Arch Linux

Rone

Member

Registered: 2015-04-27

Posts: 35

LXC unprivileged containers

Hi,

That's only for education purpose and empowering myself with sysadmin that i begin to wish to containerize everything (every apps or network service), and so i read around to know how to do it the best way and the good way concerning security concerns.

First i started to read about docker, but then i gave up with it and decided to dig into LXC instead, because LXC seems to works out of the box on 32-bit machines but it is not the case for docker, and i want to make my containers working on an old 32bits machines.

Reading forward about LXC, i saw that it is recommanded to use unprivileged LXC containers unless you know what you do and you know how to protect your "privileged" LXC containers.

Given that LXC tools are developed mainly by Canonical teams (if i understood) it seems that unprivileged LXC containers have been developed for Ubuntu users, but not for the most others GNU/Linux distros.
Gentoo distro seems to have packaged the tools needed to run unprivileged LXC containers, but Arch seems not to have done it.

So, my question is, in the future, would Archlinux make possible to run unprivileged LXC containers ?

Thanks.

--
Some links about LXC Unprivileged containers:
https://wiki.gentoo.org/wiki/LXC#Unpriv … containers

graysky

Wiki Maintainer

From: :wq

Registered: 2008-12-01

Posts: 10,734

Website

Re: LXC unprivileged containers

https://wiki.archlinux.org/index.php/Linux_Containers

Due to security concerns, the default Arch kernel does NOT ship with the ability to run containers as an unprivileged users, therefore, it is normal to see a missing status for "User namespaces" when running the check. See FS#36969 for this feature request.

Last edited by graysky (2015-05-25 12:26:12)

---

AUR packages • Zsh and other configs

Rone

Member

Registered: 2015-04-27

Posts: 35

Re: LXC unprivileged containers

Thanks @graysky, i read the wiki too quicky and didn't pay attention to this paragraph you point me to.

I've just given a look at to the "bug" ticket about "user namespace" not activated/supported in the official archlinux kernel, showing that CONFIG_USER_NS  kernel option needed to run unprivileged mode, is able to raise serious security problems that have not been resolved yet. I could have misunderstood, so correct me please if i am wrong.