5 ms·

I once wrote a post about Docker in unprivileged LXC on ZFS [1]. The post is a little bit outdated, as it is much simpler today with ZFS 2.2.0, which is nativel

I once wrote a post about Docker in unprivileged LXC on ZFS [1]. The post is a little bit outdated, as it is much simpler today with ZFS 2.2.0, which is natively supported. There's also a more recent post that shows how to run rootless docker [2], with updated uid-mappings. Both may be helpful, have a look. The advantage of using LXC for me is resource consumption and separation of concerns. I have about 35 Docker containers spread over 10 LXCs. The average CPU use is 1-3% and I only need about 10GB of memory (even with running bigger containers like Nextcloud, Gitlab, mailcow-dockerized etc.). With docker-compose.yml's, automatic updates are easy and robust. [1]: https://du.nkel.dev/blog/2021-03-25_proxmox_docker/ https://du.nkel.dev/blog/2021-03-25_proxmox_docker/ [2]: https://du.nkel.dev/blog/2023-12-12_mastodon-docker-rootless/ https://du.nkel.dev/blog/2023-12-12_mastodon-docker-rootless...

dusanh 3y ago
Thank you, this made me realize I assigned a wrong (too little) number for uids. It did not fix my issue however. I still see (dev) $ podman info ERRO[0000] running `/usr/bin/newuidmap 3427 0 1000 1 1 100000 65536`: newuidmap: open of uid_map failed: Permission denied Error: cannot set up namespace using "/usr/bin/newuidmap": exit status 1 I tried a solution I found on Red Hat's Customer Portal: (root) # setcap cap_setuid+ep /usr/bin/newuidmap (root) # setcap cap_setgid+ep /usr/bin/newgidmap Also did not work. I can run (root) # podman info just fine as root. This leads me to believe there are some other problems with my non-root user permissions. EDIT: It probably makes little sense, to run rootless on top of an already unprivileged LXC. I just wanted to give vscode server it's own non-root user in there. Oh well...
- Helmut10001 3y ago
  Yes, just start from scratch and provide uid-mappings from the beginning. Looks like those uids were set from before adding the mappings and it is trying to access uids it is not allowed to access. I used rootless docker in rootless lxc because the Postgres Docker (e.g.) will try to setup a non-root user by default. In a rootless LXC, this means it will try to access very large uids (>100000), which are not available, unless explicitly prepared.
  - dusanh 3y ago
    That actually did not do anything different for me. I did the following: 1) Created a new LXC. 2) As root, I created a new user "devel" 3) For the "devel" user set both subuid and subgid to devel:100000:65536 4) As root, installed podman 5) In another SSH session, logged in as "devel" and ran "podman version" Same error as before. This is in a Debian 12 LXC running on Proxmox.
    - Helmut10001 3y ago
      I am also using Docker in Debian 12 LXC on Proxmox. I am not sure what has gone wrong here.
      - dusanh 3y ago
        Was there anything extra you have done on the Host itself?
        Helmut10001 3y ago
        I described the full process here [1]. The only thing that seems to differ is podman for you. Ah, I see: > 4) As root, installed podman I installed docker as the non-root user. See my Mastodon post, there's a specific procedure to install Docker in a user namespace ("devel" in your case). [1]: https://du.nkel.dev/blog/2021-03-25_proxmox_docker/ https://du.nkel.dev/blog/2021-03-25_proxmox_docker/

dusanh 3y ago

Thank you, this made me realize I assigned a wrong (too little) number for uids. It did not fix my issue however. I still see (dev) $ podman info ERRO[0000] running `/usr/bin/newuidmap 3427 0 1000 1 1 100000 65536`: newuidmap: open of uid_map failed: Permission denied Error: cannot set up namespace using "/usr/bin/newuidmap": exit status 1 I tried a solution I found on Red Hat's Customer Portal: (root) # setcap cap_setuid+ep /usr/bin/newuidmap (root) # setcap cap_setgid+ep /usr/bin/newgidmap Also did not work. I can run (root) # podman info just fine as root. This leads me to believe there are some other problems with my non-root user permissions. EDIT: It probably makes little sense, to run rootless on top of an already unprivileged LXC. I just wanted to give vscode server it's own non-root user in there. Oh well...

Helmut10001 3y ago
Yes, just start from scratch and provide uid-mappings from the beginning. Looks like those uids were set from before adding the mappings and it is trying to access uids it is not allowed to access. I used rootless docker in rootless lxc because the Postgres Docker (e.g.) will try to setup a non-root user by default. In a rootless LXC, this means it will try to access very large uids (>100000), which are not available, unless explicitly prepared.
- dusanh 3y ago
  That actually did not do anything different for me. I did the following: 1) Created a new LXC. 2) As root, I created a new user "devel" 3) For the "devel" user set both subuid and subgid to devel:100000:65536 4) As root, installed podman 5) In another SSH session, logged in as "devel" and ran "podman version" Same error as before. This is in a Debian 12 LXC running on Proxmox.
  - Helmut10001 3y ago
    I am also using Docker in Debian 12 LXC on Proxmox. I am not sure what has gone wrong here.
    - dusanh 3y ago
      Was there anything extra you have done on the Host itself?
      - Helmut10001 3y ago
        I described the full process here [1]. The only thing that seems to differ is podman for you. Ah, I see: > 4) As root, installed podman I installed docker as the non-root user. See my Mastodon post, there's a specific procedure to install Docker in a user namespace ("devel" in your case). [1]: https://du.nkel.dev/blog/2021-03-25_proxmox_docker/ https://du.nkel.dev/blog/2021-03-25_proxmox_docker/