[SOLVED] Restore unprivileged LXC failes

[Duckdave]

Hi,

i want to restore a lxc to a unprivileged container, but the task fails with

extracting archive '/media/usb//dump/vzdump-lxc-101-2019_09_03-13_05_33.tar.gz'
tar: ./var/spool/postfix/dev/urandom: Cannot mknod: Operation not permitted
tar: ./var/spool/postfix/dev/random: Cannot mknod: Operation not permitted
Total bytes read: 2000721920 (1.9GiB, 26MiB/s)
tar: Exiting with failure status due to previous errors
TASK ERROR: unable to restore CT 101 - command 'lxc-usernsexec -m u:0:100000:65536 -m g:0:100000:65536 -- tar xpf - -z --totals --one-file-system -p --sparse --numeric-owner --acls --xattrs '--xattrs-include=user.*' '--xattrs-include=security.capability' '--warning=no-file-ignored' '--warning=no-xattr-write' -C /var/lib/lxc/101/rootfs --skip-old-files --anchored --exclude './dev/*'' failed: exit code 2

Restore to a normal lxc is working fine.

Spoiler: PVE Version

proxmox-ve: 6.0-2 (running kernel: 5.0.21-1-pve)
pve-manager: 6.0-6 (running version: 6.0-6/c71f879f)
pve-kernel-5.0: 6.0-7
pve-kernel-helper: 6.0-7
pve-kernel-5.0.21-1-pve: 5.0.21-1
pve-kernel-5.0.15-1-pve: 5.0.15-1
ceph-fuse: 12.2.11+dfsg1-2.1
corosync: 3.0.2-pve2
criu: 3.11-3
glusterfs-client: 5.5-3
ksm-control-daemon: 1.3-1
libjs-extjs: 6.0.1-10
libknet1: 1.11-pve1
libpve-access-control: 6.0-2
libpve-apiclient-perl: 3.0-2
libpve-common-perl: 6.0-4
libpve-guest-common-perl: 3.0-1
libpve-http-server-perl: 3.0-2
libpve-storage-perl: 6.0-7
libqb0: 1.0.5-1
lvm2: 2.03.02-pve3
lxc-pve: 3.1.0-64
lxcfs: 3.0.3-pve60
novnc-pve: 1.0.0-60
proxmox-mini-journalreader: 1.1-1
proxmox-widget-toolkit: 2.0-7
pve-cluster: 6.0-5
pve-container: 3.0-5
pve-docs: 6.0-4
pve-edk2-firmware: 2.20190614-1
pve-firewall: 4.0-7
pve-firmware: 3.0-2
pve-ha-manager: 3.0-2
pve-i18n: 2.0-2
pve-qemu-kvm: 4.0.0-5
pve-xtermjs: 3.13.2-1
qemu-server: 6.0-7
smartmontools: 7.0-pve2
spiceterm: 3.1-1
vncterm: 1.6-1
zfsutils-linux: 0.8.1-pve2

 

[Stoiko Ivanov]

This looks like you created the backup of a privileged container - These cannot be simply (i.e. without quite some manual tweaking) restored as unprivileged ones.

When did you create the backup and when the original container - the default in the GUI for containers switched from privileged to unprivileged with 5.4 - maybe this is the cause of the problem?

I hope this helps!

 

[Duckdave]

Hi, thanks for reply!

I created the containers in unprivileged mode, reinstalled pve 6.0-6 and restored the container over the cli with pct but no unpriviliged flag (if it exists).
Today i figured out that all of my containers are in privileged mode and i tryed to restore a new backup to a unprivileged container.

Is it possible to restore a unprivileged container to a privileged container? maybe that was my fault?

Regards

 

[Stoiko Ivanov]

Hm - if the container config does not have an unprivileged flag in the backup then the container was not created unprivileged in the first place.

if your containers are privileged restore them to privileged (if you want to use unprivileged containers it might be best to create a new container (unprivileged) and then copy over configuration and data from the current one, and as a last step change the ip (after testing everything works)

I hope this helps!

 

[Duckdave]

So you mean i should reinstall my application at a new unprivileged container or can i create a new unprivileged container and copy the configuration file and disk and mount it in the new container?

Regards david

 

[Stoiko Ivanov]

I would use `rsync` or something else from within the container to copy the data/config etc.

 

[Duckdave]

currently i'm testing a restore with

pct restore 104 /media/usb/dump/vzdump-lxc-104-2019_09_03-15_28_26.tar.lzo -ignore-unpack-errors 1 -unprivileged -storage data

 

[Duckdave]

Looks good, no service problem etc...

 

[Stoiko Ivanov]

Nice -glad that worked out! Please mark the thread as 'SOLVED'
Thanks!