aboutsummaryrefslogtreecommitdiff

Beggar Containers

A wrapper for LXC unprivileged containers.

Example

Enforcing PATH to avoid issues with firejail:

PATH=/bin:/usr/bin lxc-create --name alpine -t download -- -d alpine -r edge -a amd64

Development notes

ACL

getfacl . .local .local/share
sudo setfacl -m u:427680:x . .local .local/share
sudo setfacl --remove-all  . .local .local/share

AppArmor

  lxc-start 20171227032456.513 WARN     lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:218 - Incomplete AppArmor support in your kernel
  lxc-start 20171227032456.516 ERROR    lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:220 - If you really want to start this container, set
  lxc-start 20171227032456.519 ERROR    lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:221 - lxc.aa_allow_incomplete = 1
  lxc-start 20171227032456.521 ERROR    lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:222 - in your container configuration file
  lxc-start 20171227032456.527 ERROR    lxc_sync - sync.c:__sync_wait:57 - An error occurred in another process (expected sequence number 5)

References