Accessing Container Storage from Host - Best Practice

Incus
, ,
1

Hello Incus Forum,

I want to access container storage on my Host with a user other then root. What would be the best way to accomplish this without changing permissions of the storage?

Here an example, I have a LXC container and I want to access the files and directory /etc/kea from my host machine.
Storage backend is btrfs:

user@incus01:\~$ incus storage list
┌─────────────┬────────┬─────────────┬─────────┬─────────┐
│    NAME     │ DRIVER │ DESCRIPTION │ USED BY │  STATE  │
├─────────────┼────────┼─────────────┼─────────┼─────────┤
│ local_btrfs │ btrfs  │             │ 8       │ CREATED │
└─────────────┴────────┴─────────────┴─────────┴─────────┘

I can view and access the files as root, but not as user:

root@incus01:~# ls -la /var/lib/incus/containers/kea01-alma/rootfs/etc/kea/
total 12
drwxr-xr-x. 1 systemd-oom systemd-timesync    60 Oct  2 14:31 .
drwxr-xr-x. 1 root        root              2756 Oct  5 10:27 ..
drwxr-xr-x. 1 systemd-oom systemd-timesync   118 Oct  2 11:46 conf.d
-rw-r-----. 1 systemd-oom systemd-timesync 10342 Oct  2 14:31 kea-dhcp4.jsonc
drwxr-xr-x. 1 systemd-oom systemd-timesync    20 Oct  1 16:39 radius
drwxr-xr-x. 1 systemd-oom systemd-timesync   132 Oct  1 16:39 ssl

user@incus01:~$ ls -la /var/lib/incus/containers/kea01-alma/rootfs/etc/kea/
ls: cannot access '/var/lib/incus/containers/kea01-alma/rootfs/etc/kea/': Permission denied

User user is in the incus-admin group:

user@nb-flo-xbc:~$ getent group | grep user
wheel:x:10:user
user:x:1000:
incus-admin:x:968:user

Are there any official or recommended ways to accomplish this?

Thanks in advance.

2

You generally shouldn’t interact with your instance files through host paths, but rather through the incus file commands. For example, to print the content of your kea-dhcp4.jsonc file to the standard output, you can do incus file pull kea01-alma/etc/kea/kea-dhcp4.jsonc - (note the - indicating the command to print its output to stdout).
You can also use incus file mount to get a temporary SFTP server or an sshfs mount, if having access to an actual file system is more convenient to you.