-
Notifications
You must be signed in to change notification settings - Fork 103
Description
Expected behavior:
Unprivileged LXC will work in an encrypted home directory across reboot/purge
Actual behavior:
Need to 'modify' rootfs files or store them unencrypted.
I am using an encrypted home directory on Ubuntu 18.04 based on instructions at instructions at: tlbdk.github.io/ubuntu/2018/10/22/fscrypt.html
fscrypt 0.2.2-0ubuntu2.1 amd64 Tool for managing Linux filesystem encryption
Further, I can create an unprivileged LXC container in my home directory (for example)
lxc-create -t download -n httpd -- -d ubuntu -r trusty -a amd64
lxc-start -n httpd
lxc-attach -n httpd
This all works as expected.
This breaks after:
- rebooting the system
- 'fscrypt purge .' and logging out and back in.
lxc-start fails with the following error:
lxc-start: httpd: lxccontainer.c: wait_on_daemonized_start: 842 Received container state "ABORTING" instead of "RUNNING"
The log gives the following error:
lxc-start httpd 20190109202219.424 NOTICE start - start.c:start:2025 - Exec'ing "/sbin/init"
lxc-start httpd 20190109202219.424 ERROR start - start.c:start:2028 - Required key not available - Failed to exec "/sbin/init"
f I run the following command, I can again run the LXC instance:
lxc-usernsexec -m b:0:231072:65536 -- chroot .local/share/lxc/httpd/rootfs /usr/bin/find . -exec touch {} \;