[Tutorial] Mounting NFS share to an unprivileged LXC

[ellisd]

I registered just to thank you for this tutorial

 

[linesquarecube]

Hi everyone. I'm quite new to Proxmox and maybe need some advice.
Mounting itself works fine with the tutorial, but no matter what I try, I get some permission errors when handing over the NFS shares to the LXC.
My mount options in OpenMediaVault contain anongid=101000,anonuid=101000, as I have a user inside the LXC with uid=1000(myuser) gid=1000(myuser).

Checking the mounted folder and its content with ls -ld gives me the information that the folder is owned by user nobody and user nogroup.

Maybe someone can give me a hint what I may have missed.

Thanks

 

[umunas]

Hi everyone. I'm quite new to Proxmox and maybe need some advice.
Mounting itself works fine with the tutorial, but no matter what I try, I get some permission errors when handing over the NFS shares to the LXC.
My mount options in OpenMediaVault contain anongid=101000,anonuid=101000, as I have a user inside the LXC with uid=1000(myuser) gid=1000(myuser).

Checking the mounted folder and its content with ls -ld gives me the information that the folder is owned by user nobody and user nogroup.

Maybe someone can give me a hint what I may have missed.

Thanks

My situation is somewhat similar, but not sure if related.

I am trying to map Synology NAS to unprivileged LXC to use with Jellyfin. Mapping on NODE works fine, I have all the permissions and full access:

root@pve:~# ls -l /mnt
total 32
drwxrwxrwx 7 1005 1005 4096 Aug 19 23:22 nfs_nas_data
drwxrwxrwx 7 1005 1005 4096 Aug 21 14:22 nfs_nas_downloads
drwxrwxrwx 7 1005 1005 4096 Aug 20 19:35 nfs_nas_media

Unfortunately, on LXC things goes wrong:

root@jellyfin:~# ls -l /mnt
total 24
d--------- 7 nobody nogroup 4096 Aug 19 20:22 data
d--------- 7 nobody nogroup 4096 Aug 21 11:22 downloads
d--------- 7 nobody nogroup 4096 Aug 20 16:35 media

I think all this Unprivileged_LXC_containers and this Understanding LXC UID Mappings mess is at fault and I cannot wrap my head around it for the second day. I am thinking about just dropping the unprivileged LXC idea and going to privileged. It is a home setup after all.

I am sure some very important step is missing in this tutorial, but I do not know what.

 

[linesquarecube]

After some trial and error, I realized that the ownership problem of the folder is less important for me. I'm running Syncthing in the LXC, and as it is able to write to the share and I have no rights problems on other machines, I stopped looking deeper into this problem. Maybe it works because the folders inside the mount that I sync to have the proper rights attached to them.

Sorry that I cannot provide any help

 

[Ľudovít Lučenič]

Very cool but only problem is you can't take snapshots of the lxcs because of the mounts unfortunately.

Hello, does anybody know the reason why this setup hinders snapshoting functionality?
I would love to have a) unprivileged CT with b) NFS share bind-mounted from the host and c) snapshot functionality for daily CT backups to PBS
So far it seems like keep dreaming...
Thanks in advance for any kind of hint or explanation.

 

[profblackjack]

Hello, does anybody know the reason why this setup hinders snapshoting functionality?
I would love to have a) unprivileged CT with b) NFS share bind-mounted from the host and c) snapshot functionality for daily CT backups to PBS
So far it seems like keep dreaming...
Thanks in advance for any kind of hint or explanation.

AFAIK the short of it is:

1. bind mounts don't make assumptions or expose many details about the underlying storage, they're treated as POSIX compatible file system mounts, nothing more
2. in order to snapshot in an LXC, proxmox has to be sure that the entire filesystem can be snapshotted (ie it's an LVM, btrfs, etc)
3. because of 1, there's no interfaces for the bind mount to let proxmox know "hey, i'm snapshot compatible, go ahead!", and it's not good to do a mystery "partial snapshot", since you could revert the snapshot but the bind mounts are still in whatever state they're in, and suddenly you have a state that isn't exactly when you made the snapshot.

So, stick with backup strategies that stop the container, back it up, then restore the system. Those don't require the underlying storage to support snapshots, and make no promises about the state of bind mounts.

 

[Nicowars]

I was getting a 'Permission Denied' error in the LXC containers.
The solution was to add 'all_squash' to the NFS share configuration on the NAS.

 

[quepasa]

I was getting a 'Permission Denied' error in the LXC containers.
The solution was to add 'all_squash' to the NFS share configuration on the NAS.

Thanks for this. Finally got my NFS share usable in my LXC.