Can't unshare mount namespace centos 7.3

[brauner (Christian Brauner)]

We’ve had that question quite a bit and I tracked down all the necessary bits and pieces once:

CENTOS 7 - Kernel 514 - 693 Cannot start any nodes after update

Ok, so this was fun to track down again. The problem is that by default RHEL7 and friends disallow a) creation of user namespaces and b) creation of mount namespaces in user namespaces. Both are problematic for unprivileged containers. To solve a) you have to boot your kernel with user_namespace.enable=1 on the kernel command line. Unless there’s a sysctl I’m unaware of. Now, about b). I took a closer look at the RHEL7 kernel sources. (Getting at the kernel sources for RHEL7 is… interesting. I…

@stgraber also posted here:

LXD on Centos 7

Introduction A lot of people have been asking us how to run LXD on Centos/RHEL 7 in the past. Up until now, our answer has usually been to use some of the Fedora packages for liblxc, combined with a hand built version of LXD that you then have to manually integrate with your system. So certainly doable but not exactly clean or easy. But now there is finally a cleaner, much more supportable way for you to get LXD on those systems as there is now a build of snapd that works with Centos/RHEL, let…