Unprivileged containers inside privileged LXD container

LXD
1

Hi there,

I’m looking to better understand the implications of running unprivileged containers inside a privileged LXD container. My understanding is that setting security.nesting=true + security.privileged=true on an LXD container has severe security implications - software within the LXD container can potentially affect the host.

Would an unprivileged container running within such an LXD container be considered safe?

My specific use-case is running multiple Kubernetes clusters on a single set of LXD hosts, whilst giving each Kubernetes host (LXD container) elevated privileges such as the ability to create/modify ZFS datasets of the host (by passing /dev/zfs to the LXD container), for use by OpenEBS ZFS LocalPV.

I consider the Kubernetes LXD containers to be trusted - but not the containers being spun up by Kubernetes.

I want to do this because I want ZFS to be beneath my entire infrastructure to be as flexible as possible with storage. In the future I’ve love to see “virtualized ZFS” - the ability to dedicate a dataset to a unprivileged container and for that container to be able to create/delete/change properties of anything beneath that dataset.

2

That is correct.
See What does security.nesting=true? - #2 by stgraber

3

It depends on your definition of “unprivileged” as they are different between docker/kubernetes and LXD AFAIK.

Running software inside a privileged container isn’t any safer than running it on the host directly.
But as long as you’re happy that the software you’re running inside the privileged container is safe (or is run inside another container that you’re happy with the isolation level) and you’re only depending on the privileged LXD container to provide a logical convenience layer then you should be fine.