SquashFS image as rootfs in LXC

Question

Is it possible to use a SquashFS filesystem as an LXC rootfs? I can mount an ext3 image as a rootfs just by setting lxc.rootfs to the filename, but if it's any other type of image, lxc-start just says that it can't mount an ext3 filesystem. The lxc.conf man page doesn't suggest any way to specify the filesystem type.

Additionally, if I get past that stage, can you mount other loopback filesystems in the container just by using lxc.mount.entry entries with 'loop' in the options field?

Answer 1

I have a working setup with some squashfs containers, especially for security reasons

For starting, simply add

lxc.rootfs = loop:/var/lib/lxc/yourcontainer/rootfs.squashfs

to your config file.

Interestingly, I see dmesg messages like

[218687.113742] EXT4-fs (loop0): VFS: Can't find ext4 filesystem
[218687.118615] FAT-fs (loop0): invalid media value (0x00)
[218687.120368] FAT-fs (loop0): Can't find a valid FAT filesystem

... which I cannot avoid because there is no lxc.rootfs.type option. But these messages are not errors - everything works as expected.

The rest are normal read-only-root problems: Files which the system wants to write to (like resolv.conf and logs). You might want to symlink them to a tmpfs volume.

I never tried to mount another squashfs to a sub-path of this container, but a normal bind mount of a host directory works as expected.

Answer 2

You can mount as rootfs squashfs image, but it would be read-only.

mount: warning: /var/lib/lxc/busy2/rootfs/ seems to be mounted read-only.

You should have another layer over squashfs, e.g. aufs.

This technique mass used in Slax.

You can repeat this just by hand. Make true lxc config, than mount your squashfs image to rootfs dir by aufs layer.

From man page:

# sudo mount -t aufs -o br:/rw_branch:/ro_branch none /aufs

My experiment with busybox return True:

# mount -o loop -t squashfs /var/busy/busy_rootfs.squashfs /var/busy/squashfs-mnt/
mount: warning: /var/busy/squashfs-mnt/ seems to be mounted read-only.
# mount -t aufs -o br:/var/busy/aufs-root/:/var/busy/squashfs-mnt/ none /var/lib/lxc/busy2/rootfs

# lxc-start --name busy2

udhcpc (v1.20.2) started
Sending discover...
Sending select for 10.0.3.105...
Lease of 10.0.3.105 obtained, lease time 3600

Please press Enter to activate this console.



BusyBox v1.20.2 (Ubuntu 1:1.20.0-8ubuntu1) built-in shell (ash)
Enter 'help' for a list of built-in commands.

/ # ls
ls
bin      etc      lib      mnt      root     selinux  usr
dev      home     lib64    proc     sbin     tmp      var

/ # touch root.file
touch root.file
/ # ls -latr root.file
ls -latr root.file
-rw-r--r--    1 root     root             0 Aug 23 12:38 root.file

Look from host:

# ls -latr /var/busy/aufs-root/
total 24
drwxr-xr-x 3 root root 4096 Aug 23 12:15 var
drwx------ 2 root root 4096 Aug 23 12:25 .wh..wh.plnk
drwx------ 2 root root 4096 Aug 23 12:25 .wh..wh.orph
-r--r--r-- 1 root root    0 Aug 23 12:25 .wh..wh.aufs
drwxr-xr-x 6 root root 4096 Aug 23 12:30 ..
drwxr-xr-x 2 root root 4096 Aug 23 12:38 dev
-rw-r--r-- 1 root root    0 Aug 23 12:38 root.file
drwxr-xr-x 6 root root 4096 Aug 23 12:39 .