Platypuschan

Proxmox Assign Bind Mount To Unprivileged Container

In order for the LXC container to have full access the proxmox host directory, a subgid is set as owner of a host directory, and an ACL is used to ensure permissions.

Bind Mount dataset to LXC

Add the following line to /etc/pve/lxc/<CT_ID>.conf

mp0:/mount/point/on/host,mp=/mount/point/on/lxc

Create group on host

In the default Proxmox configuration, unpriviliged container subgids will have the prefix "10" followed by the expected 4-digit gid.

In case there's already a DHCP config for netplan for the private IP address:

File: /etc/netplan/50-cloud-init.yaml

Contents:

# This file is generated from information provided by
# the datasource.  Changes to it will not persist across an instance.
# To disable cloud-init's network configuration capabilities, write a file
# /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg with the following:

Using keepalived for node ingress and dns relaibility

This assumes you have installed a docker swarm

Introduction

When one has a docker swarm a container running on any node in the swarm can be accesed using any IP address of any swarm memeber.

For example if you had a single web server running on port 80, on one node of a swarm you could access the web server with any of the following IP addresses:

server1-ip:80
server2-ip:80

Kill user tty/pts sessions in Linux

Commands

w: show who is logged on and what they are doing
who: show who is logged on
tty: show current users pseudo terminal
ps -ft pts/1: get process id for the pseudo terminal
pkill: signal process based on name and other attributes

Enable TCP port 2375 for external connection to Docker

See this issue.
Docker best practise to Control and configure Docker with systemd.

Create daemon.json file in /etc/docker:

 {"hosts": ["tcp://0.0.0.0:2375", "unix:///var/run/docker.sock"]}

	On void linux.

	Under `/etc/containers/` there is a file called `registries.conf`. It is complemented by `man 5 containers-registries.conf`.

	Change (for me lines 11-12) which say

	[registries.search]
	registries = []

	#!/usr/bin/env bash

	#
	# Enable docker and docker-compose on TrueNAS SCALE (no Kubernetes)
	#
	# This script is a hack! Use it at your own risk!!
	# Using this script to enable Docker is NOT SUPPORTED by ix-systems!
	# You CANNOT use SCALE Apps while using this script!
	#
	# 1 Create a dedicated Docker zvol on one of your zpools: zfs create -V 100G data/_docker

	#!/usr/bin/env bash

	#
	# Enable docker and docker-compose on TrueNAS SCALE (no Kubernetes)
	#
	# This script is a hack! Use it at your own risk!!
	# Using this script to enable Docker is NOT SUPPORTED by ix-systems!
	# You CANNOT use SCALE Apps while using this script!
	#
	# 1 Create a dedicated Docker dataset in one of your zpools