1

I'm trying to set up unprivileged LXC containers and failing at every turn. I think I've followed every relevant step of the guide:

  • Normal users are allowed to create unprivileged containers:

    $ sysctl kernel.unprivileged_userns_clone
    kernel.unprivileged_userns_clone = 1
    
  • The control groups PAM module is enabled:

    $ grep -F pam_cgfs.so /etc/pam.d/system-login
    session optional pam_cgfs.so -c freezer,memory,name=systemd,unified
    
  • The UID and GID mappings are set up:

    $ cat /etc/lxc/default.conf
    lxc.idmap = u 0 100000 65536
    lxc.idmap = g 0 100000 65536
    lxc.net.0.type = veth
    lxc.net.0.link = lxcbr0
    lxc.net.0.flags = up
    lxc.net.0.hwaddr = 00:16:3e:xx:xx:xx
    $ cat /etc/subuid
    root:100000:65536
    $ cat /etc/subgid
    root:100000:65536
    
  • The network is set up:

    $ grep --invert-match --regexp='^#' --regexp='^$' /etc/default/lxc-net
    USE_LXC_BRIDGE="true"
    LXC_BRIDGE="lxcbr0"
    LXC_ADDR="10.0.3.1"
    LXC_NETMASK="255.255.255.0"
    LXC_NETWORK="10.0.3.0/24"
    LXC_DHCP_RANGE="10.0.3.2,10.0.3.254"
    LXC_DHCP_MAX="253"
    
  • The services look fine:

    $ systemctl status --lines=0 --no-pager lxc.service lxc-net.service 
    ● lxc.service - LXC Container Initialization and Autoboot Code
       Loaded: loaded (/usr/lib/systemd/system/lxc.service; disabled; vendor preset: disabled)
       Active: active (exited) since Fri 2019-03-08 15:31:47 NZDT; 40min ago
         Docs: man:lxc-autostart
               man:lxc
     Main PID: 4147 (code=exited, status=0/SUCCESS)
        Tasks: 0 (limit: 4915)
       Memory: 0B
       CGroup: /system.slice/lxc.service
    
    ● lxc-net.service - LXC network bridge setup
       Loaded: loaded (/usr/lib/systemd/system/lxc-net.service; enabled; vendor preset: disabled)
       Active: active (exited) since Fri 2019-03-08 15:31:45 NZDT; 40min ago
     Main PID: 4099 (code=exited, status=0/SUCCESS)
        Tasks: 1 (limit: 4915)
       Memory: 8.4M
       CGroup: /system.slice/lxc-net.service
               └─4121 dnsmasq -u dnsmasq --strict-order --bind-interfaces --pid-file=/run/lxc/dnsm…
    
  • The packages are up to date and I've just rebooted.

Even so, I can't create containers:

$ lxc-create -n test -t download
lxc-create: test: parse.c: lxc_file_for_each_line_mmap: 100 No such file or directory - Failed to open file "/home/user/.config/lxc/default.conf"
lxc-create: test: conf.c: chown_mapped_root: 3179 No uid mapping for container root
lxc-create: test: lxccontainer.c: do_storage_create: 1310 Error chowning "/home/user/.local/share/lxc/test/rootfs" to container root
lxc-create: test: conf.c: suggest_default_idmap: 4801 You do not have subuids or subgids allocated
lxc-create: test: conf.c: suggest_default_idmap: 4802 Unprivileged containers require subuids and subgids
lxc-create: test: lxccontainer.c: do_lxcapi_create: 1891 Failed to create (none) storage for test
lxc-create: test: tools/lxc_create.c: main: 327 Failed to create container test

Is there anything obviously wrong with this setup? There's no mention anywhere in the linked article about ~/.config/lxc/default.conf, and I don't understand why it says I haven't allocated subuids and subgids.

Additional info:

  • Running lxc-create as root works, but this is explicitly about creating containers as a normal user.
  • cp /etc/lxc/default.conf ~/.config/lxc/default.conf gets rid of the complaint about the configuration file, but results in this message instead:

    lxc-create: playtime: conf.c: chown_mapped_root: 3279 lxc-usernsexec failed: No such file or directory - Failed to open ttyNo such file or directory - Failed to open tt

  • "Unprivileged containers require subuids and subgids". man subuid; man subgid. Normally this should be created when the user is created, but if your user was created a long time ago, this might not have been. Put compatible values in lxc.idmap (or lxc2's equivalent). Now check the next batch of errors heh – A.B Mar 17 at 10:54
1

Is this a new project, or do you have a choice? Why not use LXD instead of LXC - much easier to use and you get to the same place. I started out with lxc and quickly made the switch because I was interested in running unprivileged containers which is not easy in LXC, but is the default in LXD.

Take a look here to start: https://discuss.linuxcontainers.org/t/comparing-lxd-vs-lxc/24

It's been a few months since I last installed/used it, but here are my notes on installation:

As LXD evolves quite rapidly, we recommend Ubuntu users use our PPA:

add-apt-repository ppa:ubuntu-lxc/lxd-stable

apt-get update

apt-get dist-upgrade

apt-get install lxd

The package creates a new “lxd” group which contains all users allowed to talk to lxd over the local unix socket. All members of the “admin” and “sudoers” groups are automatically added. If your user isn’t a member of one of these groups, you’ll need to manually add your user to the “lxd” group.

Because group membership is only applied at login, you then either need to close and re-open your user session or use the “newgrp lxd” command in the shell you’re going to interact with lxd from.

newgrp lxd

https://blog.ubuntu.com/2015/03/20/installing-lxd-and-the-command-line-tool 2018/10/22


To the best of my knowledge you can even run LXD in a virtual machine so you can give it a quick try without messing up whatever system you are working on.

Not exactly the answer to the question you asked, but I hope you find it a helpful alternative.

  • I specified Arch Linux and LXC, but I might give LXD a try sometime. – l0b0 Mar 8 at 8:38
  • I don't use Arch Linux, but from the wiki, it appears that LXD works on Arch - maybe this is helpful: link - Once you get LXD set up it's very easy to work with. – user73383 Mar 9 at 9:16
  • I got as far as this - it's enormously difficult to set up and debug this, especially given the minimal documentation. – l0b0 Mar 9 at 20:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.