I'm trying to run a Docker container inside an LXC container. However doing so causes me to get the following error: [root@DH-DockerLXC01 alex]# docker run fedora bash docker: Error response from daemon: OCI runtime create failed: container_linux.go:337: starting container process caused "apply caps: operation not permitted": unknown. ERRO[0001] error waiting for container: context canceled I presume I need to set some configuration to be more permissive, but since I've created the LXC container with virt-manager I'm not sure where to start.

Note that the LXC container is using a chroot for storage, which AFAIK should allow docker to use full AUFS without any problems, but if I'm wrong please correct me.


As it turns out, LXC, by default, will not allow containers to have the CAP_MKNOD capability, as it could theoretically allow a container to take over a host. This can be overridden, but it's not very well documented. Based on a pull request from 2015 in a mailing list, I've been able to piece together a bit of XML that does it. You just have to edit the container definition, which is located in /etc/libvirt/lxc/[container name]/

  <capabilities policy='allow'>
    <mknod state='on'/>

Note that the file may already contain a definition, in that case, paste the section inside that section. You may have to restart libvirt before it takes effect with systemctl restart libvirtd.service (this will not restart existing containers or VMs, only the service).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.