Apologies for the title, the setup is actually quite simple. I have a host with a user called
oli and a directory called
oli can read-write-execute in. Within that I have a privileged LXC container running under root.
/media/steve/incoming is mounted in the container as
lxc.mount.entry = /media/steve/incoming incoming none bind 0 0
Within the container I have a webserver running as
www-data. It needs to be able to write to
What are my options here? I can think of a few ideas but they either have pretty serious downsides or I don't know how to implement them:
I could change my daemon to run as root within the container but I'd rather it didn't. Root write files strangely in the directory (they come out as
root:oli-owned on the host).
Can I map container-
www-datato have host-
oliprivs on the filesystem? Would this grant them access to the host?
oliis not an unprivaliged account. It can do real damage.
Can I just bind-mount it in such a way that anybody in the container can write to /incoming and the access looks like it's coming from host-
ACL any help here?