[libvirt] LXC container with user namespace and root fs on loop device - how it's supposed to work?

[Dmitry Guryanov]

Hello,

It's not possible to start LXC container inside user namespace with root 
filesystem on loop device, because it tries to mount root FS from 
container's user namespace (lxcContainerSetupPivotRoot) and gets EPERM:

2015-03-19 12:48:18.545+0000: 1: debug : lxcContainerChild:2278 : 
Tearing down container
Failed to mount device /dev/loop0 to 
/var/run/libvirt/lxc/instance-0000000b.root: Operation not permitted



So I wonder, if someone tried to run LXC container with such 
configuration with success.


Here is my config:

<domain type='lxc'>
   <name>instance-0000000b</name>
   <uuid>d918c415-0a00-4c12-896e-19e4711111d3</uuid>
   <memory unit='KiB'>524288</memory>
   <currentMemory unit='KiB'>524288</currentMemory>
   <cputune>
     <shares>1024</shares>
   </cputune>
   <os>
     <type arch='x86_64'>exe</type>
     <init>/sbin/init</init>
     <cmdline>console=tty0 console=ttyS0</cmdline>
   </os>
   <idmap>
     <uid start='0' target='10000' count='1000'/>
     <gid start='0' target='10000' count='1000'/>
   </idmap>
   <clock offset='utc'/>
   <on_poweroff>destroy</on_poweroff>
   <on_reboot>restart</on_reboot>
   <on_crash>destroy</on_crash>
   <devices>
     <emulator>/usr/libexec/libvirt_lxc</emulator>
     <filesystem type='file' accessmode='passthrough'>
       <driver type='loop' format='raw'/>
       <source file='/root/2.img'/>
       <target dir='/'/>
     </filesystem>
     <console type='pty'>
       <target type='lxc' port='0'/>
     </console>
   </devices>
</domain>

-- 
Dmitry Guryanov