Pour faire cohabiter différentes instances de Libretime, installation de chacune dans un container LXC sans privilèges pour plus de sécurité …

Sur une base d'Ubuntu 18.04

sudo apt-get install lxc

Créer un utilisateur spécifique pour exécuter les containers

adduser lxcrunner

Permettre à cet utilisateur de créer des devices réseau virtuels

nano /etc/lxc/lxc-usernet

y ajouter

lxcrunner veth lxcbr0 10

Se logguer en tant que user

adduser lxcrunner

Fix environmental variables. Otherwise you might have issues creating containers later

lxcrunner> unset XDG_RUNTIME_DIR XDG_SESSION_ID

Find out the namespaces allowed for the user lxc. The wildcard in the command below will match both suid and guid files. We will map the LXC container to these regions.

lxcrunner> cat /etc/s*id|grep $USER
lxcrunner:624288:65536
lxcrunner:624288:65536

From the output, we can see that both assigned suid and guid values start at 624288 and runs through the next 65536 integers.

Let us set up configuration files as required by LXC before starting a container. The required file is in ~/.config/lxc/default.conf.

lxcrunner> mkdir -p ~/.config/lxc/
lxcrunner> vim ~/.config/lxc/default.conf

Add in the following lines. Notice that the syntax might be different from what you find online. I am using the latest version of LXC, v3.0.3.

We are setting the network interface type to be veth and creating a new bridge lxcbr0. We will come back to these later. Your hwaddr may differ; you can see the default values in /etc/lxc/default.conf. .

lxc.net.0.type = veth
lxc.net.0.link = lxcbr0
lxc.net.0.flags = up
lxc.net.0.hwaddr = 00:16:3e:xx:xx:xx
lxc.idmap = u 0 624288 65536
lxc.idmap = g 0 624288 65536

Créer le container en tant qu'utilisateur lxcrunner

lxcrunner>lxc-create -n musique -t download

Choisir ubuntu bionic amd64

Le démarrer

lxcrunner>lxc-start musique

Vérifier que ça marche

lxcrunner>lxc-ls -f

Entrer dans le container

lxcrunner>lxc-attach musique

Désactiver ipv6 si ping images.linuxcontainers.org est résolu en ipv6

• https://linuxconfig.org/how-to-disable-ipv6-address-on-ubuntu-18-04-bionic-beaver-linux

• LXC container unpriviledged https://blog.warmwolf.com/2020/04/securing-wordpress-unprivileged-lxc-container-on-ubuntu/2/
• Créer un répertoire partagé entre les containers https://askubuntu.com/questions/691039/adding-a-shared-host-directory-to-an-lxc-lxd-container