One of my hosts running lxd has a container with directory mapping which I found straightforward to set up. I just created a new container replicating the same steps unsuccessfully. The only difference is the first container is mapping an xfs/uncrypted mount, whereas the new container is referencing a LUKS mount. I wouldn’t think this has an impact, but maybe it does?
Setup:
…on the host
lxc launch images:debian/11 borg --profile default --profile macvlan
echo "b0:1001:1" | sudo tee -a /etc/subuid /etc/subgid
lxc config set borg raw.idmap "both 1001 1002"
lxc config device add borg backups disk source=/mnt/backup path=/backups
…on the container
groupadd -g 1002 b0
useradd -u 1001 -g 1002 -d /home/b0 -s /bin/sh -M b0
Checking:
…on the host
lxc exec borg -- ls /backups
ls: cannot open directory '/backups': Permission denied
…on the container
lxc exec borg -- ls -ln / | grep backup
drwxrwx--- 13 1001 65534 274 Feb 18 2021 backups
lxc exec borg -- stat /backups
File: /backups
Size: 274 Blocks: 0 IO Block: 4096 directory
Device: fe05h/65029d Inode: 128 Links: 13
Access: (0770/drwxrwx---) Uid: ( 1001/ b0) Gid: (65534/ nogroup)
Access: 2022-02-19 12:18:51.494449889 +0000
Modify: 2021-02-18 12:14:20.602704298 +0000
Change: 2022-02-19 11:37:24.483818597 +0000
Birth: 2020-12-10 16:39:22.521042000 +0000
lxc exec borg -- cat /proc/self/mountinfo | grep backups
637 535 254:5 / /backups rw,relatime master:139 - xfs /dev/mapper/backup rw,attr2,inode64,logbufs=8,logbsize=32k,noquota
…on the host:
ls -l /mnt | grep backup
drwxrwx--- 13 b0 b0 274 Feb 18 2021 backup
stat /mnt/backup/
File: /mnt/backup/
Size: 274 Blocks: 0 IO Block: 4096 directory
Device: fe05h/65029d Inode: 128 Links: 13
Access: (0770/drwxrwx---) Uid: ( 1001/ b0) Gid: ( 1002/ b0)
Access: 2022-02-19 13:18:51.494449889 +0100
Modify: 2021-02-18 13:14:20.602704298 +0100
Change: 2022-02-19 12:37:24.483818597 +0100
Birth: 2020-12-10 17:39:22.521042000 +0100
grep backup /etc/mtab
/dev/mapper/backup /mnt/backup xfs rw,relatime,attr2,inode64,logbufs=8,logbsize=32k,noquota 0 0
If this a limitation due to /mnt/backup being encrypted, is there any other alternative to being able to mount this folder in a container? Looking through this thread, if shiftfs is a solution, will enabling it impact my current container with its existing mounted folder?