Ran docker with namespace mapping in LXC encountered permission error

[jeffwji]

Hi, Everyone

I'm able to run docker container already, but recently, to avoid the security issue(http: docs.docker.com/engine/security/security/), I created a mapping user "dockremap" and add "--userns-remap=default" to the docker daemon, but now I'm experiencing permission issue, the error message is:

docker: Error response from daemon: oci runtime error: container_linux.go:265: starting container process caused "process_linux.go:368: container init caused \"rootfs_linux.go:57: mounting \\\"proc\\\" to rootfs \\\"/var/lib/docker/100000.100000/vfs/dir/5cb7aebc85e6289551756d185b9b9885ac847e29fa437dc49418b8f94506c74e\\\" at \\\"/proc\\\" caused \\\"operation not permitted\\\"\"".

I googled the internet and find someone said this might be caused by something has been mounted on top of "/proc" (http: github.com/moby/moby/issues/24752). Then I checked the "/proc" folder and did find lxcfs underrness:

# mount | grep proc
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
proc on /proc/sys/net type proc (rw,nosuid,nodev,noexec,relatime)
proc on /proc/sys type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/sysrq-trigger type proc (ro,nosuid,nodev,noexec,relatime)
lxcfs on /proc/cpuinfo type fuse.lxcfs (rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other)
lxcfs on /proc/diskstats type fuse.lxcfs (rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other)
lxcfs on /proc/meminfo type fuse.lxcfs (rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other)
lxcfs on /proc/stat type fuse.lxcfs (rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other)
lxcfs on /proc/swaps type fuse.lxcfs (rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other)
lxcfs on /proc/uptime type fuse.lxcfs (rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other)

It shouldn't be unmounted, right? then how I can fix this issue?

 

[LnxBil]

All problems with Docker on PVE or LXC can be solved by installing Docker in a "real" VM. Always better security for your host system than LXC.

 

[jeffwji]

This is not kind like what I'm expecting.

 

[wbumiller]

Within containers many privileged operations are restricted for security reasons. In this case the mounting is most likely restricted by AppArmor, if you need this in the container, you'll have to create another AppArmor profile for it and live with the fact that you're giving the container a bigger attack surface, iow. are making it easier to break out.
If it is also an unprivileged container you're also limited by the number of available user ids as you'll only have 65k uids available and it's trying to map a range starting at 100k.

You need to ask yourself whether you're running docker in a container for organisational purposes or for security. In the former case, if you trust the container, you may as well use a privileged container with AppArmor disabled. In the latter case you'll have to go with @LnxBil's suggestion and use an actual VM, I cannot recommend anything else in good conscience.

 

[jeffwji]

Within containers many privileged operations are restricted for security reasons. In this case the mounting is most likely restricted by AppArmor, if you need this in the container, you'll have to create another AppArmor profile for it and live with the fact that you're giving the container a bigger attack surface, iow. are making it easier to break out.
If it is also an unprivileged container you're also limited by the number of available user ids as you'll only have 65k uids available and it's trying to map a range starting at 100k.

You need to ask yourself whether you're running docker in a container for organisational purposes or for security. In the former case, if you trust the container, you may as well use a privileged container with AppArmor disabled. In the latter case you'll have to go with @LnxBil's suggestion and use an actual VM, I cannot recommend anything else in good conscience.

Hi wbumiller

I'm not worry about the security issue as this is a testing system, but I need keep all the setting, include the NS configuration same to the production environment. I already set "lxc.appamor.profile=unconfined" in the container configuration file, what do you mean I have to create another AppArmor profile? where I should setup it? in the host or the container?