LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software > Linux - Kernel
User Name
Password
Linux - Kernel This forum is for all discussion relating to the Linux kernel.

Notices


Reply
  Search this Thread
Old 04-19-2015, 08:26 PM   #1
matiasar
Member
 
Registered: Nov 2006
Location: Argentina
Distribution: Debian
Posts: 321
Blog Entries: 1

Rep: Reputation: 31
LXC unprivileged container in Debian Jessie - Cgroups permissions?


I've been trying to start an unprivileged LXC container in Debian Jessie (stock kernel version: 3.16.0-4-686-pae) for several days with no success.

I've followed these tutorials:
https://www.stgraber.org/2014/01/17/...ed-containers/

Created the subuid and subgid for the user I wish to start the containers with:

Code:
# grep -w lxcuser /etc/sub* 2>/dev/null
/etc/subgid:lxcuser:100000:65537
/etc/subuid:lxcuser:100000:65537
I configured those subids within lxc config file:

Code:
lxcuser@matuxntbk:~$ cat .config/lxc/default.conf 
lxc.id_map = u 0 100000 65537
lxc.id_map = g 0 100000 65537
I was able to create the container (debian wheezy)

Code:
$ lxc-ls --fancy
NAME       STATE    IPV4  IPV6  AUTOSTART  
-----------------------------------------
retuxinho  STOPPED  -     -     NO
But trying to start the container I always get the following error:

Code:
lxcuser@matuxntbk:~$ lxc-start -f .config/lxc/default.conf -n retuxinho --logfile=/tmp/startretuxinho.log --logpriority=trace
lxc-start: Permission denied - Could not create cgroup '/retuxinho' in '/sys/fs/cgroup/perf_event'.
lxc-start: Permission denied - cgroup_rmdir: failed to delete /sys/fs/cgroup/perf_event/
lxc-start: Permission denied - cgroup_rmdir: failed to delete /sys/fs/cgroup/blkio/
lxc-start: Permission denied - cgroup_rmdir: failed to delete /sys/fs/cgroup/net_cls,net_prio/
lxc-start: Permission denied - cgroup_rmdir: failed to delete /sys/fs/cgroup/freezer/
lxc-start: Permission denied - cgroup_rmdir: failed to delete /sys/fs/cgroup/devices/
lxc-start: Permission denied - cgroup_rmdir: failed to delete /sys/fs/cgroup/memory/
lxc-start: Permission denied - cgroup_rmdir: failed to delete /sys/fs/cgroup/cpu,cpuacct/
lxc-start: Permission denied - cgroup_rmdir: failed to delete /sys/fs/cgroup/cpuset/
lxc-start: failed creating cgroups
lxc-start: failed to spawn 'retuxinho'
lxc-start: The container failed to start.
lxc-start: Additional information can be obtained by setting the --logfile and --logpriority options.
The full logs:

Code:
 lxc-start 1429489340.992 INFO     lxc_confile - read uid map: type u nsid 0 hostid 100000 range 65537
      lxc-start 1429489340.992 INFO     lxc_confile - read uid map: type g nsid 0 hostid 100000 range 65537
      lxc-start 1429489340.992 WARN     lxc_log - lxc_log_init called with log already initialized
      lxc-start 1429489340.992 INFO     lxc_confile - read uid map: type u nsid 0 hostid 100000 range 65537
      lxc-start 1429489340.992 INFO     lxc_confile - read uid map: type g nsid 0 hostid 100000 range 65537
      lxc-start 1429489340.992 INFO     lxc_lsm - LSM security driver nop
      lxc-start 1429489340.992 DEBUG    lxc_start - sigchild handler set
      lxc-start 1429489340.992 INFO     lxc_start - 'retuxinho' is initialized
      lxc-start 1429489341.002 DEBUG    lxc_start - Not dropping cap_sys_boot or watching utmp
      lxc-start 1429489341.002 INFO     lxc_start - Cloning a new user namespace
      lxc-start 1429489341.003 INFO     lxc_cgroup - cgroup driver cgroupfs initing for retuxinho
      lxc-start 1429489341.004 ERROR    lxc_cgfs - Permission denied - Could not create cgroup '/retuxinho' in '/sys/fs/cgroup/perf_event'.
      lxc-start 1429489341.006 ERROR    lxc_cgfs - Permission denied - cgroup_rmdir: failed to delete /sys/fs/cgroup/perf_event/
      lxc-start 1429489341.007 ERROR    lxc_cgfs - Permission denied - cgroup_rmdir: failed to delete /sys/fs/cgroup/blkio/
      lxc-start 1429489341.007 ERROR    lxc_cgfs - Permission denied - cgroup_rmdir: failed to delete /sys/fs/cgroup/net_cls,net_prio/
      lxc-start 1429489341.007 ERROR    lxc_cgfs - Permission denied - cgroup_rmdir: failed to delete /sys/fs/cgroup/freezer/
      lxc-start 1429489341.008 ERROR    lxc_cgfs - Permission denied - cgroup_rmdir: failed to delete /sys/fs/cgroup/devices/
      lxc-start 1429489341.008 ERROR    lxc_cgfs - Permission denied - cgroup_rmdir: failed to delete /sys/fs/cgroup/memory/
      lxc-start 1429489341.008 ERROR    lxc_cgfs - Permission denied - cgroup_rmdir: failed to delete /sys/fs/cgroup/cpu,cpuacct/
      lxc-start 1429489341.009 ERROR    lxc_cgfs - Permission denied - cgroup_rmdir: failed to delete /sys/fs/cgroup/cpuset/
      lxc-start 1429489341.009 ERROR    lxc_start - failed creating cgroups
      lxc-start 1429489341.009 ERROR    lxc_start - failed to spawn 'retuxinho'
      lxc-start 1429489341.009 ERROR    lxc_start_ui - The container failed to start.
      lxc-start 1429489341.009 ERROR    lxc_start_ui - Additional information can be obtained by setting the --logfile and --logpriority options.
I think the problem may be related with cgroups configurations/permissions, but I couldn't solve it. cgmanager service is running. I'm new to cgroups and lxc.
Does anybody knows what needs to be done in order to cgroups have appropiatted permissions?
Any help will be ver appreciated.

Thanks!
 
Old 04-20-2015, 02:39 AM   #2
ceyx
Member
 
Registered: May 2009
Location: Fort Langley BC
Distribution: Kubuntu,Free BSD,OSX,Windows
Posts: 342

Rep: Reputation: 59
From :
https://linuxcontainers.org/lxc/getting-started/

Quote:
Just before you create your first container, you probably should logout and login again,
or even reboot your machine to make sure that your user is placed in the right cgroups.
Do you recall if you took this step ?
 
Old 04-20-2015, 08:15 AM   #3
matiasar
Member
 
Registered: Nov 2006
Location: Argentina
Distribution: Debian
Posts: 321

Original Poster
Blog Entries: 1

Rep: Reputation: 31
ceyx, thanks for your response.
Yes, you know, I tried it both relogin, rebooting. Starting from ssh and tty session, if running from an xterm I set XDG_RUNTIME_DIR environment variable also.
I think i'm missing some cgroup settings so lxc can create a cgroup for the container...
 
Old 04-20-2015, 03:04 PM   #4
ceyx
Member
 
Registered: May 2009
Location: Fort Langley BC
Distribution: Kubuntu,Free BSD,OSX,Windows
Posts: 342

Rep: Reputation: 59
It seems as if Ubuntu 14 is the way to go with these containers. The LXC document (above) states :

Quote:
Ubuntu is also one of the few (if not only) Linux distributions to come by default
with everything that's needed for safe, unprivileged LXC containers.
This is probably because Canonical has offerings in the 'cloud'.

You might want to get a successful Ubuntu installation going, and compare it with your Debian one to help you troubleshoot.

Not much help, but there is my two cents.

 
Old 04-20-2015, 03:48 PM   #5
matiasar
Member
 
Registered: Nov 2006
Location: Argentina
Distribution: Debian
Posts: 321

Original Poster
Blog Entries: 1

Rep: Reputation: 31
I was wondering the same today, so I installed an ubuntu 14.10 and LXC containers run without effort there, just as described in documentation.

I will remain with Debian... think ubuntu might share his work as long is open source and inherited lot of work from Debian...
I will try to compare, if i can find any difference.
 
Old 06-05-2015, 01:36 AM   #6
vandroiy.cl
LQ Newbie
 
Registered: Sep 2012
Location: Chile
Distribution: Debian
Posts: 2

Rep: Reputation: Disabled
Hi,
I was having the same issues with cgroups and network config to be able to start a lxc container
on Debian Jessie lxde,

Quickest solution I've found: Running the install script of https://www.flockport.com/start/
There's nice documentation about lxc on that site,
and after running the script, I was allowed to run privileged containers

To run unprivileged containers, what's on this link worked for me: https://www.flockport.com/lxc-using-...ed-containers/
Though I didn't wanted to run this part

sudo usermod --add-subuids 100000-165536 username
sudo usermod --add-subgids 100000-165536 username

Cause I really can't understand how to "choose" those numbers in debian
So, the workaround for the cgroups issues while trying to run unprivileged containers I do the following,
as stated here http://unix.stackexchange.com/questi...s-with-systemd

sudo service cgmanager start
sudo cgm create all $USER
sudo cgm chown all $USER $(id -u $USER) $(id -g $USER)
sudo cgm movepid all $USER $$

Though I have to do this every time I run the container, but at least I can now run it =)
Hope this helps someone.

A more permanent fix and explanations about "usermod" stuff are welcome =)
 
1 members found this post helpful.
Old 06-07-2015, 01:17 PM   #7
matiasar
Member
 
Registered: Nov 2006
Location: Argentina
Distribution: Debian
Posts: 321

Original Poster
Blog Entries: 1

Rep: Reputation: 31
Cool info!

Vandoroy.cl, cool info! Thanks.
I managed to run unprivileged containers in Debian in a very similar way.
I documented here in my blog (in spanish), forgot to write a couple of lines here, good you did it!

http://www.equiscentrico.com.ar/2015...an-jessie.html

thanks and regards,
Matías
 
  


Reply

Tags
lxc cgroups


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
LXC Container: sound Not working charlie101 Linux - Virtualization and Cloud 10 06-14-2015 12:16 PM
Unable to start unprivileged Lxc container on Debian Sid hurd Debian 0 02-02-2015 11:45 PM
LXC unprivileged container - operation no permitted gauthig Linux - Virtualization and Cloud 2 07-15-2014 04:34 PM
How to use Local ISO for LXC Container? sunveer Linux - Software 0 10-04-2013 05:44 AM
How to end a Linux Container (LXC) from within? Skaperen Linux - Virtualization and Cloud 0 06-14-2011 10:37 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software > Linux - Kernel

All times are GMT -5. The time now is 07:30 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration