Since OpenZFS 2.2 there are zfs zone/unzone commands that can allow a container to manage specific mounted datasets. It also requires dev/zfs to be mounted in container with device added to lxc config.
This can be probably implemented with lxc hooks, but would be best to support natively like Incus does.
+1 as this feature would make proxmox so much greater !
Use case: have a privileged LXC fileserver (managing ZFS and samba) as the ZFS management features (GUI) within Proxmox are not very extensive.
Last edited:
Bumping this topic up as I wanted to know if this is on any roadmap or future plans to include in Proxmox?
I have tried this with unprivileged containers using this article and it's working but comes with some drawbacks (regarding changing namespaces when rebooting).
It seems that theoretically speaking all the building blocks are there to make this possible with privileged containers;
This might also improve greatly docker ZFS support in LXC containers in future as I believe the community may prefer docker lxc over OCI ref.: OCI vs docker LXC thread
personally I prefer lxc containers over docker containers but docker support and community initiatives in docker containers and applications will not disappear and proxmox support for this (in lxc) would make the product even better - also negating an advantage that incus/LXD currently has over proxmox.
Last edited:
It seems I am among a limited few that really see the need for this?
- Fileserver, SAMBA running in an LXC...
- ZFS acl support in an LXC....
- LXC to manage ZFS snapshots with a nice GUI as this is currently very limited in Proxmox WebGUI...
- Docker running in an LXC using more stable ZFS storage driver...
- Keeping feature sets comparable to competing products like Incus that have this feature...
- many more use cases....
Just trying to create a larger demand for this....
How exactly can it tear a security hole? It's not some hack it's a feature of the filesystem. It brings a container closer than ever to a full vm, as far as the filesystem goes. You can send and receive datasets from inside the container transparently without needing a privileged container, as well and take and restore snapshots.
How exactly can it tear a security hole? It's not some hack it's a feature of the filesystem. It brings a container closer than ever to a full vm, as far as the filesystem goes. You can send and receive datasets from inside the container transparently without needing a privileged container, as well and take and restore snapshots.
The weird thing surrounding this Proxmox perspective or vision is that using github guide it is working in unprivileged containers (albeit with some caveats).
The reasoning or logic behind those security concerns confuses me as this feature was introduced in ZFS 2.2 and Incus.
Perhaps our question or demand needs to be rephrased: how can we delegate ZFS datasets to a container's privileged user namespace?
The weird thing surrounding this Proxmox perspective or vision is that using github guide it is working in unprivileged containers (albeit with some caveats).
The reasoning or logic behind those security concerns confuses me as this feature was introduced in ZFS 2.2 and Incus.Perhaps our question or demand needs to be rephrased: how can we delegate ZFS datasets to a container's privileged user namespace?
I was wondering if you are ever on irc? I'm on libera.chat and wanted to pick your brain about this stuff.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。
