added the unprivileged flag

This flag (like lxc.id_map entries) should only be set at
create-time in order to make sure the container's filesystem
has the correct ownerships and permissions.
For this reason modification is not allowed via the API.

An unprivileged containers defines lxc.id_map properties,
and includes $ostype.userns.conf in addition to
$ostype.common.conf in its lxc config.

diff --git a/src/PVE/API2/LXC.pm b/src/PVE/API2/LXC.pm
index a4e80ec7ac4592f088ef4b6707dd52a9f0f00511..165e3270ffefa6271fc1dca4d9fccaa1334f86e7 100644 (file)
--- a/src/PVE/API2/LXC.pm
+++ b/src/PVE/API2/LXC.pm
@@ -162,6 +162,9 @@ __PACKAGE__->register_method({
 
        my $same_container_exists = -f $basecfg_fn;
 
+       # 'unprivileged' is read-only, so we can't pass it to update_pct_config
+       my $unprivileged = extract_param($param, 'unprivileged');
+
        my $restore = extract_param($param, 'restore');
 
        if ($restore) {
@@ -263,6 +266,8 @@ __PACKAGE__->register_method({
 
        PVE::LXC::update_pct_config($vmid, $conf, 0, $no_disk_param);
 
+       $conf->{unprivileged} = 1 if $unprivileged;
+
        my $check_vmid_usage = sub {
            if ($force) {
                die "can't overwrite running container\n"

diff --git a/src/PVE/LXC.pm b/src/PVE/LXC.pm
index f38c5bdc0c97f404b3a508f55ea82022f54e09ba..07ac4fc2e432d38fcd6f8340654cb0d2e93a1b1a 100644 (file)
--- a/src/PVE/LXC.pm
+++ b/src/PVE/LXC.pm
@@ -192,6 +192,12 @@ my $confdesc = {
        description => "Sets the protection flag of the container. This will prevent the remove operation. This will prevent the CT or CT's disk remove/update operation.",
        default => 0,
     },
+    unprivileged => {
+       optional => 1,
+       type => 'boolean',
+       description => "Makes the container run as unprivileged user. (Should not be modified manually.)",
+       default => 0,
+    },
 };
 
 my $valid_lxc_conf_keys = {
@@ -1050,13 +1056,25 @@ sub update_lxc_config {
     die "missing 'arch' - internal error" if !$conf->{arch};
     $raw .= "lxc.arch = $conf->{arch}\n";
 
+    my $unprivileged = $conf->{unprivileged};
+    my $custom_idmap = grep { $_->[0] eq 'lxc.id_map' } @{$conf->{lxc}};
+
     my $ostype = $conf->{ostype} || die "missing 'ostype' - internal error";
     if ($ostype =~ /^(?:debian | ubuntu | centos | archlinux)$/x) {
        $raw .= "lxc.include = /usr/share/lxc/config/$ostype.common.conf\n";
+       if ($unprivileged || $custom_idmap) {
+           $raw .= "lxc.include = /usr/share/lxc/config/$ostype.userns.conf\n"
+       }
     } else {
        die "implement me";
     }
 
+    # Should we read them from /etc/subuid?
+    if ($unprivileged && !$custom_idmap) {
+       $raw .= "lxc.id_map = u 0 100000 65536\n";
+       $raw .= "lxc.id_map = g 0 100000 65536\n";
+    }
+
     if (!has_dev_console($conf)) {
        $raw .= "lxc.console = none\n";
        $raw .= "lxc.cgroup.devices.deny = c 5:1 rwm\n";
@@ -1224,6 +1242,8 @@ sub update_pct_config {
                my $mountpoint = parse_ct_mountpoint($conf->{$opt});
                add_unused_volume($conf, $mountpoint->{volume});
                delete $conf->{$opt};
+           } elsif ($opt eq 'unprivileged') {
+               die "unable to delete read-only option: '$opt'\n";
            } else {
                die "implement me"
            }
@@ -1296,6 +1316,8 @@ sub update_pct_config {
         } elsif ($opt eq 'rootfs') {
            check_protection($conf, "can't update CT $vmid drive '$opt'");
            die "implement me: $opt";
+       } elsif ($opt eq 'unprivileged') {
+           die "unable to modify read-only option: '$opt'\n";
        } else {
            die "implement me: $opt";
        }

diff --git a/src/PVE/LXC/Create.pm b/src/PVE/LXC/Create.pm
index cb9bbff83358a96ad4931be516ffe64060480397..cb9c85ab9aff85759be1e738ed7f0688f6d8d29a 100644 (file)
--- a/src/PVE/LXC/Create.pm
+++ b/src/PVE/LXC/Create.pm
@@ -156,7 +156,7 @@ sub restore_and_configure {
            my $oldconf = PVE::LXC::parse_pct_config("/lxc/$vmid.conf", $raw);
 
            foreach my $key (keys %$oldconf) {
-               next if $key eq 'digest' || $key eq 'rootfs' || $key eq 'snapshots';
+               next if $key eq 'digest' || $key eq 'rootfs' || $key eq 'snapshots' || $key eq 'unprivileged';
                $conf->{$key} = $oldconf->{$key} if !defined($conf->{$key});
            }
            unlink($pct_cfg_fn);
@@ -197,7 +197,7 @@ sub create_rootfs {
        PVE::LXC::destroy_lxc_container($storage_cfg, $vmid, $old_conf);
 
        # do not copy all settings to restored container
-       foreach my $opt (qw(rootfs digest snapshots arch ostype)) {
+       foreach my $opt (qw(rootfs digest snapshots arch ostype unprivileged)) {
            delete $old_conf->{$opt};
        }
        foreach my $opt (keys %$old_conf) {