I would like to create & start LXC container for specific UID & GID for below purpose.Login to root user(sudo user) , Do lxc-create of container, then do lxc-start of the container with same root user id. while staring container I need to start all the process inside the container with low privilege(un-priv) user id in which access to the user is restricted to only container and not to host.basically when I say ps -axu , I should be able to see low privilege user id for all the container process.PS : my host which is VM with ubuntu 16.04 LTS is systemd init system and my container(type busybox) will be started with systemd services . for that I have modified busybox template as belowCode:lxc.init_cmd=/lib/systemd/systemdand also removed all rcS & inittab related scripts in the busybox default templateand for user id map , I have changed as below in my templateCode:   lxc.id_map=u 0 165536 65536   lxc.id_map=g 0 165536 65536after that I just followed below stepsContainer created normally with below commend (and I cross checked config file at /var/lib/lxc/testecho_uid/config to make sure that all my template changes are reflected or not, found ok)Code:sudo lxc-create -n testecho_uid -t busybox_systemd_uidEntered below command to start the container with foregroundCode:sudo lxc-start -n testecho_uid -FError is :vijay@vijay-VirtualBox:~$ sudo lxc-start -n testecho_uid -Flxc-start: cgfsng.c: cgfsng_create: 1072 No such file or directory - Failed to create /sys/fs/cgroup/systemd//lxc/testecho_uid: No such file or directory                                         lxc-start: cgfsng.c: cgfsng_create: 1072 No such file or directory - Failed to create /sys/fs/cgroup/systemd//lxc/testecho_uid-1: No such file or directory                                                                                    newuidmap: uid range [0-65536) -> [165536-231072) not allowed                                 lxc-start: start.c: lxc_spawn: 1161 failed to set up id mapping                                                                                                lxc-start: start.c: __lxc_start: 1353 failed to spawn 'testecho_uid'                                                    newuidmap: uid range [0-65536) -> [165536-231072) not allowedlxc-start: conf.c: userns_exec_1: 4315 Error setting up child mappingslxc-start: cgfsng.c: recursive_destroy: 983 Error destroying /sys/fs/cgroup/systemd//lxc/testecho_uid-2newuidmap: uid range [0-65536) -> [165536-231072) not allowedlxc-start: conf.c: userns_exec_1: 4315 Error setting up child mappingslxc-start: cgfsng.c: recursive_destroy: 983 Error destroying /sys/fs/cgroup/perf_event//lxc/testecho_uid-2newuidmap: uid range [0-65536) -> [165536-231072) not allowedlxc-start: conf.c: userns_exec_1: 4315 Error setting up child mappingslxc-start: cgfsng.c: recursive_destroy: 983 Error destroying /sys/fs/cgroup/hugetlb//lxc/testecho_uid-2newuidmap: uid range [0-65536) -> [165536-231072) not allowedlxc-start: conf.c: userns_exec_1: 4315 Error setting up child mappingslxc-start: cgfsng.c: recursive_destroy: 983 Error destroying /sys/fs/cgroup/cpu//lxc/testecho_uid-2newuidmap: uid range [0-65536) -> [165536-231072) not allowedlxc-start: conf.c: userns_exec_1: 4315 Error setting up child mappingslxc-start: cgfsng.c: recursive_destroy: 983 Error destroying /sys/fs/cgroup/memory//lxc/testecho_uid-2newuidmap: uid range [0-65536) -> [165536-231072) not allowedlxc-start: conf.c: userns_exec_1: 4315 Error setting up child mappingslxc-start: cgfsng.c: recursive_destroy: 983 Error destroying /sys/fs/cgroup/pids//lxc/testecho_uid-2newuidmap: uid range [0-65536) -> [165536-231072) not allowedlxc-start: conf.c: userns_exec_1: 4315 Error setting up child mappingslxc-start: cgfsng.c: recursive_destroy: 983 Error destroying /sys/fs/cgroup/blkio//lxc/testecho_uid-2newuidmap: uid range [0-65536) -> [165536-231072) not allowedlxc-start: conf.c: userns_exec_1: 4315 Error setting up child mappingslxc-start: cgfsng.c: recursive_destroy: 983 Error destroying /sys/fs/cgroup/cpuset//lxc/testecho_uid-2newuidmap: uid range [0-65536) -> [165536-231072) not allowedlxc-start: conf.c: userns_exec_1: 4315 Error setting up child mappingslxc-start: cgfsng.c: recursive_destroy: 983 Error destroying /sys/fs/cgroup/net_cls//lxc/testecho_uid-2newuidmap: uid range [0-65536) -> [165536-231072) not allowedlxc-start: conf.c: userns_exec_1: 4315 Error setting up child mappingslxc-start: cgfsng.c: recursive_destroy: 983 Error destroying /sys/fs/cgroup/devices//lxc/testecho_uid-2newuidmap: uid range [0-65536) -> [165536-231072) not allowedlxc-start: conf.c: userns_exec_1: 4315 Error setting up child mappingslxc-start: cgfsng.c: recursive_destroy: 983 Error destroying /sys/fs/cgroup/freezer//lxc/testecho_uid-2lxc-start: lxc_start.c: main: 344 The container failed to start.lxc-start: lxc_start.c: main: 348 Additional information can be obtained by setting the --logfile and --logpriority options.Can anyone please tell me whether I am missing anything here.below are my ubuntu 16.04 setup for uid & gidCode:vijay@vijay-VirtualBox:~$ sudo cat  /etc/subgidvijay:100000:65536usrlxc:165536:65536vijay:165536:65537Code:vijay@vijay-VirtualBox:~$ sudo cat  /etc/subuidvijay:100000:65536usrlxc:165536:65536vijay:165536:65537if above my question is not clear , please see below one more question similar to same scenario.Is there a way to access(lxc start & attach) unprivileged container from root user or sudo user . That is , I have created , started and attached un-priv container using lxc user(not sudo user/root user) by login into lxc user without any issue. Now I would like to start & attach the lxc user created un-priv container from root user or sudo user. Is that possible? if yes please let me know how to do that?. I checked lxc-ls from sudo/root user and it just listed only the containers created by sudo user and does not display the container created by lxc user. or All the processes/threads of Privilege container can be executed/run for specific UID(eg: lxc user) by root/sudo user while doing lxc-start or by any means?I also tried by giving below lxc user uid & gid in config(ultimately changing busybox template). it gave above comment error.Code: lxc.id_map=u 0 165536 65536  lxc.id_map=g 0 165536 65536I tried all the possible way , but no luck , please educate me this topic.Below are user detail in my ubuntu desktop lxc user --> usrlxc which I have created as part of un-priv container creation experiment.Sudo user --> vijay - this is sudo user in my ubuntu 16.04 Virtual box machine.root user --> # which all of you awarePlease let me know if any information from my ubuntu setup or lxc config
Uid/Gid privileged LXC container : systemd lxc-start failed on ubuntu 16.04
systemd;lxc;uid