☰

无法在 LXD 非特权容器中设置“nofile”的限制 - “操作不允许”

tag-icon • tag-icon centos7 lxc ulimit lxd ubuntu-17.04
无法在 LXD 非特权容器中设置“nofile”的限制 - “操作不允许”

我在 ubuntu 17.04 主机上运行 centos7 非特权 LXD 容器。如果容器在非特权模式下运行，则在容器内设置 NOFILE 的 ulimit 时会遇到问题。

以下是重现的步骤：

$ lxc launch images:centos/7/amd64 mycontainer
$ lxc exec mycontainer bash
[root@mycontainer ~]# yum install strace
[root@mycontainer ~]# ulimit -n 200000
bash: ulimit: open files: cannot modify limit: Operation not permitted
[root@mycontainer ~]#
[root@mycontainer ~]# strace -e setrlimit bash -c 'ulimit -n 200000'
setrlimit(RLIMIT_NOFILE, {rlim_cur=200000, rlim_max=200000}) = -1 EPERM (Operation not permitted)
bash: line 0: ulimit: open files: cannot modify limit: Operation not permitted
+++ exited with 1 +++
[root@mycontainer ~]#

容器的配置详情：

$ sudo lxc config show mycontainer
architecture: x86_64
config:
  image.architecture: amd64
  image.build: "20170504_02:16"
  image.description: Centos 7 (amd64) (20170504_02:16)
  image.distribution: centos
  image.release: "7"
  volatile.base_image: 41c7bb494bbdf71c2aee471bb44a2318fd3424a0cd22091fb896a7614ae545eb
  volatile.eth0.hwaddr: 00:16:3e:61:e4:6c
  volatile.eth0.name: eth0
  volatile.idmap.base: "0"
  volatile.idmap.next: '[{"Isuid":true,"Isgid":false,"Hostid":140000,"Nsid":0,"Maprange":65536},{"Isuid":false,"Isgid":true,"Hostid":140000,"Nsid":0,"Maprange":65536}]'
  volatile.last_state.idmap: '[{"Isuid":true,"Isgid":false,"Hostid":140000,"Nsid":0,"Maprange":65536},{"Isuid":false,"Isgid":true,"Hostid":140000,"Nsid":0,"Maprange":65536}]'
  volatile.last_state.power: STOPPED
  volatile.root.hwaddr: 00:16:3e:6b:93:1d
  volatile.root.name: eth1
devices: {}
ephemeral: false
profiles:
- default

作为一种解决方法，我可以让容器具有特权，但我更愿意只授予此容器的 rlimit 访问权限，或者能够从 lxd 提高限制。以下是我设置特权的方法：

$ lxc config set mycontainer security.privileged true
$ lxc restart mycontainer
$ sudo lxc config show mycontainer                                                                                                                   
architecture: x86_64
config:
  image.architecture: amd64
  image.build: "20170504_02:16"
  image.description: Centos 7 (amd64) (20170504_02:16)
  image.distribution: centos
  image.release: "7"
  security.privileged: "true"
  volatile.base_image: 41c7bb494bbdf71c2aee471bb44a2318fd3424a0cd22091fb896a7614ae545eb
  volatile.eth0.hwaddr: 00:16:3e:61:e4:6c
  volatile.eth0.name: eth0
  volatile.idmap.base: "0"
  volatile.idmap.next: '[]'
  volatile.last_state.idmap: '[]'
  volatile.last_state.power: RUNNING
devices: {}
ephemeral: false
profiles:
- default

答案1

在开发过程中似乎有一个从 lxd 设置限制的选项：

解决方案是：

lxc config set mycontainer limits.kernel.nofile 200000
lxc restart mycontainer

看：

相关内容