Cdtjkyj

I'm trying to set up unprivileged LXC containers and failing at every turn. I think I've followed every relevant step of the guide:

• 
  

  Normal users are allowed to create unprivileged containers:

  
  
  

  $ sysctl kernel.unprivileged_userns_clone
  
  kernel.unprivileged_userns_clone = 1
  
  

  
  


• 
  

  The control groups PAM module is enabled:

  
  
  

  $ grep -F pam_cgfs.so /etc/pam.d/system-login
  
  session optional pam_cgfs.so -c freezer,memory,name=systemd,unified
  
  

  
  


• 
  

  The UID and GID mappings are set up:

  
  
  

  $ cat /etc/lxc/default.conf
  
  lxc.idmap = u 0 100000 65536
  
  lxc.idmap = g 0 100000 65536
  
  lxc.net.0.type = veth
  
  lxc.net.0.link = lxcbr0
  
  lxc.net.0.flags = up
  
  lxc.net.0.hwaddr = 00:16:3e:xx:xx:xx
  
  $ cat /etc/subuid
  
  root:100000:65536
  
  $ cat /etc/subgid
  
  root:100000:65536
  
  

  
  


• 
  

  The network is set up:

  
  
  

  $ grep --invert-match --regexp='^#' --regexp='^$' /etc/default/lxc-net
  
  USE_LXC_BRIDGE="true"
  
  LXC_BRIDGE="lxcbr0"
  
  LXC_ADDR="10.0.3.1"
  
  LXC_NETMASK="255.255.255.0"
  
  LXC_NETWORK="10.0.3.0/24"
  
  LXC_DHCP_RANGE="10.0.3.2,10.0.3.254"
  
  LXC_DHCP_MAX="253"
  
  

  
  


• 
  

  The services look fine:

  
  
  

  $ systemctl status --lines=0 --no-pager lxc.service lxc-net.service 
  
  ● lxc.service - LXC Container Initialization and Autoboot Code
  
     Loaded: loaded (/usr/lib/systemd/system/lxc.service; disabled; vendor preset: disabled)
  
     Active: active (exited) since Fri 2019-03-08 15:31:47 NZDT; 40min ago
  
       Docs: man:lxc-autostart
  
             man:lxc
  
   Main PID: 4147 (code=exited, status=0/SUCCESS)
  
      Tasks: 0 (limit: 4915)
  
     Memory: 0B
  
     CGroup: /system.slice/lxc.service
  
  
  
  ● lxc-net.service - LXC network bridge setup
  
     Loaded: loaded (/usr/lib/systemd/system/lxc-net.service; enabled; vendor preset: disabled)
  
     Active: active (exited) since Fri 2019-03-08 15:31:45 NZDT; 40min ago
  
   Main PID: 4099 (code=exited, status=0/SUCCESS)
  
      Tasks: 1 (limit: 4915)
  
     Memory: 8.4M
  
     CGroup: /system.slice/lxc-net.service
  
             └─4121 dnsmasq -u dnsmasq --strict-order --bind-interfaces --pid-file=/run/lxc/dnsm…
  
  

  
  


• The packages are up to date and I've just rebooted.

Even so, I can't create containers:

$ lxc-create -n test -t download

lxc-create: test: parse.c: lxc_file_for_each_line_mmap: 100 No such file or directory - Failed to open file "/home/user/.config/lxc/default.conf"

lxc-create: test: conf.c: chown_mapped_root: 3179 No uid mapping for container root

lxc-create: test: lxccontainer.c: do_storage_create: 1310 Error chowning "/home/user/.local/share/lxc/test/rootfs" to container root

lxc-create: test: conf.c: suggest_default_idmap: 4801 You do not have subuids or subgids allocated

lxc-create: test: conf.c: suggest_default_idmap: 4802 Unprivileged containers require subuids and subgids

lxc-create: test: lxccontainer.c: do_lxcapi_create: 1891 Failed to create (none) storage for test

lxc-create: test: tools/lxc_create.c: main: 327 Failed to create container test

Is there anything obviously wrong with this setup? There's no mention anywhere in the linked article about ~/.config/lxc/default.conf, and I don't understand why it says I haven't allocated subuids and subgids.

Additional info:

• Running lxc-create as root works, but this is explicitly about creating containers as a normal user.


• 
  

  cp /etc/lxc/default.conf ~/.config/lxc/default.conf gets rid of the complaint about the configuration file, but results in this message instead:

  
  
  

  
  

  lxc-create: playtime: conf.c: chown_mapped_root: 3279 lxc-usernsexec failed: No such file or directory - Failed to open ttyNo such file or directory - Failed to open tt