4

First a bit of information about my configuration:

  • Ubuntu 15.10
  • ZFS pool created
  • LXC containers stored in pool/lxc
  • Dataset created in pool/mydataset owned by user1

Now I need one of the containers to access the files/folders in pool/mydataset. I tried the following:

  • Created a user user1 inside the container
  • Edited pool/lxc/mycontainer/config and added:

    lxc.mount.entry = /pool/mydataset mnt/mydataset none rw,bind 0 0
    

When I start the container the dataset is mounted, but ls -la /mnt/mydataset in the container shows nobody:nogroup instead of user1:user1, which means all files are read-only.

Any idea how to get the correct permissions in the mounted directory?

4

If indeed mycontainer is unprivileged, then its owner might not have access to the path /pool/mydataset. Users in unprivileged containers have their uid offset on the host by the container-owner uid, so user1 inside the container isn't the same as user1 on the host.

  1. You can check what user on the host owns the container with sudo ls -l /pool/lxc | grep mycontainer (sudo might not be required, depending on /pool/lxc's permissions, but ls should be safe enough to run as root either way. Going forward, omit sudo where desirable if permissions make that possible). For example, I get

    drwxr-xr-x 4 100000 100000    5 Apr 22 11:37 mycontainer
    

    showing that the uid and gid of the container's owner is 100000 (we see a uid instead of a name since the user doesn't exist on the host).

  2. Test /pool/mydataset's permissions with sudo ls -l /pool | grep mydataset (or sudo ls -l /pool/mydataset for its contents).

    If you want the files to be writable from within the container, you just have to make sure whichever user inside mycontainer you want to be able to write to /pool/mydataset has permissions to do so on the host. E.g., root on mycontainer has uid 100000 on host, and if user1 in mycontainer has uid 1001 (test with id user1 from within the container) then on the host its uid would be 101001.


You might do that by allowing everyone on the host to write to /pool/mydataset with

sudo chmod -R o+w /pool/mydataset

(note: this will add permissions recursively inside /pool/mydataset), or perhaps better to make sure users in group user1 have write permissions (set it recursively with sudo chmod -R g+w /pool/mydataset if not), then add the owner of the container to group user1 with

sudo usermod -a -G user1 <username>

(In my case above, we saw that no user on the host owns the container, so we should first create a user with uid and gid 100000 with

adduser --no-create-home --uid 100000 --disabled-password --disabled-login <username>

Of course, you might wish to give permissions only to user1 inside the container, so create a user with its host uid and add that to group user1 on host, e.g., 101001.)

You can also go nuclear and give ownership of /pool/mydataset to mycontainer's root with

sudo chown -R 100000:100000 /pool/mydataset

but that could mess with other users on host accessing the data.


Once you've done that, the mount you set should allow write permissions inside mycontaier, as desired.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.