Trouble with LXC mount point permissions

xmready

New Member
Dec 15, 2021
5
1
3
I created an unprivileged container with the number 101. I mounted a single disk ZFS pool from the host by adding an mp0: line to the /etc/pve/lxc/101.conf file. I noticed the container does not have write permissions to this mount point. After reading the Unprivileged LXC containers wiki page, it seems I need to add UID mapping in the LXC config file. I created a user with UID 1000 on both the host and CT, added a mapping to the config file, updated the subuid & subgid files, and changed the owner of the mountpoint on the host to be UID 1000. I assumed that this would give write permission to UID 1000 in the CT. Now the CT won't even start up.

Contents of /etc/pve/lxc/101.conf
Code:
arch: amd64
cores: 6
features: nesting=1
hostname: PlexServer
memory: 4096
mp0: /storage/plex,mp=/mnt/plex
net0: name=eth0,bridge=vmbr0,firewall=1,gw=192.168.1.1,hwaddr=CA:FB:D2:FD:F0:C6,ip=192.168.1.80/24,type=veth
ostype: ubuntu
rootfs: local-lvm:vm-101-disk-0,size=20G
swap: 4096
unprivileged: 1
lxc.idmap = u 1000 1000 1
lxc.idmap = g 1000 1000 1

Contents of /etc/subuid
Code:
root:100000:65536
user1:165536:65536
root:1000:1

Contents of /etc/subgid
Code:
root:100000:65536
user1:165536:65536
root:1000:1

Command used to change host directory ownership
Code:
chown -R 1000:1000 /storage/plex

Output from ProxMox VE log
Code:
cgfsng_chown: 1353 No such file or directory - Error requesting cgroup chown in new user namespace
__lxc_start: 2068 Failed to spawn container "101"
TASK ERROR: startup for container '101' failed
 
Last edited:
  • Like
Reactions: seanshankus

dcsapak

Proxmox Staff Member
Staff member
Feb 1, 2016
7,600
907
163
33
Vienna

xmready

New Member
Dec 15, 2021
5
1
3
please do not bump your posts without any new information....
instead you could post e.g. debug logs from the failing start (described in this chapter of the docs: https://pve.proxmox.com/wiki/Linux_...ers_with_tt_span_class_monospaced_pct_span_tt )

also please show the permissions from the host and guest side (e.g. with ls -l )

anyway it seems you did not map the rest of the range to the >100000 range
Here are are the permissions for the CT
Code:
root@PlexServer:~# ls -lhn /mnt/
total 512
drwxr-xr-x 4 65534 65534 4 Dec 15 06:39 plex
Here are the permissions for the host
Code:
root@proxmox1:~# ls -lhn /storage/
total 512
drwxr-xr-x 4 1000 1000 4 Dec 14 22:39 plex
I thought the documentation said that the >100000 range of ids was already mapped starting with id 0 when you create a new unprivileged CT. If i'm misunderstanding, can you provide clarity on why I can't just map the id that I need to have permission? Or at least point me to the docs that provide such clarity?
 

valorad

New Member
Dec 3, 2021
1
0
1
27
I find that you need to configure all the ID mappings in /etc/pve/lxc/101.conf, like the way they do in the documentation, not just the 1000 idmap.

Here's my working setup.

Host: /etc/pve/lxc/112.conf
Code:
arch: amd64
cores: 1
features: nesting=1
hostname: alpine-3-15
memory: 512
mp0: /workspace/downloadCenter,mp=/workspace/downloadCenter
net0: name=eth0,bridge=vmbr1,firewall=1,gw=10.10.10.1,hwaddr=F2:B0:61:14:3E:4F,ip=10.10.10.10/24,type=veth
ostype: alpine
rootfs: local-btrfs:112/vm-112-disk-0.raw,size=8G
swap: 512
unprivileged: 1
lxc.idmap: u 0 100000 1000
lxc.idmap: g 0 100000 1000
lxc.idmap: u 1000 1000 1
lxc.idmap: g 1000 1000 1
lxc.idmap: u 1001 101001 64530
lxc.idmap: g 1001 101001 64530


Host: /etc/subuid
Code:
root:100000:65536
valorad:165536:65536
root:1000:1

Host: /etc/subgid
Code:
root:100000:65536
valorad:165536:65536
root:1000:1

Then in the container, I get:
Code:
alpine-3-15:/workspace/downloadCenter# ls -lhn
total 0     
-rw-r--r--    1 1000     1000           0 Jan  1 19:53 dlctr.exe
 

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get your own in 60 seconds.

Buy now!