<div dir="ltr"><div>Using ubuntu the download template creates a container that will work, IF launched from a 'login' level shell (IE: ssh to the lxc account).</div><div><br></div><div>Following (almost exactly) a possible example by Serge Hallyn from this same list around Thu, 21 Aug 2014 22:25:48 -0700<br>
</div><div>I've created:</div><div><br></div><div>/etc/init/lxc-user-auto.conf<br></div><div><div>description "start unpriv containers"</div><div>start on started lxc<br></div><div>script<br></div><div> USERS="lxc"</div>
<div> for u in $USERS; do<br></div><div> cgm create all lxc$u</div><div> cgm chown all lxc$u $(id -u $u) $(id -g $u)</div><div> lxc-autostart -L -P /home/$u/.local/share/lxc | while read line; do</div><div> set -- $line</div>
<div> /usr/bin/lxc-start-unprivileged lxc$u $u $1</div><div> sleep $2</div><div> done</div><div> done</div><div>end script</div></div><div><br></div><div><br></div><div>/usr/bin/lxc-start-unprivileged<br></div><div>
<div>
cgm movepid all "$1"</div><div>sudo -u "$2" -- lxc-start -P /home/"$2"/.local/share/lxc -o/home/"$2"/"$3".log -lDEBUG -n "$3" -d</div></div><div><br></div><div>
<br>
</div><div><div>mount | grep cgroup</div><div>none on /sys/fs/cgroup type tmpfs (rw)</div><div>systemd on /sys/fs/cgroup/systemd type cgroup (rw,noexec,nosuid,nodev,none,name=systemd)</div></div><div><br></div><div><div>
/sys/fs/cgroup/</div>
<div>/sys/fs/cgroup/systemd</div><div>/sys/fs/cgroup/systemd/user</div><div>/sys/fs/cgroup/systemd/user/0.user</div><div>/sys/fs/cgroup/systemd/user/0.user/1.session</div><div>/sys/fs/cgroup/systemd/user/0.user/1.session/notify_on_release</div>
<div>/sys/fs/cgroup/systemd/user/0.user/1.session/tasks</div><div>/sys/fs/cgroup/systemd/user/0.user/1.session/cgroup.clone_children</div><div>/sys/fs/cgroup/systemd/user/0.user/1.session/cgroup.event_control</div><div>/sys/fs/cgroup/systemd/user/0.user/1.session/cgroup.procs</div>
<div>/sys/fs/cgroup/systemd/user/0.user/notify_on_release</div><div>/sys/fs/cgroup/systemd/user/0.user/tasks</div><div>/sys/fs/cgroup/systemd/user/0.user/cgroup.clone_children</div><div>/sys/fs/cgroup/systemd/user/0.user/cgroup.event_control</div>
<div>/sys/fs/cgroup/systemd/user/0.user/cgroup.procs</div><div>/sys/fs/cgroup/systemd/user/notify_on_release</div><div>/sys/fs/cgroup/systemd/user/tasks</div><div>/sys/fs/cgroup/systemd/user/cgroup.clone_children</div><div>
/sys/fs/cgroup/systemd/user/cgroup.event_control</div><div>/sys/fs/cgroup/systemd/user/cgroup.procs</div><div>/sys/fs/cgroup/systemd/lxclxc</div><div>/sys/fs/cgroup/systemd/lxclxc/notify_on_release</div><div>/sys/fs/cgroup/systemd/lxclxc/tasks</div>
<div>/sys/fs/cgroup/systemd/lxclxc/cgroup.clone_children</div><div>/sys/fs/cgroup/systemd/lxclxc/cgroup.event_control</div><div>/sys/fs/cgroup/systemd/lxclxc/cgroup.procs</div><div>/sys/fs/cgroup/systemd/release_agent</div>
<div>/sys/fs/cgroup/systemd/notify_on_release</div><div>/sys/fs/cgroup/systemd/tasks</div><div>/sys/fs/cgroup/systemd/cgroup.sane_behavior</div><div>/sys/fs/cgroup/systemd/cgroup.clone_children</div><div>/sys/fs/cgroup/systemd/cgroup.event_control</div>
<div>/sys/fs/cgroup/systemd/cgroup.procs</div><div>/sys/fs/cgroup/cgmanager</div><div>/sys/fs/cgroup/cgmanager/sock</div></div><div><br></div><div><br></div><div><br></div><div><div> lxc-start 1408851088.621 INFO lxc_start_ui - using rcfile /home/lxc/.local/share/lxc/test/config</div>
<div> lxc-start 1408851088.621 INFO lxc_utils - XDG_RUNTIME_DIR isn't set in the environment.</div><div> lxc-start 1408851088.621 INFO lxc_confile - read uid map: type u nsid 0 hostid 400000 range 65536</div>
<div> lxc-start 1408851088.621 INFO lxc_confile - read uid map: type g nsid 0 hostid 400000 range 65536</div><div> lxc-start 1408851088.622 WARN lxc_log - lxc_log_init called with log already initialized</div>
<div> lxc-start 1408851088.625 INFO lxc_lsm - LSM security driver AppArmor</div><div> lxc-start 1408851088.625 INFO lxc_utils - XDG_RUNTIME_DIR isn't set in the environment.</div><div> lxc-start 1408851088.626 DEBUG lxc_conf - allocated pty '/dev/pts/3' (5/6)</div>
<div> lxc-start 1408851088.626 DEBUG lxc_conf - allocated pty '/dev/pts/4' (7/8)</div><div> lxc-start 1408851088.626 DEBUG lxc_conf - allocated pty '/dev/pts/6' (9/10)</div><div> lxc-start 1408851088.626 DEBUG lxc_conf - allocated pty '/dev/pts/7' (11/12)</div>
<div> lxc-start 1408851088.626 INFO lxc_conf - tty's configured</div><div> lxc-start 1408851088.626 DEBUG lxc_start - sigchild handler set</div><div> lxc-start 1408851088.626 DEBUG lxc_console - no console peer</div>
<div> lxc-start 1408851088.629 INFO lxc_monitor - using monitor sock name lxc/101c4d4958dfe913//home/lxc/.local/share/lxc</div><div> lxc-start 1408851088.895 INFO lxc_start - 'test' is initialized</div>
<div> lxc-start 1408851088.902 DEBUG lxc_start - Not dropping cap_sys_boot or watching utmp</div><div> lxc-start 1408851088.902 INFO lxc_start - Cloning a new user namespace</div><div> lxc-start 1408851088.903 INFO lxc_cgroup - cgroup driver cgmanager initing for test</div>
<div> lxc-start 1408851088.904 ERROR lxc_cgmanager - call to cgmanager_create_sync failed: invalid request</div><div> lxc-start 1408851088.904 ERROR lxc_cgmanager - Failed to create hugetlb:test</div><div>
lxc-start 1408851088.904 ERROR lxc_cgmanager - Error creating cgroup hugetlb:test</div><div> lxc-start 1408851088.904 INFO lxc_cgmanager - cgroup removal attempt: hugetlb:test did not exist</div><div> lxc-start 1408851088.904 INFO lxc_cgmanager - cgroup removal attempt: perf_event:test did not exist</div>
<div> lxc-start 1408851088.905 INFO lxc_cgmanager - cgroup removal attempt: blkio:test did not exist</div><div> lxc-start 1408851088.905 INFO lxc_cgmanager - cgroup removal attempt: freezer:test did not exist</div>
<div> lxc-start 1408851088.905 INFO lxc_cgmanager - cgroup removal attempt: devices:test did not exist</div><div> lxc-start 1408851088.906 INFO lxc_cgmanager - cgroup removal attempt: memory:test did not exist</div>
<div> lxc-start 1408851088.906 INFO lxc_cgmanager - cgroup removal attempt: cpuacct:test did not exist</div><div> lxc-start 1408851088.906 INFO lxc_cgmanager - cgroup removal attempt: cpu:test did not exist</div>
<div> lxc-start 1408851088.906 INFO lxc_cgmanager - cgroup removal attempt: cpuset:test did not exist</div><div> lxc-start 1408851088.907 INFO lxc_cgmanager - cgroup removal attempt: name=systemd:test did not exist</div>
<div> lxc-start 1408851088.907 ERROR lxc_start - failed creating cgroups</div><div> lxc-start 1408851088.907 INFO lxc_utils - XDG_RUNTIME_DIR isn't set in the environment.</div><div> lxc-start 1408851088.907 ERROR lxc_start - failed to spawn 'test'</div>
<div> lxc-start 1408851088.907 INFO lxc_utils - XDG_RUNTIME_DIR isn't set in the environment.</div><div> lxc-start 1408851088.907 INFO lxc_utils - XDG_RUNTIME_DIR isn't set in the environment.</div>
<div> lxc-start 1408851088.907 WARN lxc_commands - command get_init_pid failed to receive response</div><div> lxc-start 1408851093.912 ERROR lxc_start_ui - The container failed to start.</div><div> lxc-start 1408851093.912 ERROR lxc_start_ui - To get more details, run the container in foreground mode.</div>
<div> lxc-start 1408851093.912 ERROR lxc_start_ui - Additional information can be obtained by setting the --logfile and --log-priority options.</div></div><div><br></div><div><br></div><div>These failures mirror my much of my experience when attempting to start a container on Debian, as well as any other place (Ubuntu included) when trying to start a container via bare su / sudo.</div>
<div><br></div><div><br></div><div>If I instead log in via ssh...</div><div><br></div><div><div><div>/sys/fs/cgroup/systemd/user/1000.user</div><div>/sys/fs/cgroup/systemd/user/1000.user/2.session</div><div>/sys/fs/cgroup/systemd/user/1000.user/2.session/notify_on_release</div>
<div>/sys/fs/cgroup/systemd/user/1000.user/2.session/tasks</div><div>/sys/fs/cgroup/systemd/user/1000.user/2.session/cgroup.clone_children</div><div>/sys/fs/cgroup/systemd/user/1000.user/2.session/cgroup.event_control</div>
<div>/sys/fs/cgroup/systemd/user/1000.user/2.session/cgroup.procs</div><div>/sys/fs/cgroup/systemd/user/1000.user/notify_on_release</div><div>/sys/fs/cgroup/systemd/user/1000.user/tasks</div><div>/sys/fs/cgroup/systemd/user/1000.user/cgroup.clone_children</div>
<div>/sys/fs/cgroup/systemd/user/1000.user/cgroup.event_control</div><div>/sys/fs/cgroup/systemd/user/1000.user/cgroup.procs</div></div></div><div><br></div><div><br></div><div>Then </div><div><br></div><div><div>lxc@whatever:~$ lxc-start -d -n mc</div>
</div><div><br></div><div>works.</div><div><div><br></div></div><div><br></div><div>What type of cgroup manipulation or modifications to cgmanager are necessary to automatically start an unprivileged container at boot?</div>
</div>