Instead of creating "common" LXC unprivileged containers where all the users are mapped to (unprivileged) subuid/gid of my host user, I'm considering a mapping where my host user itself will be mapped to user 0 (root). They'd be very slim single-app containers.

The reason is that in this way I don't need the rootfs directory subtree, which resides in my user's home, to be namespace-chmod to a different user and I can delete it with a plain rm instead of a namespace one.

Is this kind of LXC less secure than the "common" one, and why is it? What could happen?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.