Token permissions and creating lxc container

D

Daxcor

Member
Oct 31, 2021
49
2
13
58
Hello,

I am trying to create a lxc via the 8.4 api. I created a apitoken on the root user with propagated permissions. Here is the content I am using to send to the api

{
vmid: 9011,
hostname: 'harry',
ostemplate: 'cephfs:vztmpl/debian13-custom-20251002-dev.tar.gz',
storage: 'vm_pool',
rootfs: 'volume=vm_pool,size=3G',
memory: 1536,
cores: 1,
cpulimit: 0.5,
net0: 'name=eth0,bridge=vmbr0,ip=dhcp,tag=20,type=veth,firewall=0',
password: 'balhblah',
swap: 1024,
start: 1,
unprivileged: 1,
cmode: 'shell',
console: true,
description: 'Game Server for harry',
tags: 'level-1, debian13, fvtt, dev',
mp0: 'vm_pool:vm-9011-disk-1,mp=/data,backup=1,size=6G'
}

The response error from the api

data: {
data: null,
message: 'Only root can pass arbitrary filesystem paths. at /usr/share/perl5/PVE/Storage.pm line 581.\n'
}


I don't understand the error. If I am using a token based on the root user. I am using a ceph rbd storage volume called "vm_pool"

Please any help would be appreciated.
Brad
 
So the issue, is the os template storage. The bind mount from cephfs is the action that is not permitted, not the rbd volumes. So I would have to make a copy of the template on each proxmox node in the local storage in order for this to work. Or, I use the root@pam via the ticket login process which would give me root access as the api token approach doesn't have the same permissions as the ticket. Thank you for the clarification.
 
Ok I am still having the same issue. I moved the template to the local storage.

{
"vmid": 9011,
"hostname": "harry",
"ostemplate": "local:vztmpl/debian13-custom-20251002-dev.tar.gz",
"rootfs": "volume=vm_pool,size=3G",
"memory": 1536,
"cores": 1,
"cpulimit": 0.5,
"net0": "name=eth0,bridge=vmbr0,ip=dhcp,tag=20,type=veth,firewall=0",
"password": "asdfasdfasdf",
"swap": 1024,
"start": 1,
"unprivileged": 1,
"cmode": "shell",
"console": true,
"description": "Game Server for harry",
"tags": "level-1, debian13, fvtt, dev"
}

I don't see any bind mounts, only local and rbd. I get the same error about root. I understand the error and why thanks to the provided thread. But I am stumped as I don't see any bind mounts in my configuration. The error provided doesn't show me the offending configuration. Not sure how to debug this.
 
You must log in or register to reply here.
Top Bottom