT" screen check "Advanced" next to Back button, then:
2- make sure to UNCHECK "Unprivileged container" option in the first screen also. You can NOT change this later.
3- don't start the container.
After creating the container:
1- click on the container to see its details.
2- click on Options then Features.
3- from the Features list check "NFS" then OK.
Now you can start the container and install the NFS server/client packages.

On container:

apt update
apt install cifs-utils -y

Create mountpoint
mkdir -p /CONTAINER_MOUNT

Now you can do something like this:

nano /etc/fstab

And inside put:
//10.1.0.10/NFS_SHARED_FOLDER_NAME /CONTAINER_MOUNT cifs username=USERNAME,password=PASSWORD,uid=1000,gid=1000,rw,users,dir_mode=0777,file_mode=0777 0 0

Save, Exit.

mount -a

Please remember to verif uid/guid (but it should be ok from my example).

Hope this helps.

 

[ardeny]

Be aware that yes @Admiral Awesome solution will work, but if something or someone gain access or root in your container (maybe because of application vulnerability) they may be able to access your PVE host root.

I would suggest either using
-docker, maybe something like portainer
-VM, not container
-Truenas, unRAID...

 

[0zw00d]

@ardeny you're absolutely right.
Now I choose the VM solution, a Debian minimal installation isn't so big in size .

Thanks to all for the Support

 

[171hostile_pidgeons]

From my notebook

To set up NFS in a container:
Before creating the container:
1- on the first "Create CT" screen check "Advanced" next to Back button, then:
2- make sure to UNCHECK "Unprivileged container" option in the first screen also. You can NOT change this later.
3- don't start the container.
After creating the container:
1- click on the container to see its details.
2- click on Options then Features.
3- from the Features list check "NFS" then OK.
Now you can start the container and install the NFS server/client packages.

On container:

apt update
apt install cifs-utils -y

Create mountpoint
mkdir -p /CONTAINER_MOUNT

Now you can do something like this:

nano /etc/fstab

And inside put:
//10.1.0.10/NFS_SHARED_FOLDER_NAME /CONTAINER_MOUNT cifs username=USERNAME,password=PASSWORD,uid=1000,gid=1000,rw,users,dir_mode=0777,file_mode=0777 0 0

Save, Exit.

mount -a

Please remember to verif uid/guid (but it should be ok from my example).

Hope this helps.

Be aware that yes @Admiral Awesome solution will work, but if something or someone gain access or root in your container (maybe because of application vulnerability) they may be able to access your PVE host root.

I would suggest either using
-docker, maybe something like portainer
-VM, not container
-Truenas, unRAID...

Was looking online for a solution to share from my OMV VM to my qbittorrent VM and I'd like to thank you two gentlemen!
Following both your advice, I've changed from using a CT to a VM and succesfully mounted the share.

One small issue though, after qbittorrent VM restarts all my torrents are "error-ed". Seems that this is due to the fact that the qbittorrent VM does not successfully auto-mount the OMW share.
How can I do this correctly and as a permanent solution?