Running Docker in Unprivileged Proxmox LXC Containers

Introduction

Running Docker inside an unprivileged LXC container on Proxmox VE can enhance your deployment flexibility while maintaining security. However, it requires specific configurations to function correctly. In this guide, we will cover the necessary steps, common pitfalls, and how to manage these settings using NexoVirt.

Why Use Unprivileged Containers?

Unprivileged containers run as a non-root user, providing an additional layer of security. If a container is compromised, the attacker has limited access to the host system. However, certain features need to be enabled to run Docker smoothly.

Required Features: nesting=1 and keyctl=1

1. Nesting: This allows the container to run its own containers, which is essential for Docker. Without this, Docker will not function correctly inside the LXC.
2. Keyctl: This is required for managing kernel keyrings. It enhances Docker's ability to manage secrets securely.

Creating the LXC Container

Here’s how to create an unprivileged LXC container with Docker:

1. Create the container using the following command:

   pct create 100 /var/lib/lxc/100/config --storage local

   Replace 100 with your desired container ID.

2. Edit the container configuration file to enable nesting and keyctl. Open the config file:

   nano /var/lib/lxc/100/config

   Add these lines:

   features: keyctl=1,nesting=1

   This enables the necessary features for Docker.

3. Start the container:

   pct start 100

4. Access the container:

   pct enter 100

5. Install Docker: Inside the container, run:

   apt update && apt install -y docker.io
   systemctl start docker
   systemctl enable docker

Common Failure Modes

While setting up Docker in an unprivileged container, you may encounter common issues:

1. OverlayFS Permission Denied

If you see errors related to permission denied when using OverlayFS, consider switching to the vfs or fuse-overlayfs storage driver. To do this:

• Edit the Docker daemon configuration:

  nano /etc/docker/daemon.json

• Add the following:

  {
  "storage-driver": "vfs"
  }

• Restart Docker:

  systemctl restart docker

2. Systemd/Proc-Mount Warnings

You may encounter warnings related to proc-mount when using certain features. This typically happens when the container does not have permission to set certain mounts. Ensure that your container is set up correctly with the features mentioned earlier.

Security Trade-offs: Privileged vs. Unprivileged Containers

Using unprivileged containers is generally more secure because they limit the potential attack surface. However, they come with their limitations:

• Privileged Containers: Have root access to the host system, allowing for more flexibility but at the cost of security. If compromised, an attacker could gain control over the host.
• Unprivileged Containers: Provide better isolation but may require workarounds for certain functionalities, like running Docker.

Using NexoVirt for Container Features

NexoVirt simplifies the creation and management of LXC containers by allowing you to set these features at creation time. When creating a new container through the NexoVirt interface or REST API:

• Checkboxes: You will find options to enable nesting and keyctl directly in the UI for easy configuration.
• REST API Fields: Use the following JSON payload to set these features:

   {
     "features": {
       "nesting": "1",
       "keyctl": "1"
     }
   }

  This removes the need to edit the host's configuration files manually, streamlining your workflow.

Conclusion

Running Docker in an unprivileged LXC container on Proxmox VE is a powerful way to enhance your development and deployment capabilities while maintaining security. By understanding the necessary configurations and using tools like NexoVirt, you can simplify the management of your containerized applications.

For more information, check the Proxmox documentation and the Docker official docs for the latest features and best practices.