Proxmox VE: Import Wizard for Migrating VMware ESXi VMs

Post by dusanh » Sun, Mar 31, 2024, 12:46 PM UTC

Helmut10001 wrote: post #97

dusanh wrote: post #69

Earlier quoted context omitted.

Unprivileged LXCs? Interesting, I thought containers would require privileged LXC. At least, that it my takeaway from trying to run Podman in a nesting enabled, but unprivileged LXC under non-root user. I kept running into > newuidmap: write to uid_map failed: Operation not permitted I tried googling it, tried some of the solutions, but reached the conclusion that it's happening because the LXC is not privileged.

I once wrote a post about Docker in unprivileged LXC on ZFS [1]. The post is a little bit outdated, as it is much simpler today with ZFS 2.2.0, which is natively supported. There's also a more recent post that shows how to run rootless docker [2], with updated uid-mappings. Both may be helpful, have a look. The advantage of using LXC for me is resource consumption and separation of concerns. I have about 35 Docker co…

  (dev) $ podman info
  ERRO[0000] running `/usr/bin/newuidmap 3427 0 1000 1 1 100000 65536`: newuidmap: open of uid_map failed: Permission denied
  Error: cannot set up namespace using "/usr/bin/newuidmap": exit status 1

  (root) # setcap cap_setuid+ep /usr/bin/newuidmap
  (root) # setcap cap_setgid+ep /usr/bin/newgidmap

  (root) # podman info 

Post by dusanh » Mon, Apr 01, 2024, 3:41 PM UTC

Helmut10001 wrote: post #112

dusanh wrote: post #111

Earlier quoted context omitted.

Thank you, this made me realize I assigned a wrong (too little) number for uids. It did not fix my issue however. I still see (dev) $ podman info ERRO[0000] running `/usr/bin/newuidmap 3427 0 1000 1 1 100000 65536`: newuidmap: open of uid_map failed: Permission denied Error: cannot set up namespace using "/usr/bin/newuidmap": exit status 1 I tried a solution I found on Red Hat's Customer Portal: (root) # setcap cap_s…

Yes, just start from scratch and provide uid-mappings from the beginning. Looks like those uids were set from before adding the mappings and it is trying to access uids it is not allowed to access. I used rootless docker in rootless lxc because the Postgres Docker (e.g.) will try to setup a non-root user by default. In a rootless LXC, this means it will try to access very large uids (>100000), which are not available…

Post by dusanh » Mon, Apr 01, 2024, 8:12 PM UTC

Helmut10001 wrote: post #114

dusanh wrote: post #113

Earlier quoted context omitted.

That actually did not do anything different for me. I did the following: 1) Created a new LXC. 2) As root, I created a new user "devel" 3) For the "devel" user set both subuid and subgid to devel:100000:65536 4) As root, installed podman 5) In another SSH session, logged in as "devel" and ran "podman version" Same error as before. This is in a Debian 12 LXC running on Proxmox.

I am also using Docker in Debian 12 LXC on Proxmox. I am not sure what has gone wrong here.

Post by dusanh » Thu, Apr 04, 2024, 9:18 PM UTC

dusanh wrote: post #69

Helmut10001 wrote: post #40

I use Proxmox since 5 years at home. Mostly docker nested in unprivileged LXCs on ZFS for performance reasons. I love the reliability. Proxmox has never lost me. They churn out constant progress without making too much noise. No buzzwords, no advertising, just a good reliable product that keeps getting better.

Unprivileged LXCs? Interesting, I thought containers would require privileged LXC. At least, that it my takeaway from trying to run Podman in a nesting enabled, but unprivileged LXC under non-root user. I kept running into > newuidmap: write to uid_map failed: Operation not permitted I tried googling it, tried some of the solutions, but reached the conclusion that it's happening because the LXC is not privileged.

  # cat /etc/subuid /etc/subgid
  devel:10000:5000
  devel:10000:5000

   # cat /etc/pve/lxc/{lxc_vmid}.conf
   ...truncated...
   lxc.cgroup2.devices.allow: c 10:200 rwm
   lxc.mount.entry: /dev/net dev/net none bind,create=dir