Create a bind mount from a Proxmox host on an unprivileged lxc container

LXCBindMount.md

Proxmox Assign Bind Mount To Unprivileged Container

In order for the LXC container to have full access the proxmox host directory, a subgid is set as owner of a host directory, and an ACL is used to ensure permissions.

Bind Mount dataset to LXC

Add the following line to /etc/pve/lxc/<CT_ID>.conf

mp0:/mount/point/on/host,mp=/mount/point/on/lxc

OR

pct set 100 -mp0 /mnt/bindmounts/shared,mp=/shared

(OPTIONAL) If having issues try setting the directory or dataset on the host to be inside /mnt

Create group on host

In the default Proxmox configuration, unpriviliged container subgids will have the prefix "10" followed by the expected 4-digit gid.

addgroup --gid <GID (ie."101000")> <GroupName (ie."container-data")>

Install ACL

Debian 11 which proxmox is based on does not have acl installed so install acl using

apt install acl

Enable acl for zfs dataset

zfs set acltype=posixacl storage/share

Set ACL for shared dataset

Any members of -GID- will have "rwx", new files from -GID- have "rwx" default Note: documentation suggests the "-d" flag should be used to assign default, however I have been able to get the desired result without, so... take that as you will

chgrp -R <GroupName> <Dataset>
chmod -R 2775 <Dataset>
setfacl -Rm g:<GID>:rwx,d:g:<GID>:rwx <Dataset>

---

Inside your LXC container

Create group

GID needs to match the last 4 digits of the subgid assigned earlier

addgroup --gid <GID (ie."1000")> <GroupName (ie."container-data")>

Add users to new permitted group

usermod -aG <GroupName> <User>

You should now be able to make modifications to the assigned directory on the host system from within the unpriviliged container.

---

References

https://blog.felixbrucker.com/2015/10/01/how-to-mount-host-directories-inside-a-proxmox-lxc-container/ https://www.reddit.com/r/homelab/comments/4h0erv/resolving_permissions_issues_with_host_bind/

Thanks for the succinct gist on the subject! It summarizes about 20 threads I've been reading on the subject to the same conclusions I reached. I will give feedback after I'm done setting up a node this way.

Also this: https://www.itsembedded.com/sysadmin/proxmox_bind_unprivileged_lxc/

I have one question though. You have this:

mp0:/mount/point/on/host,mp=/mount/point/on/lxc
It's important that the directory or dataset on the host should be in /mnt

Why does the directory/dataset need to have the mount point in /mnt on the host?

Why does the directory/dataset need to have the mount point in /mnt on the host?

I don't think that's needed any more and I am going to update this gist. I was having issues initially when my zfs dataset mount point was not inside the /mnt folder. I read it somewhere. Currently, my bind mounts are not located inside /mnt. So if you are having issues, you can try setting the bind mount to be inside /mnt on the host.

I have to check on ACL's as well as there have been some updates in samba and posixacl recently.

Ok great, that's what I thought... Wanted to avoid introducing an issue

…

On Thu, Jun 22, 2023, 02:36 Jp ***@***.***> wrote: ***@***.**** commented on this gist. ------------------------------ Why does the directory/dataset need to have the mount point in /mnt on the host? I don't think that's needed any more and I am going to update this gist. I was having issues initially when my zfs dataset mount point was not inside the /mnt folder. I read it somewhere. Currently, my bind mounts are not located inside /mnt. So if you are having issues, you can try setting the bind mount to be inside /mnt on the host. — Reply to this email directly, view it on GitHub <https://gist.github.com/JSinghDev/10e0824580a84a56022153592ac64faa#gistcomment-4606340> or unsubscribe <https://github.com/notifications/unsubscribe-auth/AADAJACESWUBTU7JHT3NZYTXMMWJBBFKMF2HI4TJMJ2XIZLTSKBKK5TBNR2WLJDHNFZXJJDOMFWWLK3UNBZGKYLEL52HS4DFQKSXMYLMOVS2I5DSOVS2I3TBNVS3W5DIOJSWCZC7OBQXE5DJMNUXAYLOORPWCY3UNF3GS5DZVRZXKYTKMVRXIX3UPFYGLK2HNFZXIQ3PNVWWK3TUUZ2G64DJMNZZDAVEOR4XAZNEM5UXG5FFOZQWY5LFVEYTCNBRHAZTCOJXU52HE2LHM5SXFJTDOJSWC5DF> . You are receiving this email because you commented on the thread. Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub> .