0

I have some troubles with lxc unprivileged containers on Debian. I follow this method:

a)I create the user unprivileged with home in /var/lxcunpriv

useradd -m -d /var/lxcunpriv lxcunpriv

b)I install the require packages

apt -y install lxc libvirt0 libpam-cgroup libpam-cgfs bridge-utils cgroupfs-mount

c)I change the file lxc-net vim /etc/default/lxc-net

USE_LXC_BRIDGE="true"

d)I restart lxc-net

systemctl restart lxc-net

e)check, all green(works fine)

lxc-checkconfig

f)I apply this

sh -c 'echo "kernel.unprivileged_userns_clone=1" > /etc/sysctl.d/80-lxc-userns.conf'
sysctl -w -p --system

g)as a NOT root user I did

cat /etc/s*id|grep $USER

h)It return 100000-165536, so...

usermod --add-subuids 100000-165536 lxcunpriv
usermod --add-subgids 100000-165536 lxcunpriv

i)I give some permission on /var/lxcunpriv

cd /var/lxcunpriv
setfacl -m u:100000:x . .local .local/share

l)I configure the usernet, bridge1 is the name of my bridge net

echo "lxcunpriv veth bridge1 10"| tee -i /etc/lxc/lxc-usernet

m)I create the dirs

su - lxcunpriv
mkdir -p .config/lxc

n) then..

echo \
'lxc.include = /etc/lxc/default.conf
# Subuids and subgids mapping
lxc.id_map = u 0 100000 65536
lxc.id_map = g 0 100000 65536
# "Secure" mounting
lxc.mount.auto = proc:mixed sys:ro cgroup:mixed
lxc.apparmor.profile = unconfined

Network configuration


lxc.network.type = veth
lxc.network.link = bridge1
lxc.network.flags = up
lxc.network.hwaddr = 00:FF:xx:xx:xx:xx'>.config/lxc/default.conf

o)I edit /etc/lxc/default.conf

lxc.network.type = veth
lxc.network.link = bridge1

p)update the .config/lxc/default.conf

lxc-update-config -c .config/lxc/default.conf

q)I create the first container

lxc-create --name mylinux -t download
lxc-start --name mylinux
lxc-attach --name mylinux

Now the problem, when I start the container...

lxc-start --name mylinux
lxc-start: mylinux: lxccontainer.c: wait_on_daemonized_start: 833 No such file or directory - Failed to receive the container state
lxc-start: mylinux: tools/lxc_start.c: main: 330 The container failed to start
lxc-start: mylinux: tools/lxc_start.c: main: 333 To get more details, run the container in foreground mode
lxc-start: mylinux: tools/lxc_start.c: main: 336 Additional information can be obtained by setting the --logfile and --logpriority options

Searching on forum I found this workaround

#!/bin/sh
printf '\n\033[42mCreating cgroup hierarchy\033[m\n\n' &&
for d in /sys/fs/cgroup/*; do
        f=$(basename $d)
        echo "looking at $f"
        if [ "$f" = "cpuset" ]; then
                echo 1 | sudo tee -a $d/cgroup.clone_children;
        elif [ "$f" = "memory" ]; then
                echo 1 | sudo tee -a $d/memory.use_hierarchy;
        fi
        sudo mkdir -p $d/$USER
        sudo chown -R $USER $d/$USER
        # add current process to cgroup
       echo $PPID > $d/$USER/tasks
done

sh workaround.sh

give me a "permission denied" on line echo $PPID > $d/$USER/tasks but works.

lxc-start -n mylinux
echo $?
0

Now the problem. I want the containers to start on boot(they are unprivileged) so lxc-autostart don't work I have created the file /etc/rc.local, but fail I have tried this way

#!/bin/bash
# Action at boot

start() {
su - lxcunpriv -c "lxc-start -n mylinux"
su - lxcunpriv -c "lxc-start -n myothercontainer"
....
}

in this case failed with the error

  lxc-start: mylinux: lxccontainer.c: wait_on_daemonized_start: 833 No such file or directory - Failed to receive the container state
    lxc-start: mylinux: tools/lxc_start.c: main: 330 The container failed to start
    lxc-start: mylinux: tools/lxc_start.c: main: 333 To get more details, run the container in foreground mode
    lxc-start: mylinux: tools/lxc_start.c: main: 336 Additional information can be obtained by setting the --logfile and --logpriority options

and also this to exec the "workaround" script from rc.local

su - lxcunpriv <<EOF
sh workaround.sh
lxc-start -n myothercontainer
EOF

in this case the workaround run but the lxc-start command fail with the same error

 lxc-start --name mylinux
    lxc-start: mylinux: lxccontainer.c: wait_on_daemonized_start: 833 No such file or directory - Failed to receive the container state...

Of course if I do

su - lxcunpriv
sh workaround.sh
lxc-start -n mylinux

it works, why don't work also from rc-local?

elbarna
  • 12,695

1 Answers1

0

Solution found I edit rc.local

Instead of those lines

su - lxcunpriv <<EOF
sh workaround.sh
lxc-start -n myothercontainer
EOF

the correct lines are those

start() {
su - lxcunpriv <<EOF
/var/lxcunpriv/workaround.sh
lxc-start --name mycontainer
lxc-start --name myothercontainer
...
EOF    
}

The container start. The problem was the word "sh" before the script, which start another subshell and vanish the effect of the workaround script.

elbarna
  • 12,695