Lab 3.2 - lxc containers - running unprivileged as root (but not part of exercise)
I ran through the LXC lab again, and tried a variation that is mentioned at the beginning: unprivileged containers can be created by root.
The regular unprivileged setup described in the lab works well. Except for that it can't create LVM volumes (the -B lvm option).
Privileged container also works well. Again, LVM doesn't work and I can't explain.
Next I tried what was hinted: create an unprivileged container as root.
The default Ubuntu 18.04 server installation already had a root entry in /etc/subuid and subgid:
lxd:100000:65536 root:100000:65536 heiko:165536:65536
I edited /etc/lxc/default.conf and added:
lxc.idmap = u 0 100000 65536 lxc.idmap = g 0 100000 65536
Then I followed the steps installing a container as root. Once created, I tried to start it, but got the following:
root@ubuntu:~# lxc-start -n priv -d lxc-start: priv: lxccontainer.c: wait_on_daemonized_start: 842 Received container state "ABORTING" instead of "RUNNING" lxc-start: priv: tools/lxc_start.c: main: 330 The container failed to start lxc-start: priv: tools/lxc_start.c: main: 333 To get more details, run the container in foreground mode lxc-start: priv: tools/lxc_start.c: main: 336 Additional information can be obtained by setting the --logfile and --logpriority options
I wonder what went wrong?
Also, wouldn't it make sense to include this exercise - creating non-privileged containers as root - in the lab? I know it's a lot of stuff and hard to decide where to shorten.
If anyone has any thoughts on why LVM doesn't work (including as root), that would be a bonus.
Right now my feeling about lxc is that it's not that practical. But I definitely don't know enough about it.
Comments
-
Hi @heiko_s,
LXC is one of the classics, and it was used by Docker in its early days.
As far as LVM, you may find some helpful tips on the linuxcontainers.org forum.
I will try to run thru this (non)exercise to investigate what is happening. I will post my findings as soon as I have something.
Regards,
-Chris0 -
Hello @heiko_s,
I have attempted to create the unprivileged container as root, but so far I have been stuck at the same step as reported by you. There have been many inconsistent issues reported around this method, where the container start fails.
This makes me wonder if what the documentation states (but does not prove) has any specific requirements or dependencies. I will keep this on my radar and report back with any relevant info.
Regards,
-Chris0 -
Thanks for digging into this, Chris.
0
Categories
- All Categories
- 177 LFX Mentorship
- 177 LFX Mentorship: Linux Kernel
- 755 Linux Foundation IT Professional Programs
- 375 Cloud Engineer IT Professional Program
- 170 Advanced Cloud Engineer IT Professional Program
- 74 DevOps IT Professional Program - Discontinued
- 5 DevOps & GitOps IT Professional Program
- 100 Cloud Native Developer IT Professional Program
- 7.6K Training Courses & Learning Paths
- 2 AI & ML Training
- 1 Blockchain & Decentralized Identity Training
- 5 Cloud & Containers Training
- 1 Cybersecurity Training
- 2 DevOps & Site-Reliability Training
- 1 Linux Kernel Development Training
- 1 Networking Training
- 2 Open Source Best Practice Training
- 2 System Administration Training
- 1 System Engineering Training
- 1 Web & Application Development Training
- 794 Hardware
- 202 Drivers
- 68 I/O Devices
- 37 Monitors
- 95 Multimedia
- 173 Networking
- 91 Printers & Scanners
- 89 Storage
- 769 Linux Distributions
- 81 Debian
- 68 Fedora
- 22 Linux Mint
- 13 Mageia
- 24 openSUSE
- 150 Red Hat Enterprise
- 31 Slackware
- 13 SUSE Enterprise
- 356 Ubuntu
- 465 Linux System Administration
- 31 Cloud Computing
- 73 Command Line/Scripting
- Github systems admin projects
- 98 Linux Security
- 78 Network Management
- 101 System Management
- 46 Web Management
- 112 Mobile Computing
- 20 Android
- 77 Development
- 1.2K New to Linux
- 1K Getting Started with Linux
- 393 Off Topic
- 121 Introductions
- 182 Small Talk
- 29 Study Material
- 980 Programming and Development
- 310 Kernel Development
- 652 Software Development
- 995 Software
- 387 Applications
- 182 Command Line
- 5 Compiling/Installing
- 68 Games
- 317 Installation
- Archived
- 2 LFD140 Class Forum
- 1.4K LFS258 Class Forum
Upcoming Training
-
August 20, 2018
Kubernetes Administration (LFS458)
-
August 20, 2018
Linux System Administration (LFS301)
-
August 27, 2018
Open Source Virtualization (LFS462)
-
August 27, 2018
Linux Kernel Debugging and Security (LFD440)