I'd like to play with LXC but I find the docs not very newbie-friendly. I'm trying to follow a guide at:
https://brandonrozek.com/blog/lxc-fedora-38/
(basically because it mentions Fedora). I followed the steps closely and rebooted, but I get the following error:
$ systemd-run --unit=my-unit --user --scope -p "Delegate=yes" -- lxc-start test Running scope as unit: my-unit.scope lxc-start: test: lxccontainer.c: wait_on_daemonized_start: 877 Received container state "ABORTING" instead of "RUNNING" lxc-start: test: tools/lxc_start.c: main: 306 The container failed to start lxc-start: test: tools/lxc_start.c: main: 309 To get more details, run the container in foreground mode lxc-start: test: tools/lxc_start.c: main: 311 Additional information can be obtained by setting the --logfile and --logpriority options
Any insights would be welcome. (Just in case, I tried running with SElinux turned off, but it made no difference.)
poc
On 3/10/24 09:39, Patrick O'Callaghan wrote:
I'd like to play with LXC but I find the docs not very newbie-friendly. I'm trying to follow a guide at:
https://brandonrozek.com/blog/lxc-fedora-38/
(basically because it mentions Fedora). I followed the steps closely and rebooted, but I get the following error:
$ systemd-run --unit=my-unit --user --scope -p "Delegate=yes" -- lxc-start test Running scope as unit: my-unit.scope lxc-start: test: lxccontainer.c: wait_on_daemonized_start: 877 Received container state "ABORTING" instead of "RUNNING" lxc-start: test: tools/lxc_start.c: main: 306 The container failed to start lxc-start: test: tools/lxc_start.c: main: 309 To get more details, run the container in foreground mode lxc-start: test: tools/lxc_start.c: main: 311 Additional information can be obtained by setting the --logfile and --logpriority optionsAny insights would be welcome. (Just in case, I tried running with SElinux turned off, but it made no difference.)
I use lxc all the time.
The last two lines are key. Add these flags: -F -o logfile. The default loglevel is ERROR. If you want more detail include -l LEVEL.
e.g. lxc-start -n containerName -F -o containerName.log -l WARN
My experience has been that there is a disconnect between the container and the host's bridge usually caused by misconfigured network options in the config file or perhaps the default bridge is not up.
Here's a section from my Archlinux config. This particular bridge is named WWW. The veth.pair isn't necessary but it puts a name on the interface and makes it easier to identify with "ip link list (ip l l )". The generated names, eth-VLXWORL eg. aren't helpful at all. Same thing about hwaddr. If you don't provide a MAC one will be provided for you.
# Network configuration lxc.net.0.type = veth lxc.net.0.link = WWW lxc.net.0.flags = up
# not required lxc.net.0.veth.pair = WWW-rch lxc.net.0.hwaddr = 00:16:3e:00:05:10
hth, :m
On Sun, 2024-03-10 at 11:13 -0700, Mike Wright wrote:
The last two lines are key. Add these flags: -F -o logfile. The default loglevel is ERROR. If you want more detail include -l LEVEL.
e.g. lxc-start -n containerName -F -o containerName.log -l WARN
This is what I get:
$ lxc-start -n test -F -o test.log -l WARN lxc-start: test: cgroups/cgfsng.c: __cgfsng_delegate_controllers: 2921 Device or resource busy - Could not enable "+cpu +io +memory +pids" controllers in the unified cgroup 9 lxc-start: test: cgroups/cgfsng.c: __cgfsng_delegate_controllers: 2921 Device or resource busy - Could not enable "+cpu +io +memory +pids" controllers in the unified cgroup 9 lxc-start: test: start.c: print_top_failing_dir: 99 Permission denied - Could not access /home/poc/.local. Please grant it x access, or add an ACL for the container root lxc-start: test: sync.c: sync_wait: 34 An error occurred in another process (expected sequence number 1) lxc-start: test: start.c: __lxc_start: 2074 Failed to spawn container "test" lxc-start: test: tools/lxc_start.c: main: 306 The container failed to start lxc-start: test: tools/lxc_start.c: main: 311 Additional information can be obtained by setting the --logfile and --logpriority options $ cat test.log lxc-start test 20240310223702.913 ERROR cgfsng - cgroups/cgfsng.c:__cgfsng_delegate_controllers:2921 - Device or resource busy - Could not enable "+cpu +io +memory +pids" controllers in the unified cgroup 9 lxc-start test 20240310223702.934 ERROR cgfsng - cgroups/cgfsng.c:__cgfsng_delegate_controllers:2921 - Device or resource busy - Could not enable "+cpu +io +memory +pids" controllers in the unified cgroup 9 lxc-start test 20240310223702.944 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1251 - No such file or directory - Failed to fchownat(15, memory.oom.group, 65536, 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW ) lxc-start test 20240310223702.944 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1251 - No such file or directory - Failed to fchownat(15, memory.reclaim, 65536, 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW ) lxc-start test 20240310223702.945 ERROR start - start.c:print_top_failing_dir:99 - Permission denied - Could not access /home/poc/.local. Please grant it x access, or add an ACL for the container root lxc-start test 20240310223702.945 ERROR sync - sync.c:sync_wait:34 - An error occurred in another process (expected sequence number 1) lxc-start test 20240310223702.945 ERROR start - start.c:__lxc_start:2074 - Failed to spawn container "test" lxc-start test 20240310223702.945 WARN start - start.c:lxc_abort:1039 - No such process - Failed to send SIGKILL via pidfd 16 for process 148416 lxc-start test 20240310223702.958 ERROR lxc_start - tools/lxc_start.c:main:306 - The container failed to start
I guess the first two lines are the key to the problem. My default config file is:
$ cat ~/.config/lxc/default.conf lxc.net.0.type = veth lxc.net.0.link = lxcbr0 lxc.net.0.flags = up lxc.net.0.hwaddr = 00:16:3e:xx:xx:xx lxc.idmap = u 0 100000 65536 lxc.idmap = g 0 100000 65536
The 'test' container is a Fedora 39 instance.
poc
On 3/10/24 15:40, Patrick O'Callaghan wrote:
On Sun, 2024-03-10 at 11:13 -0700, Mike Wright wrote:
The last two lines are key. Add these flags: -F -o logfile. The default loglevel is ERROR. If you want more detail include -l LEVEL.
e.g. lxc-start -n containerName -F -o containerName.log -l WARN
This is what I get:
$ lxc-start -n test -F -o test.log -l WARN
...
lxc-start test 20240310223702.945 ERROR start - start.c:print_top_failing_dir:99 - Permission denied - Could not access /home/poc/.local. Please grant it x access, or add an ACL for the container root
This one looks interesting
On 3/10/24 15:40, Patrick O'Callaghan wrote:
On Sun, 2024-03-10 at 11:13 -0700, Mike Wright wrote:
The last two lines are key. Add these flags: -F -o logfile. The default loglevel is ERROR. If you want more detail include -l LEVEL.
e.g. lxc-start -n containerName -F -o containerName.log -l WARN
This is what I get:
$ lxc-start -n test -F -o test.log -l WARN
<snip/>
$ cat test.log lxc-start test 20240310223702.913 ERROR cgfsng - cgroups/cgfsng.c:__cgfsng_delegate_controllers:2921 - Device or resource busy - Could not enable "+cpu +io +memory +pids" controllers in the unified cgroup 9 lxc-start test 20240310223702.934 ERROR cgfsng - cgroups/cgfsng.c:__cgfsng_delegate_controllers:2921 - Device or resource busy - Could not enable "+cpu +io +memory +pids" controllers in the unified cgroup 9
I use this:
lxc.apparmor.profile=unconfined
which runs the container as root. That setting doesn't stop you from adding profiles.
If I disable that line I get a cgfsng WARN and the container won't start. ( My containers are used for local services so I'm pretty lax about running them as root. They are also heavily firewalled behind a router (also a container which starts the firewall then puts an IP on the WAN and sets the default route. Until the router container comes up my host has no network connectivity at all) )
Also, you're remapping IDs. What happens if you comment those out?
My thought here is to get it running as root first then begin the process of securing it as you see fit.
I don't have this in my configs but I found this:
lxc.cgroup.devices.allow=a
On Sun, 2024-03-10 at 22:56 -0700, Mike Wright wrote:
On 3/10/24 15:40, Patrick O'Callaghan wrote:
On Sun, 2024-03-10 at 11:13 -0700, Mike Wright wrote:
The last two lines are key. Add these flags: -F -o logfile. The default loglevel is ERROR. If you want more detail include -l LEVEL.
e.g. lxc-start -n containerName -F -o containerName.log -l WARN
This is what I get:
$ lxc-start -n test -F -o test.log -l WARN
<snip/> > $ cat test.log > lxc-start test 20240310223702.913 ERROR cgfsng - > cgroups/cgfsng.c:__cgfsng_delegate_controllers:2921 - Device or > resource busy - Could not enable "+cpu +io +memory +pids" > controllers in the unified cgroup 9 > lxc-start test 20240310223702.934 ERROR cgfsng - > cgroups/cgfsng.c:__cgfsng_delegate_controllers:2921 - Device or > resource busy - Could not enable "+cpu +io +memory +pids" > controllers in the unified cgroup 9
I use this:
lxc.apparmor.profile=unconfined
which runs the container as root. That setting doesn't stop you from adding profiles.
AFAIK 'apparmor' is a Ubuntu-ism. Both my system and the system in the container are Fedora 39.
If I disable that line I get a cgfsng WARN and the container won't start. ( My containers are used for local services so I'm pretty lax about running them as root. They are also heavily firewalled behind a router (also a container which starts the firewall then puts an IP on the WAN and sets the default route. Until the router container comes up my host has no network connectivity at all) )
Also, you're remapping IDs. What happens if you comment those out?
I thought that was part of the whole point of using separate namespaces.
My thought here is to get it running as root first then begin the process of securing it as you see fit.
I don't have this in my configs but I found this:
lxc.cgroup.devices.allow=a
I'll try that.
poc
On 3/11/24 04:33, Patrick O'Callaghan wrote:
On Sun, 2024-03-10 at 22:56 -0700, Mike Wright wrote:
On 3/10/24 15:40, Patrick O'Callaghan wrote:
On Sun, 2024-03-10 at 11:13 -0700, Mike Wright wrote:
The last two lines are key. Add these flags: -F -o logfile. The default loglevel is ERROR. If you want more detail include -l LEVEL.
e.g. lxc-start -n containerName -F -o containerName.log -l WARN
This is what I get:
$ lxc-start -n test -F -o test.log -l WARN
<snip/> > $ cat test.log > lxc-start test 20240310223702.913 ERROR cgfsng - > cgroups/cgfsng.c:__cgfsng_delegate_controllers:2921 - Device or > resource busy - Could not enable "+cpu +io +memory +pids" > controllers in the unified cgroup 9 > lxc-start test 20240310223702.934 ERROR cgfsng - > cgroups/cgfsng.c:__cgfsng_delegate_controllers:2921 - Device or > resource busy - Could not enable "+cpu +io +memory +pids" > controllers in the unified cgroup 9
I use this:
lxc.apparmor.profile=unconfined
which runs the container as root. That setting doesn't stop you from adding profiles.
AFAIK 'apparmor' is a Ubuntu-ism. Both my system and the system in the container are Fedora 39.
That one puzzles me, too. However, there is no corresponding lxc.selinux setting. lxc was a canonical/ubuntu creation so my first reaction was the same as yours but from some of the comments I've read on https://discuss.linuxcontainers.org ( another forum with *lots* of empty space ) that it or something like it may have been integrated into lxc.
On 3/11/24 08:41, Mike Wright wrote:
On 3/11/24 04:33, Patrick O'Callaghan wrote:
On Sun, 2024-03-10 at 22:56 -0700, Mike Wright wrote:
On 3/10/24 15:40, Patrick O'Callaghan wrote:
On Sun, 2024-03-10 at 11:13 -0700, Mike Wright wrote:
The last two lines are key. Add these flags: -F -o logfile. The default loglevel is ERROR. If you want more detail include -l LEVEL.
AFAIK 'apparmor' is a Ubuntu-ism. Both my system and the system in the container are Fedora 39.
That one puzzles me, too. However, there is no corresponding lxc.selinux setting. lxc was a canonical/ubuntu creation so my first reaction was the same as yours but from some of the comments I've read on https://discuss.linuxcontainers.org ( another forum with *lots* of empty space ) that it or something like it may have been integrated into lxc.
CORRECTION: the above paragraph is wrong.
A much easier to read manpage:
https://manpages.ubuntu.com/manpages/bionic/en/man5/lxc.container.conf.5.htm...
§ SELINUX CONTEXT
lxc.selinux.context
Specify the SELinux context under which the container should be run or unconfined_t. For example
lxc.selinux.context = system_u:system_r:lxc_t:s0:c22
On Mon, 2024-03-11 at 09:16 -0700, Mike Wright wrote:
On 3/11/24 08:41, Mike Wright wrote:
On 3/11/24 04:33, Patrick O'Callaghan wrote:
On Sun, 2024-03-10 at 22:56 -0700, Mike Wright wrote:
On 3/10/24 15:40, Patrick O'Callaghan wrote:
On Sun, 2024-03-10 at 11:13 -0700, Mike Wright wrote:
The last two lines are key. Add these flags: -F -o logfile. The default loglevel is ERROR. If you want more detail include -l LEVEL.
AFAIK 'apparmor' is a Ubuntu-ism. Both my system and the system in the container are Fedora 39.
That one puzzles me, too. However, there is no corresponding lxc.selinux setting. lxc was a canonical/ubuntu creation so my first reaction was the same as yours but from some of the comments I've read on https://discuss.linuxcontainers.org%C2%A0( another forum with *lots* of empty space ) that it or something like it may have been integrated into lxc.
CORRECTION: the above paragraph is wrong.
A much easier to read manpage:
https://manpages.ubuntu.com/manpages/bionic/en/man5/lxc.container.conf.5.htm...
This appears to the manpage at lxc-container.conf(5).
§ SELINUX CONTEXT
lxc.selinux.context
Specify the SELinux context under which the container should be run or unconfined_t. For example
lxc.selinux.context = system_u:system_r:lxc_t:s0:c22
I added that to the config file. It made no difference.
poc
On Sun, 2024-03-10 at 16:39 +0000, Patrick O'Callaghan wrote:
I'd like to play with LXC but I find the docs not very newbie- friendly. I'm trying to follow a guide at:
https://brandonrozek.com/blog/lxc-fedora-38/
(basically because it mentions Fedora). I followed the steps closely and rebooted, but I get the following error:
$ systemd-run --unit=my-unit --user --scope -p "Delegate=yes" -- lxc-start test Running scope as unit: my-unit.scope lxc-start: test: lxccontainer.c: wait_on_daemonized_start: 877 Received container state "ABORTING" instead of "RUNNING" lxc-start: test: tools/lxc_start.c: main: 306 The container failed to start lxc-start: test: tools/lxc_start.c: main: 309 To get more details, run the container in foreground mode lxc-start: test: tools/lxc_start.c: main: 311 Additional information can be obtained by setting the --logfile and -- logpriority options Any insights would be welcome. (Just in case, I tried running with SElinux turned off, but it made no difference.)
One thing: on running lxc-checkconfig I get: ... Cgroup v1 systemd controller: missing Cgroup v1 freezer controller: missing Cgroup ns_cgroup: required
...
(everything else is OK).
poc
On 3/11/24 14:38, Patrick O'Callaghan wrote:
On Mon, 2024-03-11 at 09:16 -0700, Mike Wright wrote:
On 3/11/24 08:41, Mike Wright wrote:
On 3/11/24 04:33, Patrick O'Callaghan wrote:
On Sun, 2024-03-10 at 22:56 -0700, Mike Wright wrote:
On 3/10/24 15:40, Patrick O'Callaghan wrote:
On Sun, 2024-03-10 at 11:13 -0700, Mike Wright wrote: > The last two lines are key. Add these flags: -F -o > logfile. The > default loglevel is ERROR. If you want more detail include > -l > LEVEL. >
AFAIK 'apparmor' is a Ubuntu-ism. Both my system and the system in the container are Fedora 39.
That one puzzles me, too. However, there is no corresponding lxc.selinux setting. lxc was a canonical/ubuntu creation so my first reaction was the same as yours but from some of the comments I've read on https://discuss.linuxcontainers.org ( another forum with *lots* of empty space ) that it or something like it may have been integrated into lxc.
CORRECTION: the above paragraph is wrong.
A much easier to read manpage:
https://manpages.ubuntu.com/manpages/bionic/en/man5/lxc.container.conf.5.htm...
This appears to the manpage at lxc-container.conf(5).
Yes, sans-serif is easier for me to read. White BG (although I prefer dark theme) is also a lot better for me than white on black manpages.
§ SELINUX CONTEXT
lxc.selinux.context
Specify the SELinux context under which the container should be run or unconfined_t. For example
lxc.selinux.context = system_u:system_r:lxc_t:s0:c22I added that to the config file. It made no difference.
Try this ( works with lxc.apparmor.context ).
lxc.selinux.context = generated
...and also ~/.local/lxc/default.conf with these contents:
lxc.include = /etc/lxc/default.conf lxc.idmap = u 0 100000 65536 lxc.idmap = g 0 100000 65536
That way the lxc.idmap lines are not required in each config.
On 3/11/24 14:41, Patrick O'Callaghan wrote:
On Sun, 2024-03-10 at 16:39 +0000, Patrick O'Callaghan wrote:
I'd like to play with LXC but I find the docs not very newbie- friendly. I'm trying to follow a guide at:
https://brandonrozek.com/blog/lxc-fedora-38/
(basically because it mentions Fedora). I followed the steps closely and rebooted, but I get the following error:
$ systemd-run --unit=my-unit --user --scope -p "Delegate=yes" -- lxc-start test Running scope as unit: my-unit.scope lxc-start: test: lxccontainer.c: wait_on_daemonized_start: 877 Received container state "ABORTING" instead of "RUNNING" lxc-start: test: tools/lxc_start.c: main: 306 The container failed to start lxc-start: test: tools/lxc_start.c: main: 309 To get more details, run the container in foreground mode lxc-start: test: tools/lxc_start.c: main: 311 Additional information can be obtained by setting the --logfile and -- logpriority options
Any insights would be welcome. (Just in case, I tried running with SElinux turned off, but it made no difference.)
One thing: on running lxc-checkconfig I get: ... Cgroup v1 systemd controller: missing Cgroup v1 freezer controller: missing Cgroup ns_cgroup: required
I get the same results over here. The first two are irrelevant since current systems are using v2.
I don't know if ns_required is a WARN or ERROR or a threat :)
On Mon, 2024-03-11 at 15:08 -0700, Mike Wright wrote:
Try this ( works with lxc.apparmor.context ).
lxc.selinux.context = generated
Same result.
...and also ~/.local/lxc/default.conf with these contents:
lxc.include = /etc/lxc/default.conf
The local default.conf was copied from /etc/lxc and edited.
lxc.idmap = u 0 100000 65536 lxc.idmap = g 0 100000 65536
Those lines are already there. This is the complete file:
$ cat ~/.config/lxc/default.conf lxc.net.0.type = veth lxc.net.0.link = lxcbr0 lxc.net.0.flags = up lxc.net.0.hwaddr = 00:16:3e:xx:xx:xx lxc.idmap = u 0 100000 65536 lxc.idmap = g 0 100000 65536 lxc.cgroup.devices.allow=a lxc.selinux.context = generated
poc
On 3/11/24 14:41, Patrick O'Callaghan wrote:
On Sun, 2024-03-10 at 16:39 +0000, Patrick O'Callaghan wrote:
I'd like to play with LXC but I find the docs not very newbie- friendly. I'm trying to follow a guide at:
https://brandonrozek.com/blog/lxc-fedora-38/
(basically because it mentions Fedora). I followed the steps closely and rebooted, but I get the following error:
$ systemd-run --unit=my-unit --user --scope -p "Delegate=yes" -- lxc-start test Running scope as unit: my-unit.scope lxc-start: test: lxccontainer.c: wait_on_daemonized_start: 877 Received container state "ABORTING" instead of "RUNNING" lxc-start: test: tools/lxc_start.c: main: 306 The container failed to start lxc-start: test: tools/lxc_start.c: main: 309 To get more details, run the container in foreground mode lxc-start: test: tools/lxc_start.c: main: 311 Additional information can be obtained by setting the --logfile and -- logpriority options
Any insights would be welcome. (Just in case, I tried running with SElinux turned off, but it made no difference.)
One thing: on running lxc-checkconfig I get: ... Cgroup v1 systemd controller: missing Cgroup v1 freezer controller: missing Cgroup ns_cgroup: required
...
(everything else is OK).
The first two are irrelevant. It uses cgroup2 now. 3rd one I don't understand.
How is your test container working?
I've been playing along over here and now have a container that reports "UNPRIVILEGED true" using lxc-ls -f. It starts and runs but is unusable. lxc-start -n C1 -F shows the bootup sequence and it is full of [FAILED] sections. root can't even change to /root: permission denied. Almost everything is owned by 65534:65534. If I manually set an IP and default route I have networking and it uses my DNS container successfully.
I found this: https://brandonrozek.com/blog/lxc-fedora-38/ "Setting up unprivileged containers with LXC on Fedora 38" and how to use systemd to start and stop the containers. It works but doesn't solve the other problems I'm seeing.
On Tue, 2024-03-12 at 15:36 -0700, Mike Wright wrote:
On 3/11/24 14:41, Patrick O'Callaghan wrote:
On Sun, 2024-03-10 at 16:39 +0000, Patrick O'Callaghan wrote:
I'd like to play with LXC but I find the docs not very newbie- friendly. I'm trying to follow a guide at:
https://brandonrozek.com/blog/lxc-fedora-38/
(basically because it mentions Fedora). I followed the steps closely and rebooted, but I get the following error:
$ systemd-run --unit=my-unit --user --scope -p "Delegate=yes"
lxc-start test Running scope as unit: my-unit.scope lxc-start: test: lxccontainer.c: wait_on_daemonized_start: 877 Received container state "ABORTING" instead of "RUNNING" lxc-start: test: tools/lxc_start.c: main: 306 The container failed to start lxc-start: test: tools/lxc_start.c: main: 309 To get more details, run the container in foreground mode lxc-start: test: tools/lxc_start.c: main: 311 Additional information can be obtained by setting the --logfile and -- logpriority options Any insights would be welcome. (Just in case, I tried running with SElinux turned off, but it made no difference.)
One thing: on running lxc-checkconfig I get: ... Cgroup v1 systemd controller: missing Cgroup v1 freezer controller: missing Cgroup ns_cgroup: required
...
(everything else is OK).
The first two are irrelevant. It uses cgroup2 now. 3rd one I don't understand.
How is your test container working?
It isn't. I still get the same errors on startup.
I've been playing along over here and now have a container that reports "UNPRIVILEGED true" using lxc-ls -f. It starts and runs but is unusable. lxc-start -n C1 -F shows the bootup sequence and it is full of [FAILED] sections. root can't even change to /root: permission denied. Almost everything is owned by 65534:65534. If I manually set an IP and default route I have networking and it uses my DNS container successfully.
I found this: https://brandonrozek.com/blog/lxc-fedora-38/%C2%A0%22Setting up unprivileged containers with LXC on Fedora 38" and how to use systemd to start and stop the containers. It works but doesn't solve the other problems I'm seeing.
Yes, I'd found that page a couple of days ago and tried following it. Same problems as before.
I'm thinking this isn't worth the hassle. My main interest in lxc was to run a small containerised VPN, but Fedora seems to have much better support for docker (via podman) so I'll probably concentrate on that.
poc
On 3/13/24 04:45, Patrick O'Callaghan wrote:
On Tue, 2024-03-12 at 15:36 -0700, Mike Wright wrote:
On 3/11/24 14:41, Patrick O'Callaghan wrote:
On Sun, 2024-03-10 at 16:39 +0000, Patrick O'Callaghan wrote:
I'd like to play with LXC but I find the docs not very newbie- friendly. I'm trying to follow a guide at:
https://brandonrozek.com/blog/lxc-fedora-38/
(basically because it mentions Fedora). I followed the steps closely and rebooted, but I get the following error:
$ systemd-run --unit=my-unit --user --scope -p "Delegate=yes"
lxc-start test Running scope as unit: my-unit.scope lxc-start: test: lxccontainer.c: wait_on_daemonized_start: 877 Received container state "ABORTING" instead of "RUNNING" lxc-start: test: tools/lxc_start.c: main: 306 The container failed to start lxc-start: test: tools/lxc_start.c: main: 309 To get more details, run the container in foreground mode lxc-start: test: tools/lxc_start.c: main: 311 Additional information can be obtained by setting the --logfile and -- logpriority options
Any insights would be welcome. (Just in case, I tried running with SElinux turned off, but it made no difference.)
One thing: on running lxc-checkconfig I get: ... Cgroup v1 systemd controller: missing Cgroup v1 freezer controller: missing Cgroup ns_cgroup: required
...
(everything else is OK).
The first two are irrelevant. It uses cgroup2 now. 3rd one I don't understand.
How is your test container working?
It isn't. I still get the same errors on startup.
I've been playing along over here and now have a container that reports "UNPRIVILEGED true" using lxc-ls -f. It starts and runs but is unusable. lxc-start -n C1 -F shows the bootup sequence and it is full of [FAILED] sections. root can't even change to /root: permission denied. Almost everything is owned by 65534:65534. If I manually set an IP and default route I have networking and it uses my DNS container successfully.
I found this: https://brandonrozek.com/blog/lxc-fedora-38/%C2%A0%22Setting up unprivileged containers with LXC on Fedora 38" and how to use systemd to start and stop the containers. It works but doesn't solve the other problems I'm seeing.
Yes, I'd found that page a couple of days ago and tried following it. Same problems as before.
I'm thinking this isn't worth the hassle.
I reached the same conclusion wrt unprivileged containers. Nonetheless, I'm still very happy using privileged containers. They're up in a second, none have ever crashed or become unstable. I find them ideal for isolating individual services on my network and for conducting quick experiments.
My main interest in lxc was to run a small containerised VPN, but Fedora seems to have much better support for docker (via podman) so I'll probably concentrate on that.
Good luck!
-
Mike Wright -
Patrick O'Callaghan