以 root 身份运行非特权 lxc 容器

以 root 身份运行非特权 lxc 容器

我已经成功运行特权 lxc 容器(以 root 身份)。我的系统:

uname -a
Linux ruby-dev 3.13.0-32-generic #57-Ubuntu SMP Tue Jul 15 03:51:08 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

sudo apt-get install cgmanager cgmanager-utils cgroup-bin

The following are available on system: libcap, libapparmor, libselinux, libseccomp, pyhton3-dev

sudo apt-get install lxc
sudo lxc-create -t download -n semiprivcont1 -- -d ubuntu -r trusty -a amd64
sudo lxc-start -n semiprivcont1 -d  

这将启动 semiprivcon1

lxc-ls -f
NAME           STATE    IPV4       IPV6  AUTOSTART  
--------------------------------------------------
semiprivcont1      RUNNING  10.0.3.99  -     NO 

现在我停止使用容器lxc-stop

创建了用户 lxchostuser。( sudo adduser lxchostuser)

cat /etc/subuid
lxchostuser:165536:65536

cat /etc/subgid
lxchostuser:165536:65536

vi /var/lib/lxc/semiprivcont1/config

添加了以下几行:

lxc.id_map = u 0 165536 65536
lxc.id_map = g 0 165536 65536

现在尝试启动 semiprivcon1:

sudo lxc-start -n semiprivcont1 -d

lxc-start: lxc_start.c: main: 342 The container failed to start.
lxc-start: lxc_start.c: main: 344 To get more details, run the container in foreground mode.
lxc-start: lxc_start.c: main: 346 Additional information can be obtained by setting the --logfile

sudo lxc-start -n semiprivcont1 -d --logfile semiprivcont1.log --logpriority=DEBUG

lxc-start: lxc_start.c: main: 342 The container failed to start.
lxc-start: lxc_start.c: main: 344 To get more details, run the container in foreground mode. 

从日志 semiprivcont1.log 中可以看出,容器在配置文件中引入的 id 映射存在错误。

lxc-start 1427506372.212 ERROR    lxc_conf - conf.c:userns_exec_1:4735 - Error setting up child mappings
      lxc-start 1427506372.212 ERROR    lxc_cgmanager - cgmanager.c:chown_cgroup:485 - Error requesting cgroup chown in new namespace
      lxc-start 1427506372.212 WARN     lxc_cgmanager - cgmanager.c:cgm_chown:1266 - Failed to chown lxc/semiprivcont1 to container root
      lxc-start 1427506372.219 DEBUG    lxc_conf - conf.c:lxc_assign_network:3420 - move '(null)' to '17213'
      lxc-start 1427506372.242 ERROR    lxc_start - start.c:lxc_spawn:955 - failed to set up id mapping
      lxc-start 1427506372.242 WARN     lxc_conf - conf.c:lxc_delete_network:3296 - failed to remove interface '(null)'
      lxc-start 1427506372.243 ERROR    lxc_start - start.c:__lxc_start:1080 - failed to spawn 'semiprivcont1'
      lxc-start 1427506372.243 WARN     lxc_commands - commands.c:lxc_cmd_rsp_recv:172 - command get_init_pid failed to receive response
      lxc-start 1427506372.243 WARN     lxc_cgmanager - cgmanager.c:cgm_get:954 - do_cgm_get exited with error
      lxc-start 1427506377.250 ERROR    lxc_start_ui - lxc_start.c:main:342 - The container failed to start.
      lxc-start 1427506377.250 ERROR    lxc_start_ui - lxc_start.c:main:344 - To get more 

如有任何指点/建议我将不胜感激。

相关内容