<div dir="ltr"><div>Ah, could be that those images ship with stuff in /dev then.</div><div>As I said, your best bet is to modify the tarball and just drop those entries.</div><div><br></div><div>It's only a problem because you're trying to import the tarball inside an unprivileged container where such device nodes cannot be created.</div><div>If the container had been exported from within an unprivileged container or if it was restored on a host or inside a privileged container, this wouldn't happen.<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Nov 22, 2019 at 12:18 PM Chris Han <<a href="mailto:chrishan308@gmail.com">chrishan308@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>That container was started from a clean image from the "ubuntu" remote.</div><div> lxc launch ubuntu:18.04 c1<br></div><div><br></div><div>Originally the container was started in a Btrfs storage pool. But after that I copy the container to a Dir storage pool and use the later version. Will this cause the /dev/xx problem?</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Nov 23, 2019 at 1:07 AM Stéphane Graber <<a href="mailto:stgraber@stgraber.org" target="_blank">stgraber@stgraber.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>No, switching between privileged and unprivileged wouldn't have cause dev/ to get populated.</div><div>My guess is that you probably had an image that contained those files when it shouldn't have in the first place.<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Nov 22, 2019 at 11:45 AM Chris Han <<a href="mailto:chrishan308@gmail.com" target="_blank">chrishan308@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Originally the container was started as a privileged container with security.privileged="true". But after that I have removed the security.privileged configuration and restarted the container. Is this the root cause of the problem?<div><br></div><div>May I know what is the correct steps to change a privileged container to an unprivileged container?</div><div><br></div><div>Thanks for your reply.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Nov 23, 2019 at 12:28 AM Stéphane Graber <<a href="mailto:stgraber@stgraber.org" target="_blank">stgraber@stgraber.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>Hmm, not sure why you have those devices in this container in the first place, normally /dev is left empty and mounted as tmpfs in the container.</div><div>You could likely just edit the tarball to remove the content of dev/ and then import it just fine.<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Nov 22, 2019 at 2:19 AM Chris Han <<a href="mailto:chrishan308@gmail.com" target="_blank">chrishan308@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hi,<div><br></div><div>I have an unprivileged LXD container, c1, running in a physical host. I have exported this container to tar.gz:</div><div><br></div><blockquote style="margin:0px 0px 0px 40px;border:medium none;padding:0px"><div>lxc export c1-unprivileged c1-unprivileged.tar.gz</div></blockquote><div><br></div><div>I have created another unprivileged LXD container, c2, with settings for nested containers. Inside the c2 container, I am able to launch a nested unprivileged LXD container, c3. The c3 container is working fine.</div><div><br></div><blockquote style="margin:0px 0px 0px 40px;border:medium none;padding:0px"><div>lxc launch ubuntu:18.04 c3-unprivileged-nested</div></blockquote><div><br></div><div>However, when I try to import the c1 tar.gz file inside c2 to create a nested container, it shows the following error message:</div><div><br></div><div><blockquote style="margin:0px 0px 0px 40px;border:medium none;padding:0px"><div>lxc import c1-unprivileged.tar.gz</div><div><br></div><div>tar: rootfs/dev/zero: Cannot mknod: Operation not permitted<br>tar: rootfs/dev/random: Cannot mknod: Operation not permitted<br>tar: rootfs/dev/tty: Cannot mknod: Operation not permitted<br>tar: rootfs/dev/null: Cannot mknod: Operation not permitted<br>tar: rootfs/dev/full: Cannot mknod: Operation not permitted<br>tar: rootfs/dev/urandom: Cannot mknod: Operation not permitted<br></div><div><br></div></blockquote>I am able to import the c1 tar.gz file in a physical host, but unable to import it in an unprivileged container (to create a nested container). The LXD network and storage settings in the physical host and the c2 container are exactly the same.</div><div><br></div><div>How to import the c1 tar.gz in the c2 unprivileged container?</div><div><br></div></div>
_______________________________________________<br>
lxc-users mailing list<br>
<a href="mailto:lxc-users@lists.linuxcontainers.org" target="_blank">lxc-users@lists.linuxcontainers.org</a><br>
<a href="http://lists.linuxcontainers.org/listinfo/lxc-users" rel="noreferrer" target="_blank">http://lists.linuxcontainers.org/listinfo/lxc-users</a><br>
</blockquote></div><br clear="all"><br>-- <br><div dir="ltr">Stéphane</div>
_______________________________________________<br>
lxc-users mailing list<br>
<a href="mailto:lxc-users@lists.linuxcontainers.org" target="_blank">lxc-users@lists.linuxcontainers.org</a><br>
<a href="http://lists.linuxcontainers.org/listinfo/lxc-users" rel="noreferrer" target="_blank">http://lists.linuxcontainers.org/listinfo/lxc-users</a><br>
</blockquote></div>
_______________________________________________<br>
lxc-users mailing list<br>
<a href="mailto:lxc-users@lists.linuxcontainers.org" target="_blank">lxc-users@lists.linuxcontainers.org</a><br>
<a href="http://lists.linuxcontainers.org/listinfo/lxc-users" rel="noreferrer" target="_blank">http://lists.linuxcontainers.org/listinfo/lxc-users</a><br>
</blockquote></div><br clear="all"><br>-- <br><div dir="ltr">Stéphane</div>
_______________________________________________<br>
lxc-users mailing list<br>
<a href="mailto:lxc-users@lists.linuxcontainers.org" target="_blank">lxc-users@lists.linuxcontainers.org</a><br>
<a href="http://lists.linuxcontainers.org/listinfo/lxc-users" rel="noreferrer" target="_blank">http://lists.linuxcontainers.org/listinfo/lxc-users</a><br>
</blockquote></div>
_______________________________________________<br>
lxc-users mailing list<br>
<a href="mailto:lxc-users@lists.linuxcontainers.org" target="_blank">lxc-users@lists.linuxcontainers.org</a><br>
<a href="http://lists.linuxcontainers.org/listinfo/lxc-users" rel="noreferrer" target="_blank">http://lists.linuxcontainers.org/listinfo/lxc-users</a><br>
</blockquote></div><br clear="all"><br>-- <br><div dir="ltr" class="gmail_signature">Stéphane</div>