Controlling access to LXD operations

LXD
,
1

We’re running LXD on Ubuntu 18.04. I was a little concerned to notice that, by default, any user can execute any LXD command. In particular, any user can delete a container.

It also seems to be the case that any remote LXD user, once they are in the trust list, can execute any command.

Is there a way to restrict access to LXD operations? Or is it all-or-nothing?

The security section of the documentation only mentions limiting access to /var/lib/lxd/unix.socket

Thanks!

2

It’s all or nothing, that’s why the socket is restricted to a group of trusted users.

You can reduce the risk of a trusted user destroying containers by setting security.protection.delete=true in your default profile though, at which point, you’ll need to manually set that flag to false on the container before you can delete it.