• 0 Posts
  • 141 Comments
Joined 1 year ago
cake
Cake day: July 13th, 2023

help-circle









  • The issue is that the docker container will still be running as the LXC’s root user even if you specify another user to run as in the docker compose file or run command, and if root doesn’t have access to the dir the container will always fail.

    The solution to this is to remap the unprivileged LXC’s root user to a user on the Proxmox host that has access to the dir using the LXC’s config file, mount the container’s filesystem using pct mount, and then chown everything in the container owned by the default root mapped user (100000).

    These are the commands I use for this:

    find /var/lib/lxc/xxx/rootfs -user 100000 -type f -exec chown username {} +;
    find /var/lib/lxc/xxx/rootfs -user 100000 -type d -exec chown username {} +;
    find /var/lib/lxc/xxx/rootfs -user 100000 -type l -exec chown -h username {} +;
    find /var/lib/lxc/xxx/rootfs -group 100000 -type f -exec chown :username {} +;
    find /var/lib/lxc/xxx/rootfs -group 100000 -type d -exec chown :username {} +;
    find /var/lib/lxc/xxx/rootfs -group 100000 -type l -exec chown -h :username {} +
    

    (Replace xxx with the LXC number and username with the host user/UID)

    If group permissions are involved you’ll also have to map those groups in the LXC config, create them in the LXC with the corresponding GIDs, add them as supplementary groups to the root user in the LXC, and then add them to the docker compose yaml using group_add.

    It’s super confusing and annoying but this is the workflow I’m using now to avoid having to have any resources tied up in VMs unnecessarily.








  • You’d be surprised how often none of that is touched, and I really doubt any repackers are bothering to block any network calls if the original scene release didn’t. I’ve used some equivalent of OpenSnitch that prompts on all network requests that I haven’t explicitly allowed already for the past decade, and at least 90% of all games I downloaded during that time tried to phone home.

    ALWAYS set firewall rules to block internet access to any software you pirate.