I cannot create /dev/net/tun in my unprivileged container. The container is running a systemd-less Debian distro called Devuan.
I have done much Googling and haven’t found a solution. Could this be a result of running an unpriviledged container needing a privileged capability? If so, is there a work-around? Any help appreciated…
Starting openvpn from the container commandline gives:
ERROR: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)
Trying to make the tun device manually throws an Operation not permitted error:
$ mkdir -p /dev/net
$ mknod /dev/net/tun c 10 200
mknod: ‘/dev/net/tun’: Operation not permitted
Unprivileged containers can’t create device nodes, that’s a kernel enforced policy for those.
Instead what you should do is bind-mount that device node from the host.
In LXD 3.0, I created an unprivileged 18.04 container and set up openvpn.
It then managed to create the tun device,
root@openvpn:~# ip route
default via 10.52.252.1 dev eth0 proto dhcp src 10.52.252.109 metric 100
10.10.10.0/24 via 10.10.14.1 dev tun0
10.10.14.0/23 dev tun0 proto kernel scope link src 10.10.15.55
10.52.252.0/24 dev eth0 proto kernel scope link src 10.52.252.109
10.52.252.1 dev eth0 proto dhcp scope link src 10.52.252.109 metric 100
root@openvpn:~# ping 10.10.14.1
PING 10.10.14.1 (10.10.14.1) 56(84) bytes of data.
64 bytes from 10.10.14.1: icmp_seq=1 ttl=64 time=80.4 ms
64 bytes from 10.10.14.1: icmp_seq=2 ttl=64 time=78.3 ms
^C
--- 10.10.14.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 78.375/79.422/80.470/1.084 ms
root@openvpn:~# ls -l /dev/net/tun
crw-rw-rw- 1 nobody nogroup 10, 200 Apr 23 07:35 /dev/net/tun
root@openvpn:~#
The only thing that did not work, was for openvpn to create a default route to the VPN, using a smaller metric so that it takes precedence,
The permissions could be a problem if you’re running openvpn as non-root.
It’s odd though as the file on the host /dev/net/tun should have been 666 not 600, at least that’s how I see it on my system.
NOTE: I didn’t need this step on a second container host I am running. The permissions were correct. However, if they are not 666 as above run (on the host):
I’m having the same issue and I can’t implement the solution because, every time that I start the CT, the added line is erased.
All changes to the /var/lib/lxc/101/config file are undone.
I’m using Proxmox with a Kali container, trying to connect to the Hack The Box machine.
Hey this almost helped me but i run into a different problem when trying to: chmod 666 /dev/net/tun it says Operation not permitted. Im logged in as root an it looks like it created the file but it belongs to nobody and no group do i need to change the owner?
