Toto je starší verze dokumentu!



Yes, it's possible. Simply create a new profile (based on lxc-container-default-cgns) and use it for the specific containers. So first run

cp /etc/apparmor.d/lxc/lxc-default-cgns /etc/apparmor.d/lxc/lxc-default-with-nfs

Then edit the new file /etc/apparmor.d/lxc/lxc-default-with-nfs:

replace profile lxc-container-default-cgns by profile lxc-container-default-with-nfs put the NFS configuration (see below) just before the closing bracket (}) NFS configuration

Either write

mount fstype=nfs*,
mount fstype=rpc_pipefs,

or (being more explicit)

mount fstype=nfs,
mount fstype=nfs4,
mount fstype=nfsd,
mount fstype=rpc_pipefs,

and finally run service apparmor reload.

Use the new profile

Edit /etc/pve/lxc/${container_id}.conf and append this line:
lxc.apparmor.profile: lxc-container-default-with-nfs

Then stop the container and start it again, e.g. like this:

pct stop ${container_id} && pct start ${container_id}

Now mounting NFS shares should work.

disabling cluster mode

systemctl stop pve-cluster
systemctl stop corosync
pmxcfs -l
rm /etc/pve/corosync.conf
rm /etc/corosync/*
killall pmxcfs
systemctl start pve-cluster

move vm to another node

vzdump 130 --mode stop
scp tar new_node
pct restore 1234 var/lib/vz/dump/vzdump-lxc-1234-2016_03_02-02_31_03.tar.gz -ignore-unpack-errors 1 -unprivileged

run unms in lxc

lxc.apparmor.profile = unconfined
do /usr/lib/lxc/ID.conf
pak lxc-stop -n ID
lxc-start -n ID
by default je to lxc brutalne unprivileged