LXC unprivileged container: apt-get fails to download anything inside

Question

I'm running Ubuntu Xenial and set up simple unprivileged user container from template (also Xenial).

When I attach inside and try to just do upgrade or install anything 'apt-get' fails with following messages:

root@c1:/# apt-get update
E: setgroups 65534 failed - setgroups (22: Invalid argument)
E: setegid 65534 failed - setegid (22: Invalid argument)
Reading package lists... Done
E: setgroups 65534 failed - setgroups (22: Invalid argument)
E: setegid 65534 failed - setegid (22: Invalid argument)
E: Method gave invalid 400 URI Failure message: Failed to setgroups - setgroups (22: Invalid argument)
E: Method gave invalid 400 URI Failure message: Failed to setgroups - setgroups (22: Invalid argument)
E: Method http has died unexpectedly!
E: Sub-process http returned an error code (112)
E: Method http has died unexpectedly!
E: Sub-process http returned an error code (112)

So the question is - what's going on here?

Answer 1

By default user '_apt' has uid=65534, but lxc (and host) is configured to allow only 10000 subuids and subgids for user (and therefore unprivileged containers).

One solution might be to set user '_apt' uid inside container below 10000.

The other way is to up subuids/subgids limit on the host. Use command sudo usermod --add-subuids 260000-325536 --add-subgids 260000-325536 $USER for user that owns container, and ensure lxc user containers are configured with:

lxc.id_map = u 0 260000 65536
lxc.id_map = g 0 260000 65536

Answer 2

I got a similar error when building my docker container. Turns out that I forgot to write sudo before my docker build command.

Answer 3

In my case, @Alwin's solution cannot be used as I'm running rootless. Regarding @dilettant solution, there isn't lxc in my environment, nevertheless replaced _apt's uid using sed -i 's/_apt:x:100:65534/_apt:x:100:100/g' /etc/passwd. Also followed @cheshirekow's comment and in my case /proc/<pid>/setgroups contained allow and not deny.

I solved it indirectly by installing brew as an alternative using:

RUN /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
ENV PATH=$MVND_HOME/home/linuxbrew/.linuxbrew/bin:$PATH