Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On Ubuntu 14.04, I have created an unprivileged container that I can manually start and stop.

But I would like this to start and stop along with the system.

I have added the following to the container's configuration: lxc.start.auto = 1 lxc.start.delay = 5

However, the system scripts don't seem to pick unprivileged containers.

There is a thread related to this on linuxcontainers.org, but the solution seems to be restricted to root user.

Is there a clean way to do this for a non-root user (with root user's consent)?

share|improve this question

I'd recommend using the handy @reboot alias in Ubuntu's cron to run lxc-autostart.

As the user that owns the unprivileged container, run crontab -e and add the following line:

@reboot lxc-autostart

share|improve this answer
    
This sounds great. However, there doesn't seem to be a way to run a command on shutdown (via cron). Any ideas? – HRJ Jan 30 '15 at 1:48
    
I'm not aware of any simple ways to run a job at shutdown. You'd probably have to, as root, add an upstart job to shutdown containers for each user that owns them. You could look at /etc/init/lxc.conf for pointers. It's the upstart job that starts the privileged containers. It shouldn't be too hard to copy it and modify it to shutdown unprivileged containers as well. – encoded Jan 30 '15 at 4:29
1  
It occurs to me that, since each process in the container is visible from the host, the container likely doesn't need anything special to shut it down, each process should receive the TERM signal from the host. Chances are you don't need to do anything special on shutdown. If you want to run some scripts or other such things on shutdown, that's different, but most of the processes should have a chance to shutdown normally. – encoded Jan 30 '15 at 19:30
    
Does the crontab approach work? On Ubuntu 14.04, I get the "call to cgmanager_move_pid_sync failed: invalid request" error which occurs because PAM, namely libpam-systemd is not involved in the user changing process. You can see in /proc/self/cgroup that it contains sequences like /user/0.user/1.session instead of /user/1000.user/1.session – Daniel Alder May 23 '15 at 12:20

In case anyone stumbles on to this q&a for the answer to autostarting unprivileged LXC containers (I certainly check back here a lot), here is a solution that works well and which I followed to get it working on my server:

http://blog.lifebloodnetworks.com/?p=2118 by Nicholas J Ingrassellino.

In a nutshell, it involves creating two scripts, and they work together at startup to allow LXC to start the unprivileged containers of each listed user without having to actually log in to the user account; in other words, executing the command as the user with all the CGroups magic intact. In keeping with SO best practice, I'll quote the bones of it here but it's worth reading his original article.

Allow our user account to use the bridge…

echo "$USER veth lxcbr0 1024" | sudo tee -a /etc/lxc/lxc-usernet

Create Upstart script… In /etc/init/lxc-unprivileged.conf add…

description "LXC Unprivileged Containers"
author "Mike Bernson <mike@mlb.org>"

start on started lxc

script
    USERS="[user]"

    for u in $USERS; do
        cgm create all lxc$u
        cgm chown all lxc$u $(id -u $u) $(id -g $u)
        lxc-autostart -L -P /home/$u/.local/share/lxc | while read line;
        do
            set -- $line
            /usr/local/bin/startunprivlxc lxc$u $u $1
            sleep $2
        done
    done
end script

Make sure to replace [user] with your user account.

Create the container start script… In /usr/local/bin/startunprivlxc add…

#!/bin/sh

cgm movepid all $1 $$
sudo -iH -u $2 -- lxc-start -n $3 -d

…and make it executable…

sudo chmod +x /usr/local/bin/startunprivlxc

I'd just like to emphasise that it does appear to work safely, correctly, and doesn't require the root to SSH into the other user accounts.

There is also more on the subject (touching on related gotchas) here: https://gist.github.com/julianlam/4e2bd91d8dedee21ca6f which can be useful in understanding why this is the way it is.

share|improve this answer

I've written a small script to work around the issue, just follow the commented instructions.

share|improve this answer

SORRY: answered too soon. It didn't work even though lxc-ls shows "AUTOSTART" as "YES".

Here is a link with a lot more useful info, and maybe someone can make use of it: http://www.geeklee.co.uk/unprivileged-privileged-containers-ubuntu-14-04-lxc/

I landed on this page because I had the same issue. After reading this thread, I realized that lxc-create cannot write to the usual "/var/lib/lxc/" directory if it is not run with sudo.

I looked around and located the rootfs for my unprivileged container in "~/.local/share/lxc", and putting the two lines in the question into config in that directory.

I looked at the template I used, "lxc-download" for clue, but I think that path was passed in when "lxc-download" is invoked. I have not looked at how the system looks for unprivileged containers during boot.

share|improve this answer

Assuming (which are the mother of all ways to screw things up), you are logging in as the user which "owns" the unprivileged lxc container, then the following command should address what you are looking for...

$ echo "lxc-start -n LXC-CONTAINER-NAME -d" >> .bashrc

This will simply run the above command when you log in via bash. This is also assuming that bash is the login shell. Please replace the name: LXC-CONTAINER-NAME with the name of your LXC container which you'd like to start.

share|improve this answer

I have used a different approach and it is working

1º Add the following entries at container config file

AUTO START CONFIG

lxc.start.auto = 1 lxc.start.delay = 5

2º Create a trust relationship between container user and himself at the same server

userlxc@GEST-4:~$ ssh-keygen -t rsa Generating public/private rsa key pair. Enter file in which to save the key (/home/userlxc/.ssh/id_rsa): Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/userlxc/.ssh/id_rsa. Your public key has been saved in /home/userlxc/.ssh/id_rsa.pub. The key fingerprint is: c9:b4:e1:f3:bf:a3:25:cc:f8:bc:be:b6:80:39:59:98 userlxc@GEST-AMENCIA-4 The key's randomart image is: +--[ RSA 2048]----+ | | | | | o | | * + | | E S | | = * | | = o = . | | . +.+. | | oO=oo | +-----------------+

userlxc@GEST-4:~$ cat .ssh/id_rsa.pub >> .ssh/authorized_keys userlxc@GEST-4:~$ ls -lrt .ssh/authorized_keys -rw-rw-r-- 1 userlxc userlxc 404 Nov 19 17:23 .ssh/authorized_keys

Check the ssh connection, you have to be able to use it without password  userlxc@GEST-4:~$ ssh userlxc@localhost "lxc-ls --fancy"

NAME STATE IPV4 IPV6 AUTOSTART

EXTLXCCONT01 STOPPED - - YES
UBUSER1404USERCONT01-test STOPPED - - NO
UBUSER1404USERLXCCONT01 STOPPED - - NO

3º Create a crontab entry at container owner

@reboot ssh userlxc@localhost "lxc-autostart"

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.