Unprivileged LXC fails to start when using lxc.sysctl.*

[0xFelix]

Hello!

I tried to setup Gitlab in an unprivileged LXC.

As already discussed in other threads Gitlab wants to set some sysctls to specific values.

To be exact:

kernel.shmall = 4194304
kernel.sem = 250 32000 32 262
net.core.somaxconn = 1024
kernel.shmmax = 17179869184

In older versions of PVE it was sufficient to set these values on the host and then they would get passed down into every LXC.

This commit in the LXC repository introduced the lxc.sysctl.* parameter: https://github.com/lxc/lxc/issues/989
And according to https://bugzilla.proxmox.com/show_bug.cgi?id=1785#c5 this should also work on PVE.

I added the following lines to my LXC config:

lxc.mount.auto: proc:rw
lxc.sysctl.kernel.shmall: 4194304
lxc.sysctl.kernel.sem: 250 32000 32 262
lxc.sysctl.kernel.shmmax: 17179869184

My problem is that the LXC fails to start when it is set to unprivileged.
The previous solution also worked with unprivileged LXCs. Is this a bug?

According to the linked GIthub issue this should also work with user namespaces / unprivileged LXCs.

 

[0xFelix]

No ideas?

 

[t.lamprecht]

No, that cannot work for unprivileged CTs for now.
Your linked Github issue also nowhere mentions unprivileged at all, AFAICT only privileged work.

So either:

• Use a privileged CT (you can select this on CT create, or backup+restore and choose priviledged on CT restore)
• Set the settings on the host (probably not too ideal as it affects all)
• use a Virtual Machine

 

[0xFelix]

You are right, I linked the wrong issue.

Unprivileged / user namespaces was discussed here: https://github.com/lxc/lxc/pull/2009#issuecomment-350181714

Setting the values on the host does not work anymore as these settings are no longer passed down into the CTs.

A privileged CT is what I currently resorted to, but I'd like to use an unprivileged CT again like in the past.

 

[Helmut101]

I had the same problem, trying to install Gitlab in an unprivileged LXC with Debian. I also tried Ubuntu, because this issue suggests that it is not affected, but with the same result.

However (and surprisingly), I was successfull running the official Gitlab Docker, inside Docker on LXC (unprivileged, Debian) in Proxmox. I am not sure whether the folks who maintain the official Docker image modified the parts where it tries to set sysctls settings.

I followed these steps to set up Docker in unprivileged LXC.