2 ms·

> " [..] which are just shell scripts for bootstrapping and configuring your container and pretty common between distros. " I find it a big advantage that this

> " [..] which are just shell scripts for bootstrapping and configuring your container and pretty common between distros. " I find it a big advantage that this builds the containers basically from scratch and you only have to trust the distro and not any other parties. I'm always feeling uneasy with images which are hard to inspect and whose provenance is opaque and potentially involved multiple parties. That, combined with running them unprivileged, should make a fairly secure system. Unfortunately I had great difficulty to create an unprivileged Debian LXC container with this method. If I remember correctly you have to create the privileged container first and then use a tool to fix-up uid and gid. If anyone knows an easier way to do it, I would be grateful to know. EDIT: I think I used the following to create the container: lxc-create -n <name> -t debian -- -r stretch It uses deboostrap for the build.

foresto 4y ago
I don't recall having to do any uid/gid fixup last time I made an unprivileged container. I did have to prepare the unprivileged host account, of course, by setting its subordinate uids/gids (/etc/sub?id) and virtual network interface limit (/etc/lxc/lxc-usernet). To create the container, I did this: lxc-create -t download -n <name> -- -d debian -r bullseye -a amd64 Note that this runs the 'download' template, which (IIRC) is better suited to unprivileged containers than the 'debian' template is. The 'download' template will list its available distros if you do this: lxc-create -t download -n <name> -- --list Note that some versions of the 'download' template may fail with a keyserver error because sks-keyservers.net died somewhat recently. Workaround: DOWNLOAD_KEYSERVER=hkp://keyserver.ubuntu.com lxc-create ... https://github.com/lxc/lxc/issues/3894 https://github.com/lxc/lxc/issues/3894

foresto 4y ago

I don't recall having to do any uid/gid fixup last time I made an unprivileged container. I did have to prepare the unprivileged host account, of course, by setting its subordinate uids/gids (/etc/sub?id) and virtual network interface limit (/etc/lxc/lxc-usernet). To create the container, I did this: lxc-create -t download -n <name> -- -d debian -r bullseye -a amd64 Note that this runs the 'download' template, which (IIRC) is better suited to unprivileged containers than the 'debian' template is. The 'download' template will list its available distros if you do this: lxc-create -t download -n <name> -- --list Note that some versions of the 'download' template may fail with a keyserver error because sks-keyservers.net died somewhat recently. Workaround: DOWNLOAD_KEYSERVER=hkp://keyserver.ubuntu.com lxc-create ... https://github.com/lxc/lxc/issues/3894 https://github.com/lxc/lxc/issues/3894