Create a new LXC Container⌗
In Proxmox VE create a unprivileged LXC container with
fuse=1,keyctl=1,mknod=1,nesting=1 (I’m not sure if all are needed).
In this case I use a Ubuntu 18.04 container.
fuse-overlayfs is a similar to overlayfs runs in userspace and can be used without root permissions1. Unlike overlayfs, fuse-overlayfs can be also used when the backing filesystem is ZFS, like on Proxmox VE.
Then inside the container, install a static version of fuse-overlayfs.
and place it in
/usr/local/bin so it’s named
apt-get install docker.io
In my case this installed the version 20.10.2
# docker info Client: Context: default Debug Mode: false Server: Containers: 2 Running: 0 Paused: 0 Stopped: 2 Images: 1 Server Version: 20.10.2 Storage Driver: fuse-overlayfs Logging Driver: json-file Cgroup Driver: cgroupfs Cgroup Version: 1 (...)
To my surprise, it auto-detected that I have
fuse-overlayfs installed and uses it. And this although I’m not using rootless Docker!
Now I can use Docker nested in LXC on Proxmox VE without the efficiency problems of VFS.
It would be also interesting to use Podman in LXC on Proxmox PVE but I couldn’t get it working so far. I know it’s possible to use rootless Podman in unprivileged LXD container using the
security.nesting flag. However LXC on PVE is a bit different from LXD.
Debian 10 and similar systems also support overlayfs without root but this isn’t working on a ZFS filesystem and it’s not directly usable inside a container. In newer kernel versions unprivileged overlay mount is possible by default. This could mean that unprivileged overlay will also be supported in Fedora-like distributions in the future. ↩︎