Devuan bug report logs - #502
LXC unprivileged containers

Package: lxc; Maintainer for lxc is (unknown); Source for lxc is src:lxc.

Reported by: Saman Behnam <sbehnam73@googlemail.com>

Date: Mon, 3 Aug 2020 01:18:01 UTC

Severity: normal

Tags: debian, moreinfo

Subject: bug#502: LXC unprivileged containers
Reply-To: Saman Behnam <sbehnam73@googlemail.com>, 502@bugs.devuan.org
Resent-From: Saman Behnam <sbehnam73@googlemail.com>
Resent-To: devuan-bugs@lists.dyne.org
Resent-CC: devuan-dev@lists.dyne.org
Resent-Date: Mon, 03 Aug 2020 01:18:01 +0000
Resent-Message-ID: <handler.502.B.159641700623566@bugs.devuan.org>
Resent-Sender: owner@bugs.devuan.org
MIME-Version: 1.0
From: Saman Behnam <sbehnam73@googlemail.com>
Date: Sun, 2 Aug 2020 19:04:11 -0600
Message-ID: <CAC1V7=ywTyGzvCP86XwN03RJRre5n_PsUQm_mr2wLxr2YrpDHA@mail.gmail.com>
To: submit@bugs.devuan.org
Content-Type: multipart/alternative; boundary="0000000000004e9f1405abeeb811"

[Message part 1 (text/plain, inline)]

Package: lxc

Version: 1:3.1.0+really3.0.3-8

System: Devuan Beowulf

After a clean install of lxc package containers do not work unless i have
to do the following.

add to sysctl.conf
##################
# LXC Devuan unpriviliged
# containers
kernel.unprivileged_userns_clone = 1

# LXC kernel setting (optional)
# Makes dmesg work for
# non root users.
kernel.dmesg_restrict = 0

create and configure
####################
/etc/lxc/lxc-usernet
/etc/default/lxc-net

I suggest adding a file with above settings that goes to
"/etc/sysctl.d"
And make
"sysctl.conf"
include
"/etc/sysctl.d"

Also add files:
/etc/lxc/lxc-usernet
/etc/default/lxc-net

~ $ cat /etc/lxc/lxc-usernet
# USERNAME TYPE BRIDGE COUNT
# examplecontainer1 veth lxcbr0 1
# examplecontainer2 veth lxcbr0 2

~ $ cat /etc/default/lxc-net
# This file is auto-generated by lxc.postinst if it does not
# exist.  Customizations will not be overridden.
# Leave USE_LXC_BRIDGE as "true" if you want to use lxcbr0 for your
# containers.  Set to "false" if you'll use virbr0 or another existing
# bridge, or mavlan to your host's NIC.
USE_LXC_BRIDGE="false"

# If you change the LXC_BRIDGE to something other than lxcbr0, then
# you will also need to update your /etc/lxc/default.conf as well as the
# configuration (/var/lib/lxc/<container>/config) for any containers
# already created using the default config to reflect the new bridge
# name.
# If you have the dnsmasq daemon installed, you'll also have to update
# /etc/dnsmasq.d/lxc and restart the system wide dnsmasq daemon.
LXC_BRIDGE="lxcbr0"
LXC_ADDR="10.0.3.1"
LXC_NETMASK="255.255.255.0"
LXC_NETWORK="10.0.3.0/24"
LXC_DHCP_RANGE="10.0.3.2,10.0.3.254"
LXC_DHCP_MAX="253"
# Uncomment the next line if you'd like to use a conf-file for the lxcbr0
# dnsmasq.  For instance, you can use 'dhcp-host=mail1,10.0.3.100' to have
# container 'mail1' always get ip address 10.0.3.100.
#LXC_DHCP_CONFILE=/etc/lxc/dnsmasq.conf

# Uncomment the next line if you want lxcbr0's dnsmasq to resolve the .lxc
# domain.  You can then add "server=/lxc/10.0.3.1' (or your actual
$LXC_ADDR)
# to your system dnsmasq configuration file (normally /etc/dnsmasq.conf,
# or /etc/NetworkManager/dnsmasq.d/lxc.conf on systems that use
NetworkManager).
# Once these changes are made, restart the lxc-net and network-manager
services.
# 'container1.lxc' will then resolve on your host.
#LXC_DOMAIN="lxc"

Thank you for a great and clean distribution!

Saman

[Message part 2 (text/html, inline)]

Send a report that this bug log contains spam.

Devuan bug report logs - #502 LXC unprivileged containers

Devuan bug report logs - #502
LXC unprivileged containers