[solved] Unable to "pct create" an unprivileged debian container

[proxmix]

Hi,

I'm using Proxmox PVE 8.1. Creating unprivileged containers using the WebGUI works fine, but I'm unable to create an unpriviledged container using the pct create command line tool and even worse I'm unable to find my mistake. Thus your help is very much appreciated.

#Creating an privileged container works fine:
pct create 1000 /var/lib/vz/template/cache/debian-12-standard_12.2-1_amd64.tar.zst --ostype debian --storage VMs --hostname test2 --cores 1 --memory 512

echo "^^^ this command worked fine"
echo "vvv this command fails"

#Trying to create an unprivileged container:
pct create 1001 /var/lib/vz/template/cache/debian-12-standard_12.2-1_amd64.tar.zst --ostype debian --storage VMs --hostname test2 --cores 1 --memory 512 --unprivileged 1

The last command produces this output:

extracting archive '/var/lib/vz/template/cache/debian-12-standard_12.2-1_amd64.tar.zst'
tar: /var/lib/lxc/1001/rootfs: Cannot open: Permission denied
tar: Error is not recoverable: exiting now
unable to create CT 1001 - command 'lxc-usernsexec -m u:0:100000:65536 -m g:0:100000:65536 -- tar xpf - --zstd --totals --one-file-system -p --sparse --numeric-owner --acls --xattrs '--xattrs-include=user.*' '--xattrs-include=security.capability' '--warning=no-file-ignored' '--warning=no-xattr-write' -C /var/lib/lxc/1001/rootfs --skip-old-files --anchored --exclude './dev/*'' failed: exit code 2

Thanks a lot for your support!

Best regards,
proxmix

 

[proxmix]

I'm still searching for the cause. The pct man page states, that unprivileged shouldn't be modified manually:

"--unprivileged <boolean> (default = 0)
Makes the container run as unprivileged user. (Should not be modified manually.)"

What does manually mean here? Via the command line? Or shouldn't the setting just not be changed in the lxc's conf directly?

 

[proxmix]

Oh ha. It [suddenly] works! ;-) Don't know exactly why - ok, I've reinstalled Proxmox from scratch, that obviously did the trick.

 

[panchuz]

Hi @proxmix ,

Good to know you managed.

Just for the record: I had the same problem a while ago and solved it enablenig ACLs for the drive that I was trying to use as storage for the root filesystem of the new container.

In my particular case, I had to delete "noacl" from the mount options of that drive in /etc/fstab.

Hope this helps somebody... I experimented Hell for almost a hole working day.

Regards