Shiftfs root info inside container

LXD
1

output of df -h inside container:

without shiftfs:

Filesystem Size Used Avail Use% Mounted on
zp3/pl2/containers/303_set-buzzard 2.1G 239M 1.9G 12% /

with shiftfs on:

Filesystem Size Used Avail Use% Mounted on
/var/snap/lxd/common/lxd/storage-pools/pl2/containers/303_novel-dragon/rootfs 2.1G 238M 1.9G 12% /

It was already exposing too much of host zfs pool structure to guest, but now with shiftfs the /root is more like GPS coordinates on host!

For a user/guest used to the short host or vm style of /dev/sda2 / it might look bit confusing.

Is there a way to hide/obfuscate it?
Or at least show a shortened/chrooted version of it /containers/name/rootfs ?

2

Is there a way to use shiftfs selectively? Then once enabled, it applies to all newly created containers.

I tried lxd with disabled shiftfs, applied this to a container (before first start):
security.protection.shift: "true"
resulted in:
Error: Failed to handle idmapped storage: Container is protected against filesystem shifting

Than enabled shiftfs for lxd snap, but how to make a container where shifting is desired?

security.protection.shift: "false" obviousely no effect.
Must define raw id maps individually?

3

Any thoughts @amikhalitsyn ?

4

@kamzar1

that’s definitely a shiftfs bug. Shiftfs is not properly resolves path. We have seen a lot of issues like that with overlayfs (that was patched to work over shiftfs).

Is there a way to use shiftfs selectively? Then once enabled, it applies to all newly created containers.

You can try to set security.shifted to false on the storage pool. But as far as I understand you can’t control this parameter individually for the rootfs.

For additional disk devices you can control if shifting is used or not by:
lxc config device set container_name disk_name shift=true

5

@amikhalitsyn Thanks for elaborating.
@tomp Is it worth opening issues for those or just live with it?

  1. Selective shiftfs.
    once shiftfs enabled for snap.lxd config, it applies to all subsequently created instances.
    Either lxd.daemon shiftfs=false but apply individually to instances
    or globally shiftfs=true, but disable in cases by instance/profile config.

  2. resolve rootfs path inside container:
    overlayfs not exposing zpool structure:
    zpool/lxdpool/containers/project_container
    shiftfs not showing full host path:
    /var/snap/lxd/common/lxd/storage-pools/mystoragepool/containers/Project_Contanername/rootfs

6

once shiftfs enabled for snap.lxd config, it applies to all subsequently created instances.

as I mentioned you can control that on the storage pool level.

7

Can you clarify on the exact command required to do that? The documentation isn’t very straightforward when it comes to actually explaining all options available and how to use them…