Unpriviliged LXC file server to share ZFS Pool via CIFS??

[TheBokke]

Hello Team,

I'm relatively new to Proxmox. I'm in the process of rebuilding my proxmox host, this has ZFS storage pool which I need to share to VMs/Containers (linux) and other physical windows machines on the network,

On the previous build I had samba running on the host which worked fine but I read this isn't best practice to modify the hypervisor. To help with portability/redundancy I'd like to have these served from guest instances via CT/VM.

My preference is to use LXC and to ensure security it looked like unprivileged LXC was the way to go, using turnkey file server template and then using bind mounts to the zpool and then configuring uid and gid mappings accordingly.

However I've just read that it is not possible to have the samba server running properly on an unprivileged container?? Is this correct? My preference is to use a container but if needs be I will have to create a VM as I dont want to do priviliged in this instance.

If I need to go down the VM route, does the ZFS share=nfs allow sharing the pool without the need to modify the host?

Thanks
Damon

 

[aaron]

this has ZFS storage pool which I need to share to VMs/Containers (linux) and other physical windows machines on the network,

On the previous build I had samba running on the host which worked fine but I read this isn't best practice to modify the hypervisor. To help with portability/redundancy I'd like to have these served from guest instances via CT/VM.

If the data is stored on the local ZFS pool, you are not really able to have redundancy or portability as you are locked to that node. In that case, why not share it directly from the PVE node again? It is based on Debian, which means that the regular tools / packages for sharing it via samba/cifs apply.

My preference is to use LXC and to ensure security it looked like unprivileged LXC was the way to go, using turnkey file server template and then using bind mounts to the zpool and then configuring uid and gid mappings accordingly.

Turnkey containers are generally meant to be run as privileged containers.

However I've just read that it is not possible to have the samba server running properly on an unprivileged container?? Is this correct? My preference is to use a container but if needs be I will have to create a VM as I dont want to do priviliged in this instance.

Needs to be a privileged container, and even then you need to activate the CIFS feature in the Options->Features panel of the container.

If I need to go down the VM route, does the ZFS share=nfs allow sharing the pool without the need to modify the host?

A VM has no direct access to a file system running on the host. You can create one big disk for the VM and move you data to the VM, but to do so you will have to use a network share on the host or something like rsync.

 

[TheBokke]

If the data is stored on the local ZFS pool, you are not really able to have redundancy or portability as you are locked to that node. In that case, why not share it directly from the PVE node again? It is based on Debian, which means that the regular tools / packages for sharing it via samba/cifs apply.


Turnkey containers are generally meant to be run as privileged containers.


Needs to be a privileged container, and even then you need to activate the CIFS feature in the Options->Features panel of the container.

A VM has no direct access to a file system running on the host. You can create one big disk for the VM and move you data to the VM, but to do so you will have to use a network share on the host or something like rsync.

Thanks for taking the time to reply Aaron. What I was hoping for with containers was to have backups so if I ever needed to rebuild the host to a newer version I could just copy back the container to simplify the rebuild. Getting my All in one server up and running last time took some effort, and a lot of reading.

If I go with Privileged LXC, can you make some suggestions on what I could do to make it more secure? It'll run on a home network behind a separate of sense box, as a general all in one file/media/home automation.

Alternatively installing CIFS on the host is the alternative. Which I could always revert back to.

Thanks for the help.