Unprivileged LXC

What is an unprivileged Linux container (LXC)? Unprivileged containers are considered safer and more secure than privileged containers. When an unprivileged container runs, the container's root UID is mapped to a non-root UID on the host system. This makes it difficult for an attacker to gain root privileges on the underlying host even if they compromise the container. In short, if an attacker manages to compromise your container through a known software vulnerability, they will immediately find themselves unable to obtain any host privileges. Therefore, unprivileged containers are inherently designed to limit the root user privileges of LXC, thereby protecting the security of the host. However, this also causes some inconveniences. For example, when we want to use the mount command to mount an SMB-shared NAS directory in an unprivileged LXC in PVE just like in normal Linux, it will fail with a permission error:

mount error(1): Operation not permitted lxc

So what should we do if we want to mount an external SMB directory in this case? We have to take a detour: first mount the SMB directory to the PVE host, and then use the PVE host to map its mounted directory into the unprivileged LXC container.

Note: The following operations are run on the PVE host

First mount the shared directory that needs to be mounted to the LXC onto the PVE host

Install the cifs-utils package

apt-get install cifs-utils

Create the mount directory

mkdir -p  /mnt/share/

Run the mount command

mount -o username=账号,password=密码 //your-ip/共享目录 /mnt/share

Mount the PVE host directory into the unprivileged LXC container

pct set "CT id" -mp0  /mnt/share/,mp=/mnt/share

If you need to mount other directories later, they will be mp1, mp2, etc., in sequence.

Check after restarting the LXC container

ls /mnt/share

If you see the contents of the SMB directory, it means success.

Note: If you want PVE to automatically load the SMB directory on boot, you need to edit /etc/fstab and add the following content:

//your-ip/共享目录 /mnt/share cifs defaults,username=账号,password=密码

You can refer to my other article for this:Debian Series: Automatically Mount SMB on Boot