Problem with lxc cpanel and /proc

[picateclas]

Hello,

I open this thread, to see if someone can give me a hand, we are installing cPanel (centos 7) on LXC .

The problem we have is that cpanel gives several errors like this:

Your configuration changes have been saved! Waiting for âeximâ to restart â¦â¦Cpanel::Exception::SystemCall/(XID 24ters) The system failed to execute the system call âsetrlimitâ (8 ����������������) because of an error: Operation not permitted at /usr/local/cpanel/Cpanel/Syscall.pm line 116. Cpanel::Syscall::syscall("setrlimit", 8,

We've contacted cpanel and they say the problem is:

This LXC container has an invalid uid and gid on /proc. It should be root user and group owned.
This issue will need to be corrected and is a systems level issue that can't be resolved by cPanel. Please have the server administrators review the node/host configuration. Also, ensure the pcap settings provided on https://docs.cpanel.net/knowledge-base/general-systems-administration/linux-containers/ have been performed on the host node as well.

Honestly we don't know how to solve it, we have investigated, but I can't find anything, I have enough knowledge of qemu, openvz, but I am quite new to LXC.

~# pveversion -v
proxmox-ve: 6.2-1 (running kernel: 5.4.41-1-pve)
pve-manager: 6.2-6 (running version: 6.2-6/ee1d7754)
pve-kernel-5.4: 6.2-2
pve-kernel-helper: 6.2-2
pve-kernel-5.4.41-1-pve: 5.4.41-1
pve-kernel-5.4.34-1-pve: 5.4.34-2
ceph-fuse: 12.2.11+dfsg1-2.1+b1
corosync: 3.0.3-pve1
criu: 3.11-3
glusterfs-client: 5.5-3
ifupdown: 0.8.35+pve1
ksm-control-daemon: 1.3-1
libjs-extjs: 6.0.1-10
libknet1: 1.15-pve1
libproxmox-acme-perl: 1.0.4
libpve-access-control: 6.1-1
libpve-apiclient-perl: 3.0-3
libpve-common-perl: 6.1-3
libpve-guest-common-perl: 3.0-10
libpve-http-server-perl: 3.0-5
libpve-storage-perl: 6.1-8
libqb0: 1.0.5-1
libspice-server1: 0.14.2-4~pve6+1
lvm2: 2.03.02-pve4
lxc-pve: 4.0.2-1
lxcfs: 4.0.3-pve2
novnc-pve: 1.1.0-1
proxmox-mini-journalreader: 1.1-1
proxmox-widget-toolkit: 2.2-7
pve-cluster: 6.1-8
pve-container: 3.1-8
pve-docs: 6.2-4
pve-edk2-firmware: 2.20200229-1
pve-firewall: 4.1-2
pve-firmware: 3.1-1
pve-ha-manager: 3.0-9
pve-i18n: 2.1-3
pve-qemu-kvm: 5.0.0-4
pve-xtermjs: 4.3.0-1
qemu-server: 6.2-3
smartmontools: 7.1-pve2
spiceterm: 3.1-1
vncterm: 1.6-1
zfsutils-linux: 0.8.4-pve1

Thank you

 

[Stefan_R]

If the container wants to set rlimits it needs to be root on the host. This is usually forbidden, as it breaks the isolation guarantees of LXC, but you can enable it by making the container "privileged". This can only be done at creation time at the moment (remove the checkbox on "Unprivileged container").