Is it possible to expose /var/lib/incus/unix.socket to the container

Incus
1

Similar to docker
-v /var/run/docker.sock:/var/run/docker.sock,
So I can calling the Incus daemon API inside the container.
I tried the following command

incus config device add ubuntu2204 unix-socket unix-char source=/var/lib/incus/unix.socket path=/var/lib/incus/unix.socket

it said Invalid value for device option “source”: Path needs to be in /dev

2

Yes, it is. We are using in this example an Incus proxy device, to connect a Unix socket with a Unix socket. (unix<->unix).

$ incus launch images:ubuntu/24.04/cloud management
Launching management
$ incus config device add management incussocket proxy connect=unix:/var/lib/incus/unix.socket listen=unix:/var/lib/incus/unix.socket bind=container uid=0 gid=147 mode=0660 security.uid=65534 security.gid=147
Error: Failed to start device "incussocket": Error occurred when starting proxy device: Error: Failed to listen on /var/lib/incus/unix.socket: listen unix /var/lib/incus/unix.socket: bind: no such file or directory
$ incus exec management -- mkdir -p /var/lib/incus/
$ incus config device add management incussocket proxy connect=unix:/var/lib/incus/unix.socket listen=unix:/var/lib/incus/unix.socket bind=container uid=0 gid=147 mode=0660 security.uid=65534 security.gid=147
Device incussocket added to management
$ incus shell management
root@management:~# apt install incus-client
...
root@management:~# incus version
Client version: 6.0.0
Server version: 6.5
root@management:~# logout
$

147 is the ID of incus-admin in my case.

3

Thanks, I tested it successfully using the following command, and the user group in my container is 1000

incus exec ubuntu2204 -- mkdir -p /var/lib/incus/

incus config device add ubuntu2204 incus-socket proxy \
  bind=instance mode=0660 gid=1000 \
  listen=unix:/var/lib/incus/unix.socket connect=unix:/var/lib/incus/unix.socket
4

Also bear in mind the security implications of this.

1 Like
5

This is how I solve the same problem.

1 Like