Subject: bug#502: LXC unprivileged containers

From: Saman Behnam <[email-masked]>
Date: Sun, 2 Aug 2020 19:04:11 -0600

Package: lxc

Version: 1:3.1.0+really3.0.3-8

System: Devuan Beowulf

After a clean install of lxc package containers do not work unless i have
to do the following.

add to sysctl.conf
##################
# LXC Devuan unpriviliged
# containers
kernel.unprivileged_userns_clone = 1

# LXC kernel setting (optional)
# Makes dmesg work for
# non root users.
kernel.dmesg_restrict = 0

create and configure
####################
/etc/lxc/lxc-usernet
/etc/default/lxc-net

I suggest adding a file with above settings that goes to
"/etc/sysctl.d"
And make
"sysctl.conf"
include
"/etc/sysctl.d"

Also add files:
/etc/lxc/lxc-usernet
/etc/default/lxc-net

~ $ cat /etc/lxc/lxc-usernet
# USERNAME TYPE BRIDGE COUNT
# examplecontainer1 veth lxcbr0 1
# examplecontainer2 veth lxcbr0 2

~ $ cat /etc/default/lxc-net
# This file is auto-generated by lxc.postinst if it does not
# exist.  Customizations will not be overridden.
# Leave USE_LXC_BRIDGE as "true" if you want to use lxcbr0 for your
# containers.  Set to "false" if you'll use virbr0 or another existing
# bridge, or mavlan to your host's NIC.
USE_LXC_BRIDGE="false"

# If you change the LXC_BRIDGE to something other than lxcbr0, then
# you will also need to update your /etc/lxc/default.conf as well as the
# configuration (/var/lib/lxc/<container>/config) for any containers
# already created using the default config to reflect the new bridge
# name.
# If you have the dnsmasq daemon installed, you'll also have to update
# /etc/dnsmasq.d/lxc and restart the system wide dnsmasq daemon.
LXC_BRIDGE="lxcbr0"
LXC_ADDR="10.0.3.1"
LXC_NETMASK="255.255.255.0"
LXC_NETWORK="10.0.3.0/24"
LXC_DHCP_RANGE="10.0.3.2,10.0.3.254"
LXC_DHCP_MAX="253"
# Uncomment the next line if you'd like to use a conf-file for the lxcbr0
# dnsmasq.  For instance, you can use 'dhcp-host=mail1,10.0.3.100' to have
# container 'mail1' always get ip address 10.0.3.100.
#LXC_DHCP_CONFILE=/etc/lxc/dnsmasq.conf

# Uncomment the next line if you want lxcbr0's dnsmasq to resolve the .lxc
# domain.  You can then add "server=/lxc/10.0.3.1' (or your actual
$LXC_ADDR)
# to your system dnsmasq configuration file (normally /etc/dnsmasq.conf,
# or /etc/NetworkManager/dnsmasq.d/lxc.conf on systems that use
NetworkManager).
# Once these changes are made, restart the lxc-net and network-manager
services.
# 'container1.lxc' will then resolve on your host.
#LXC_DOMAIN="lxc"

Thank you for a great and clean distribution!

Saman