[lxc-users] Mount additional storage into unprivileged container

[Andrey Repin]

Greetings, Andriy Tovstik!

>>> I am learning LXC features because we are going  to implement it in our
>>> production environment.
>>  
>>  LXC or LXD? Your configuration smells the latter.

> LXD, you are right. But AFAIK LXD is an extension that was built over LXC
> subsystem, isn't it?

LXD is an environment by and in itself. It uses different configuration tools
to setup and manage containers.

My (overly simplified) explanation of use case is that LXC is what I'd use if
I need to setup a system once and forget (as a figure of speech) it exists,
while LXD is a tool for mass-deployment of applications/appliances. With
leaning to the latter, since LXD deploys entire stack in a single container.

>>> Could somebody explain me is there any well documented way to mount
>>> additional filesystems or (preferable) block devices into Unprivileged
>>> containers? is it supports live migration of container?
>>  
>>  You could do better at explaining, what you need that for. It'll speed up the
>>  answer.
>>  Normally, you don't need to "mount block devices into container".

> Well... I'm going to use LXD to isolate two applications that will be
> heavily loaded. May be it will be necessary to give for each other dedicated storage.

You can do that by just mounting that dedicated storage in the profile. You
don't really need block devices inside a container, unless your use case
demands specifically block-level access. F.e. if you want to prepare bootable
media from inside a container (there was a thread about it a while ago,
apparently, OP's host OS was unable to produce desirable results, and they
wanted to use a container with a newer OS (thus newer toolchain) to prepare
the media).

> Rootfs i'll put to ZFS pool. Alternative way is to use zfs over high speed
> storage system and use IOPS limit for each container...

>>> I've read a lot of articles and man pages but unfortunatly this question is still unclear for me...
>>>
>>> Currently my config looks like:
>>>
>>>  
>>>
>>> name: test-container
>>> profiles:
>>> - default
>>> config:
>>>   raw.lxc: lxc.aa_profile=unconfined
>>>   security.privileged: "true"
>>>   volatile.base_image: a19c9ae2bd2e7bf99b0e2d31a0707cc534781a4eba47f44f172f486d2e01c96b
>>>   volatile.eth0.hwaddr: 00:16:3e:87:d6:d9
>>>   volatile.last_state.idmap: '[]'
>>> devices:
>>>   data:
>>>     path:  /datastorage
>>>     source: /dev/sdf
>>>     type: disk
>>>
>>>
>>> But when I try to change security.privileged to ‘false’ I lost an ability
>>> to write to /datastorage path inside container.
>>>
>>> Currently I’m using version 2.0.5 of LXC
>>  
>>  Doesn't match to your listed config. Smells like LXD.

> All versions looks like something like this:

You have LXD installed. "lxc2" is an alternative name for it. LXC is named
"lxc1" in the repository.

> ii  lxc-common     2.0.5-0ubuntu1~ubuntu16.04.2 amd64        Linux
> Containers userspace tools (common tools)

> ii  lxc2           2.0.5-0ubuntu1~ubuntu16.04.1 all          Container hypervisor based on LXC - metapackage
> ii  lxcfs          2.0.4-0ubuntu1~ubuntu16.04.1 amd64        FUSE based filesystem for LXC
> ii  lxd            2.0.5-0ubuntu1~ubuntu16.04.1 amd64        Container hypervisor based on LXC - daemon
> ii  lxd-client     2.0.5-0ubuntu1~ubuntu16.04.1 amd64        Container hypervisor based on LXC - client
> ii  lxd-tools      2.0.5-0ubuntu1~ubuntu16.04.1 amd64        Container hypervisor based on LXC - extra tools


aptitude show lxc2
Package: lxc2
State: not installed
Version: 2.0.5-0ubuntu1~ubuntu14.04.1
Priority: extra
Section: universe/metapackages
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Architecture: all
Uncompressed Size: 57,3 k
Depends: lxd, lxd-client
Description: Container hypervisor based on LXC - metapackage
 LXD offers a REST API to remotely manage containers over the network, using an image based
 workflow and with support for live migration.

This is a dummy metapackage to install LXD and its client.
Homepage: https://linuxcontainers.org/


-- 
With best regards,
Andrey Repin
Tuesday, November 8, 2016 14:25:33

Sorry for my terrible english...