-
Notifications
You must be signed in to change notification settings - Fork 766
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Error out of disk space when install in a LXC container #65
Comments
Hi @raguilera82 , What is your lxc profile look like? I had partial success in running microk8s with this one:
|
@raguilera82 , seems docker inside lxc containers does not play well with ZFS https://github.com/lxc/lxd/issues/2305 could you use dir instead? |
Hi @ktsakalozos Thanks for your answers. My experience with LXC containers (version 3.2) is that they work properly with Docker and ZFS (this is the recommend storage) if you enabled nesting and privileged properties of security. For example, I have a LXC container with an instance of GitLab and I can work with Docker and docker-compose without problems into the container. The issue that you have mentioned is quite old. Now, I can not change the system storage, maybe for that reason I will get back to Minikube until this issue will be fixed. Thank you very much for your time. |
Thank you for giving microk8s a try |
Hi @raguilera82 , After some experimentation with LXC and zfs I got microk8s working. Here is what I had to do:
Most of the work is on the lxc profile so there is not really much to do for microk8s. Here is an ascii cast of the above steps: https://asciinema.org/a/198964 Thanks |
Thank you @ktsakalozos Your steps work perfectly! Also, I have tried with ubuntu:16.04 with your microk8s profile and all works like a charm. Thank you very much for your time! |
@ktsakalozos Thanks for the info above! I have a question, I see we're removing a lot of the security constraints from lxc .. Can you comment on how contained is that lxc container now? Is it still a little hard to break out of a lxc container with that configuration, or does it basically have full host control without much effort? Basically can I let fairly hostile guests in that lxc with some level of guarantee it's not too easy to break out Thanks! |
Hi @kim0 , I am not entirely sure what you are asking me. I would say it is a little hard to reach the host but not hard enough. MicroK8s, can get out of the lxc confinement and can access the host machine and this is the purpose of the profile we apply. MicroK8s is expected to run on the host and you are expected to trust it. What you might not trust is the user workload that runs inside Kubernetes and that is constrained by docker containers. You should be aware that MicroK8s is not supposed to be deployed in production or in untrusted environments. Its purpose is mainly to assist in application development locally. If security is of concern you should look into production grade Kubernetes solutions. Having said that here are a few ways to harden MicroK8s.
Thanks |
Hi,
I have an error when I am trying to install microk8s in a LXC container with nesting and privileged security to true. I follow these steps:
At that moment I see this info:
I have checked my ZFS storage and I have not a problem with my disk space.
Can anyone reproduce it with LXC container? Any ideas?
Thank you very much
The text was updated successfully, but these errors were encountered: