4

I am running debian stretch on my host and I try to configure openvpn inside an Ubuntu xenial LXC guest.

Because openvpn needs a tun device, I followed guides such as http://heider.io/blog/2013/10/26/openvpn-in-a-lxc-container/ to allow tun device creation inside the container.

Unfortunately, setting lxc.cgroup.devices.allow = c 10:200 rwm in the container's config file gives me this error:

  lxc-start ERROR    lxc_cgfsng - cgroups/cgfsng.c:cgfsng_setup_limits:1949 - No such file or directory - Error setting devices.allow to c 10:200 rwm for ubuntu
  lxc-start ERROR    lxc_start - start.c:lxc_spawn:1236 - Failed to setup the devices cgroup for container "ubuntu".
  lxc-start ERROR    lxc_start - start.c:__lxc_start:1346 - Failed to spawn container "ubuntu".

Edit

I am trying to achieve this in an unpriviledged LXC container, here is the full configuration of this container:

# Distribution configuration
lxc.include = /usr/share/lxc/config/ubuntu.common.conf
lxc.include = /usr/share/lxc/config/ubuntu.userns.conf
lxc.arch = x86_64

# Container specific configuration
lxc.id_map = u 0 100000 65536
lxc.id_map = g 0 100000 65536
lxc.rootfs = /home/myuser/.local/share/lxc/ubuntu/rootfs
lxc.rootfs.backend = dir
lxc.utsname = ubuntu

# Network configuration
lxc.network.type = veth
lxc.network.flags = up
lxc.network.link = br0
lxc.network.hwaddr = 00:11:22:aa:bb:cc
lxc.network.ipv4 = 192.168.1.101/24
lxc.network.ipv4.gateway = 192.168.1.1

# trying to get /dev/net/tun inside container
lxc.cgroup.devices.allow = c 10:200 rwm

When I do not set the devices.allow option in order to be able to start the container, I can see processes inside the container are in the cgroup /sys/fs/cgroup/devices/user.slice (their PID, viewed from outside the container, are actually in the cgroup.procs file of this subdirectory), and from here :

$ cat devices.list 
a *:* rwm

but from inside the container

# mknod /dev/net/tun c 10 200
mknod: /dev/net/tun: Operation not permitted
Improve this question
8
  • You’re probably missing kernel support for “devices” control groups.
    – Daniel B
    Commented Apr 24, 2017 at 13:34
  • Why exactly do you want to do this in a container? It can be done more easily by setting up a second network namespace, which is the same thing the container does, except there is none of the container overhead.
    – MariusMatutiae
    Commented Apr 24, 2017 at 13:52
  • @MariusMatutiae : It's for test purposes, I want a fully functionnal linux container without having to run a virtual machine.
    – omega
    Commented Apr 24, 2017 at 18:49
  • @DanielB: How could I check that ? What could I do for ?
    – omega
    Commented Apr 24, 2017 at 18:50
  • So I installed the current Debian from scratch and the option works fine. Please verify that all cgroup filesystems (cpuset, cpu/cpuacct, devices, freezer, net_cls/net_prio, blkio and perf_event) are correctly mounted at /sys/fs/cgroup. If not, there may be an error somewhere in your boot configuration. Are you running systemd? Is your Debian installation old and upgrated?
    – Daniel B
    Commented Apr 24, 2017 at 20:41

1 Answer 1

Reset to default
1

Adding

lxc.mount.entry = /dev/net/tun dev/net/tun none bind,create=file

in the container's config file bind-mount the tun char device inside the container which solves the problem.

Improve this answer
2
  • Thanks, this worked for me but don't forget to run openvpn as root inside of the container (I forgot to use sudo and thought the problem came from somewhere else).
    – baptx
    Commented Jan 28, 2019 at 19:36
  • Note that you have to add this in the container configuration, for example .local/share/lxc/debian/config (replace debian with your container name). I was wondering why it did not work because I added this line in .config/lxc/default.conf instead. By the way, I noticed a configuration like lxc.mount.entry = /dev/net dev/net none bind,create=dir (from wiki.archlinux.org/index.php/…) works also. Is this solution better than lxc.mount.entry = /dev/net/tun dev/net/tun none bind,create=file from your answer? Creating the file seems not needed.
    – baptx
    Commented May 20, 2020 at 17:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .