Contents
Unprivileged LXC
What are unprivileged Linux containers (LXC)? Unprivileged containers are considered to be more secure and confidential than privileged containers. When an unprivileged container is running, the root UID of the container is mapped to a non-root UID on the host system. This makes it difficult for an attacker to gain root privileges to the underlying host even if they crack the container. In short, if an attacker manages to compromise your container through a known software vulnerability, they will immediately find that they cannot obtain any host permissions. Therefore, unprivileged containers are designed to limit the root user permissions of LXC, thereby protecting the security of the host machine. However, this will also cause some inconveniences. For example, when we want to mount an SMB shared NAS directory using the mount command in PVE's unprivileged LXC like in normal Linux, we will fail because of permission errors:
mount error(1): Operation not permitted lxcSo what should we do if we want to mount an external SMB directory in this case? We can only go in a circle: first mount the SMB directory to the pve host, and then use the pve host to map the mounted directory to the unprivileged LXC container.
Note: The following operations are run on the pve host
Mount the shared directory that needs to be mounted to LXC to the PVE host first
Install the cifs-utils package
apt-get install cifs-utilsCreate a mount directory
mkdir -p /mnt/share/Run the mount command
mount -o username=account,password=password//your-ip/shared directory/mnt/shareMount the PVE host directory into the unprivileged LXC container
pct set "CT id" -mp0 /mnt/share/,mp=/mnt/shareIf you want to mount other directories later, they will be mp1, mp2, and so on.
Restart the LXC container and check
ls /mnt/shareIf you can see the contents of the SMB directory, it means success.
Note: If you want pve to automatically load the SMB directory when it starts, you need to edit /etc/fstab and add the following content:
//your-ip/shared directory/mnt/share cifs defaults,username=account,password=passwordThis can be found in my other article:Debian series automatically mount SMB at startup