Mount LXD guest directory without destroying data and ownership

Question

I've created a LXD guest for hosting my webserver, and to easily access the document root, I did:

lxc config device add guest sharedhtml disk path=/document/root/ source=/home/$USER/public_html

This did two things:

• completely replaced /document/root/ with public_html/ (all default webserver files are gone, as public-html is empty)
• destroyed /document/root ownership settings; the directory and the files I create in public_html/ is now owned by nobody:nogroup

As I understand, this is more like a reverse mount; instead of mounting the guest's directory, the host's directory is reverse mounted forcefully into the guest.

How may I mount guest directory in host without destroying existing contents make it so that the changes inherit the guest directory's ownership settings?

Bonus: how do I remove the device that's mounting the directory?

Answer 1

To remove the entry you created, the following should do the trick:

lxc config device remove sharedhtml

Now it looks like LXD did exactly what it was supposed to do in this case. The command you ran instructs LXD to mount /home/$USER/public_html from the host into the container as the container's /document/root

As LXD containers run using a different uid/gid map from the host, the ownership of the files from the host cannot be rendered inside the container, leading to the kernel showing you those as nobody:nogroup.

There is no mechanism to have a path inside the container be mounted on the host and it's unlikely we'd add such a thing any time soon.

Anyway, in your case, what you probably ought to be doing is have a storage path on the host for your web server's files, then have this setup as a device disk entry in LXD to have it mounted in the right location inside the container.

Then set POSIX ACLs on the host so that both the container's uid/gid can access the files and your own user too.

In most cases, the container uid and gid on the host will be 165536 + uid or gid inside the container. An easier way to figure that out is to have the path on the host be world writable temporarily, then write something to the path inside the container and confirm who shows up as the owner on the host.