<div dir="ltr">Hi Fajar,<div><br></div><div>Thank you for your detailed answer. However, I searched a solution a little bit today, and I am still stuck.</div><div><br></div><div>For "userpace", I meant "userspace", of course. Sorry for mistyped.</div><div><br></div><div><br></div><div>Here are what I checked:</div><div><br></div><div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div>LXC tests in userspace</div><div><br></div><div>1. [VirtualBox] Fresh Ubuntu 14.04.2 server amd64</div><div> creation OK, starting not OK</div><div> without cgmanager, with libpam-systemd</div><div>2. [VirtualBox] Fresh Ubuntu 14.04.4 amd64 Desktop ( from <a href="http://releases.ubuntu.com/14.04/">http://releases.ubuntu.com/14.04/</a> )</div><div> same behaviour as above.</div><div>3. Ubuntu 14.04.4 LTS, Trusty Tahr [bare metal]</div><div> Created through a basic FAI template + post-configure with SaltStack</div><div> creation not OK, starting not OK (report from first mail)</div><div> without cgmanager, with libpam-systemd</div><div>4. Ubuntu 16.04 [bare metal]</div><div> creation OK, starting OK</div></blockquote><br></div><div><br></div><div>I did not try nested container.</div><div><br></div><div>The start error in [1] VirtualBox is:</div><div><br></div><div><div> lxc-start 20160513133526.251 ERROR lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1289 - Operation not permitted - Error remounting /usr/lib/x86_64-linux-gnu/lxc/sys/fs/cgroup/systemd read-only</div><div> lxc-start 20160513133526.252 ERROR lxc_conf - conf.c:lxc_mount_auto_mounts:781 - Operation not permitted - error mounting /sys/fs/cgroup</div><div> lxc-start 20160513133526.252 ERROR lxc_conf - conf.c:lxc_setup:3746 - failed to setup the automatic mounts for 'u1'</div><div> lxc-start 20160513133526.252 ERROR lxc_start - start.c:do_start:819 - failed to setup the container</div><div> lxc-start 20160513133526.252 ERROR lxc_sync - sync.c:__sync_wait:52 - An error occurred in another process (expected sequence number 2)</div><div> lxc-start 20160513133526.252 ERROR lxc_start - start.c:__lxc_start:1329 - failed to spawn 'u1'</div><div> lxc-start 20160513133531.764 ERROR lxc_start_ui - lxc_start.c:main:344 - The container failed to start.</div><div> lxc-start 20160513133531.765 ERROR lxc_start_ui - lxc_start.c:main:346 - To get more details, run the container in foreground mode.</div><div> lxc-start 20160513133531.766 ERROR lxc_start_ui - lxc_start.c:main:348 - Additional information can be obtained by setting the --logfile and --logpriority options.</div></div><div><br></div><div><br></div><div>The start error in [2] VirtualBox is :</div><div><div> lxc-start 20160513161811.814 ERROR lxc_start - start.c:print_top_failing_dir:112 - Permission denied - could not access /home/maintenance/.local. Please grant it 'x' access, or add an ACL for the container root.</div><div> lxc-start 20160513161811.814 ERROR lxc_sync - sync.c:__sync_wait:52 - An error occurred in another process (expected sequence number 2)</div><div> lxc-start 20160513161811.814 ERROR lxc_start - start.c:__lxc_start:1329 - failed to spawn 'u1'</div><div> lxc-start 20160513161817.339 ERROR lxc_start_ui - lxc_start.c:main:344 - The container failed to start.</div><div> lxc-start 20160513161817.340 ERROR lxc_start_ui - lxc_start.c:main:346 - To get more details, run the container in foreground mode.</div><div> lxc-start 20160513161817.340 ERROR lxc_start_ui - lxc_start.c:main:348 - Additional information can be obtained by setting the --logfile and --logpriority options.</div></div><div><br></div><div>The information you gave me about /proc/self/cgroup is helpful, however I can not have the correct file at any point (for a lxc user). I am not using sudo at all, except for the lxc install step.</div><div><br></div><div>I would be happy to move to Ubuntu 16.04 for hosting my lxc containers, however, it is not possible right now, because it would mean to change all my configuration and templates (specially the FAI one) on my servers (even if I plan to do so in the future).</div><div><br></div><div>Regards,</div><div><br>Remy</div></div><div class="gmail_extra"><br><div class="gmail_quote">2016-05-13 11:19 GMT+02:00 Fajar A. Nugraha <span dir="ltr"><<a href="mailto:list@fajar.net" target="_blank">list@fajar.net</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><span class="">On Fri, May 13, 2016 at 3:05 PM, Rémy Dernat <span dir="ltr"><<a href="mailto:remy.d1@gmail.com" target="_blank">remy.d1@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr"><span style="font-size:12.8px">Hi,</span><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">I am new on lxc, although, I used other container technologies in the past. </div><div style="font-size:12.8px">I choose to switch to lxc for the userspace capabilties. </div></div></blockquote><div><br></div></span><div>How do you define "userpace"?</div><div><br></div><div>if you mean "lxc can be started by non-root users", root still needs to perform some configurations to allow them do so.</div><span class=""><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div style="font-size:12.8px">I followed this tutorial: <a href="https://help.ubuntu.com/lts/serverguide/lxc.html" target="_blank">https://help.ubuntu.com/lts/serverguide/lxc.html</a></div><div style="font-size:12.8px"><br></div></div></blockquote><div><br></div></span><div>Works for me.</div><span class=""><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div style="font-size:12.8px">For my first tests of lxc I was quite disappointed; the creation of containers works fine as sudo, but not when you try to run it as non-root user: <a href="http://paste.debian.net/683686/" target="_blank">http://paste.debian.net/683686/</a></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">Debug informations: <a href="http://paste.debian.net/683687/" target="_blank">http://paste.debian.net/683687/</a></div><div style="font-size:12.8px"><br></div></div></blockquote><div><br></div></span><div>Did you mix sudo in the commands? e.g. when using lxc-create, or mkdir?</div><div><br></div><div>In general, you should NOT do so. For unprivileged containers, commands must be run as normal user. And DON'T run it as root while su/sudo-ing to the user either, it won't work. use "ssh" to login as the user.</div><div><br></div><div>The exception is when preparing the system (e.g. installing packages, modifying /etc/sub[ug]id, /etc/lxc/lxc-usernet), where you (obivously) must be root.</div><div><br></div><div>Try again with a fresh system. Or, for test purposes, use a container with nesting enabled (e.g. <a href="https://insights.ubuntu.com/2016/04/15/lxd-2-0-lxd-in-lxd-812/" target="_blank">https://insights.ubuntu.com/2016/04/15/lxd-2-0-lxd-in-lxd-812/</a> , setting security.nesting: true, and use THAT as your 'host')</div><span class=""><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div style="font-size:12.8px"></div><div><div style="font-size:12.8px"><span style="font-size:12.8px">I also read this thread on ubuntuask: </span><a href="http://askubuntu.com/questions/623789/problem-setting-up-a-user-space-lxc-container" style="font-size:12.8px" target="_blank">http://askubuntu.com/questions/623789/problem-setting-up-a-user-space-lxc-container</a><br></div><div><span style="font-size:12.8px">But running its script and installing lxc from ppa archive in version 2.0 did not change anything. Note that everything works as expected on ubuntu 16.04 (from Ubuntu apt official repositories; I did not try the lxc ppa). This problem only occurs on ubuntu 14.04.</span></div><div><span style="font-size:12.8px"><br></span></div></div></div></blockquote><div><br></div><div><br></div></span><div>Just tested this on a container-with-nesting-enabled as 14.04 host:</div><div>as root:</div><div><div><br></div><div>add-apt-repository ppa:ubuntu-lxc/lxc-stable</div><div>apt-get update</div><div>apt-get install lxc</div></div><div><br></div><div><br></div><div>as normal user (ssh as the existing "ubuntu" user, then following the guide you linked, 'Basic unprivileged usage'):</div><div><br></div><div><div>mkdir -p ~/.config/lxc</div><div>echo "lxc.id_map = u 0 100000 65536" > ~/.config/lxc/default.conf</div><div>echo "lxc.id_map = g 0 100000 65536" >> ~/.config/lxc/default.conf</div><div>echo "lxc.network.type = veth" >> ~/.config/lxc/default.conf</div><div>echo "lxc.network.link = lxcbr0" >> ~/.config/lxc/default.conf</div><div>echo "$USER veth lxcbr0 2" | sudo tee -a /etc/lxc/lxc-usernet</div><div><br></div><div>cat /proc/self/cgroup</div><div>lxc-create -t download -n u1 -- -d ubuntu -r xenial -a amd64</div><div>lxc-start -n u1<br></div><div>lxc-attach -n u1</div></div><div><br></div><div><br></div><div>The the "cat /proc/self/group" command, I use it to check whether to user session is already on it's own cgroup. In my case it looks like this:</div><div><div>$ cat /proc/self/cgroup</div><div>10:perf_event:/lxc/lxc-demo</div><div>9:memory:/lxc/lxc-demo/user/ubuntu/0</div><div>8:freezer:/lxc/lxc-demo/user/ubuntu/0</div><div>7:net_cls,net_prio:/lxc/lxc-demo</div><div>6:devices:/lxc/lxc-demo</div><div>5:cpu,cpuacct:/lxc/lxc-demo</div><div>4:blkio:/lxc/lxc-demo</div><div>3:cpuset:/lxc/lxc-demo</div><div>2:hugetlb:/lxc/lxc-demo</div><div>1:name=systemd:/lxc/lxc-demo/user/ubuntu/0</div></div><div><br></div><div><br></div><div>... while on a "normal" host it should look like this:</div><div><div>$ cat /proc/self/cgroup</div><div>10:perf_event:/</div><div>9:memory:/user.slice/user-1000.slice</div><div>8:freezer:/</div><div>7:net_cls,net_prio:/</div><div>6:devices:/user.slice/user-1000.slice</div><div>5:cpu,cpuacct:/user.slice/user-1000.slice</div><div>4:blkio:/user.slice/user-1000.slice</div><div>3:cpuset:/</div><div>2:hugetlb:/</div><div>1:name=systemd:/user.slice/user-1000.slice/session-3545.scope</div></div><div><br></div><div>The important thing is that there are some cgroups (e.g. memory, name=systemd) which starts with "user-$UID.slice" or "user/$USER". On newer systems, this is created by libpam-cgfs. If you've installed older versions of lxc, you might still have 'cgmanager' and 'libpam-systemd', which might interfere with the correct functions. You might be hitting these limitation.<br></div><div><br></div><div><br></div><div>So again, my suggestion:</div><div>- start with a fresh system as host. fresh install, VM, nesting-enabled-container, whatever</div><div>- add ubuntu-lxc/lxc-stable ppa, install lxc. Make sure you have latest version (2.0.0-0ubuntu2~ubuntu14.04.1~ppa1 on my test)</div><div>- use ssh to login as the user. Do NOT use su/sudo</div><div>- follow the example</div><div><br></div><div>If you CAN'T start with a fresh system, then you could probably have some luck by uninstalling old packages first (lxc, cgmanager, libpam-systemd, etc). I haven't test this though, and you might end up wasting time. Always use fresh system for testing purposes whenever possible.</div><div><br></div><div>One last possibly-obvious suggestion: if you can start over with 16.04, do so, and use lxd. nicer, easier, cleaner. You can then create a nesting-capable-container for each of your users, and let them manage it (including creating their own containers under it)</div><span class="HOEnZb"><font color="#888888"><div><br></div><div>-- </div><div>Fajar</div><div><br></div></font></span></div></div></div>
<br>_______________________________________________<br>
lxc-users mailing list<br>
<a href="mailto:lxc-users@lists.linuxcontainers.org">lxc-users@lists.linuxcontainers.org</a><br>
<a href="http://lists.linuxcontainers.org/listinfo/lxc-users" rel="noreferrer" target="_blank">http://lists.linuxcontainers.org/listinfo/lxc-users</a><br></blockquote></div><br></div>