lxc unpriviliged containers do not start.

Maintainer: @ratkaj
Environment: amd64, Sophos XG-210 v3, OpenWrt 23.05.rc2

Description:

Starting an unprivileged lxc container fails.

lxc-start: test: ../src/lxc/utils.c: safe_mount: 1220 Operation not permitted - Failed to mount "proc" onto "/usr/lib/lxc/rootfs/proc"
lxc-start: test: ../src/lxc/conf.c: lxc_mount_auto_mounts: 811 Operation not permitted - Failed to mount "proc" on "/usr/lib/lxc/rootfs/proc" with flags 14
lxc-start: test: ../src/lxc/conf.c: lxc_setup: 4403 Failed to setup first automatic mounts
lxc-start: test: ../src/lxc/start.c: do_start: 1272 Failed to setup container "test"
lxc-start: test: ../src/lxc/sync.c: sync_wait: 34 An error occurred in another process (expected sequence number 3)
lxc-start: test: ../src/lxc/start.c: __lxc_start: 2107 Failed to spawn container "test"
lxc-start: test: ../src/lxc/tools/lxc_start.c: main: 306 The container failed to start
lxc-start: test: ../src/lxc/tools/lxc_start.c: main: 311 Additional information can be obtained by setting the --logfile and --logpriority options

Container Config

# Template used to create this container: /usr/share/lxc/templates/lxc-download
# Parameters passed to the template: --dist ubuntu --release jammy --arch amd64 --server images.linuxcontainers.org
# Template script checksum (SHA-1): 3fb72537313c2b568fac47e25f809ebba51c2525
# For additional config options, please look at lxc.container.conf(5)

# Uncomment the following line to support nesting containers:
#lxc.include = /usr/share/lxc/config/nesting.conf
# (Be aware this has security implications)


# Distribution configuration
lxc.include = /usr/share/lxc/config/common.conf
lxc.include = /usr/share/lxc/config/userns.conf
lxc.arch = linux64

# Container specific configuration
lxc.idmap = u 0 100000 65536
lxc.idmap = g 0 100000 65536
lxc.rootfs.path = btrfs:/srv/lxc/test/rootfs
lxc.uts.name = test

# Network configuration
lxc.net.0.type = veth
lxc.net.0.link = br-lan
lxc.net.0.flags = up
lxc.net.0.hwaddr = 00:16:3e:af:d4:fd

/etc/subuid:

root:100000:10000001

/etc/subgid:

root:100000:10000001

After following the tips in this forum post, the unprivileged containers will start. I added the following to /etc/rc.local to make the change persistent.

I found a possible patch in the lxc repo here. Perhaps the lxc package could be patched for a future build.

diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index d691a8b..be23c4d 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -697,7 +697,7 @@ static int lxc_mount_auto_mounts(struct lxc_handler *handler, int flags)
 		 * it's busy...  MS_REMOUNT|MS_BIND|MS_RDONLY seems to work for
 		 * kernels as low as 2.6.32...
 		 */
-		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "proc",                                           "%r/proc",                    "proc",  MS_NODEV|MS_NOEXEC|MS_NOSUID,                    NULL, false },
+		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "proc",                                           "%r/proc",                    "proc",  MS_NODEV|MS_NOEXEC|MS_NOSUID|MS_NOATIME,         NULL, false },
 		/* proc/tty is used as a temporary placeholder for proc/sys/net which we'll move back in a few steps */
 		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sys/net",                                "%r/proc/tty",                NULL,    MS_BIND,                                         NULL, true, },
 		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, "%r/proc/sys",                                    "%r/proc/sys",                NULL,    MS_BIND,                                         NULL, false },
@@ -707,7 +707,7 @@ static int lxc_mount_auto_mounts(struct lxc_handler *handler, int flags)
 		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_MIXED, NULL,                                             "%r/proc/sysrq-trigger",      NULL,    MS_REMOUNT|MS_BIND|MS_RDONLY,                    NULL, false },
 		{ LXC_AUTO_PROC_MASK, LXC_AUTO_PROC_RW,    "proc",                                           "%r/proc",                    "proc",  MS_NODEV|MS_NOEXEC|MS_NOSUID,                    NULL, false },
 		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_RW,     "sysfs",                                          "%r/sys",                     "sysfs", 0,                                               NULL, false },
-		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_RO,     "sysfs",                                          "%r/sys",                     "sysfs", MS_RDONLY,                                       NULL, false },
+		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_RO,     "sysfs",                                          "%r/sys",                     "sysfs", MS_RDONLY|MS_NOATIME,                            NULL, false },
 		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  "sysfs",                                          "%r/sys",                     "sysfs", MS_RDONLY|MS_NOSUID|MS_NODEV|MS_NOEXEC,          NULL, false },
 		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  "%r/sys/devices/virtual/net",                     "%r/sys/devices/virtual/net",  NULL,   MS_BIND,                                         NULL, false },
 		{ LXC_AUTO_SYS_MASK,  LXC_AUTO_SYS_MIXED,  NULL,                                             "%r/sys/devices/virtual/net",  NULL,   MS_REMOUNT|MS_NOSUID|MS_NODEV|MS_NOEXEC,         NULL, false },

Start by reviewing the reported failure on OpenWrt 23.05.rc2 and the linked LXC issue and proposed changes in src/lxc/conf.c. Compare how the OpenWrt package incorporates LXC sources, then verify the package with an unprivileged container using the supplied configuration. Done means the container starts without the reported proc mount permission error.