Linux – How to Configure Unprivileged Containers

arch linuxlxc

I'm trying to set up unprivileged LXC containers and failing at every turn. I think I've followed every relevant step of the guide:

  • Normal users are allowed to create unprivileged containers:

    $ sysctl kernel.unprivileged_userns_clone
kernel.unprivileged_userns_clone = 1

  • The control groups PAM module is enabled:

    $ grep -F pam_cgfs.so /etc/pam.d/system-login
session optional pam_cgfs.so -c freezer,memory,name=systemd,unified

  • The UID and GID mappings are set up:

    $ cat /etc/lxc/default.conf
lxc.idmap = u 0 100000 65536
lxc.idmap = g 0 100000 65536
lxc.net.0.type = veth
lxc.net.0.link = lxcbr0
lxc.net.0.flags = up
lxc.net.0.hwaddr = 00:16:3e:xx:xx:xx
$ cat /etc/subuid
root:100000:65536
$ cat /etc/subgid
root:100000:65536

  • The network is set up:

    $ grep --invert-match --regexp='^#' --regexp='^$' /etc/default/lxc-net
USE_LXC_BRIDGE="true"
LXC_BRIDGE="lxcbr0"
LXC_ADDR="10.0.3.1"
LXC_NETMASK="255.255.255.0"
LXC_NETWORK="10.0.3.0/24"
LXC_DHCP_RANGE="10.0.3.2,10.0.3.254"
LXC_DHCP_MAX="253"

  • The services look fine:

    $ systemctl status --lines=0 --no-pager lxc.service lxc-net.service 
● lxc.service - LXC Container Initialization and Autoboot Code
   Loaded: loaded (/usr/lib/systemd/system/lxc.service; disabled; vendor preset: disabled)
   Active: active (exited) since Fri 2019-03-08 15:31:47 NZDT; 40min ago
     Docs: man:lxc-autostart
           man:lxc
 Main PID: 4147 (code=exited, status=0/SUCCESS)
    Tasks: 0 (limit: 4915)
   Memory: 0B
   CGroup: /system.slice/lxc.service

● lxc-net.service - LXC network bridge setup
   Loaded: loaded (/usr/lib/systemd/system/lxc-net.service; enabled; vendor preset: disabled)
   Active: active (exited) since Fri 2019-03-08 15:31:45 NZDT; 40min ago
 Main PID: 4099 (code=exited, status=0/SUCCESS)
    Tasks: 1 (limit: 4915)
   Memory: 8.4M
   CGroup: /system.slice/lxc-net.service
           └─4121 dnsmasq -u dnsmasq --strict-order --bind-interfaces --pid-file=/run/lxc/dnsm…
  • The packages are up to date and I've just rebooted.

Even so, I can't create containers:

$ lxc-create -n test -t download
lxc-create: test: parse.c: lxc_file_for_each_line_mmap: 100 No such file or directory - Failed to open file "/home/user/.config/lxc/default.conf"
lxc-create: test: conf.c: chown_mapped_root: 3179 No uid mapping for container root
lxc-create: test: lxccontainer.c: do_storage_create: 1310 Error chowning "/home/user/.local/share/lxc/test/rootfs" to container root
lxc-create: test: conf.c: suggest_default_idmap: 4801 You do not have subuids or subgids allocated
lxc-create: test: conf.c: suggest_default_idmap: 4802 Unprivileged containers require subuids and subgids
lxc-create: test: lxccontainer.c: do_lxcapi_create: 1891 Failed to create (none) storage for test
lxc-create: test: tools/lxc_create.c: main: 327 Failed to create container test

Is there anything obviously wrong with this setup? There's no mention anywhere in the linked article about ~/.config/lxc/default.conf, and I don't understand why it says I haven't allocated subuids and subgids.

Additional info:

  • Running lxc-create as root works, but this is explicitly about creating containers as a normal user.

  • cp /etc/lxc/default.conf ~/.config/lxc/default.conf gets rid of the complaint about the configuration file, but results in this message instead:

    lxc-create: playtime: conf.c: chown_mapped_root: 3279 lxc-usernsexec failed: No such file or directory – Failed to open ttyNo such file or directory – Failed to open tt

Best Answer

Is this a new project, or do you have a choice? Why not use LXD instead of LXC - much easier to use and you get to the same place. I started out with lxc and quickly made the switch because I was interested in running unprivileged containers which is not easy in LXC, but is the default in LXD.

Take a look here to start: https://discuss.linuxcontainers.org/t/comparing-lxd-vs-lxc/24

It's been a few months since I last installed/used it, but here are my notes on installation:

As LXD evolves quite rapidly, we recommend Ubuntu users use our PPA:

add-apt-repository ppa:ubuntu-lxc/lxd-stable

apt-get update

apt-get dist-upgrade

apt-get install lxd

The package creates a new “lxd” group which contains all users allowed to talk to lxd over the local unix socket. All members of the “admin” and “sudoers” groups are automatically added. If your user isn’t a member of one of these groups, you’ll need to manually add your user to the “lxd” group.

Because group membership is only applied at login, you then either need to close and re-open your user session or use the “newgrp lxd” command in the shell you’re going to interact with lxd from.

newgrp lxd

https://blog.ubuntu.com/2015/03/20/installing-lxd-and-the-command-line-tool 2018/10/22

To the best of my knowledge you can even run LXD in a virtual machine so you can give it a quick try without messing up whatever system you are working on.

Not exactly the answer to the question you asked, but I hope you find it a helpful alternative.

Related Question