Apologies for the delay with the replies.
Before providing workarounds about the Turris LXC images repository usage for unprivileged containers in LuCI, let’s first understand why this is not working.
In brief:
- LXC templates such as
lxc-download or lxc-local are shell scripts used by lxc-create to generate containers root filesystem, notably lxc-download uses a specified download server (LXC images repository) to get the necessary archives (e.g. rootfs.tar.xz, meta.tar.xz)
- As per the
lxc-download template specifications, a download server can have two different indexes (or images lists), one for privileged containers (index-system file) the other for unprivileged containers (index-user file), the correct index-list is automatically selected based on LXC configuration in use
- The Turris LXC images repository only contains an index for privileged containers (
index-system file), this causes the lxc-download template to fail when trying to create an unprivileged container as the required index file is not available on the specified server
With that being said, the best solution would be to have the Turris team to publish an appropriate index for unprivileged containers, awaiting the permanent fix there are several workarounds that can be applied, here below you can find just some proposals.
1 Create your own repository
The instructions to achieve this goes beyond the scope of this post
2 Create a custom copy of the Turris repository
wget --mirror --convert-links --adjust-extension --page-requisites --reject .html -e robots=off --random-wait --no-verbose --include-directories="/lxc" --user-agent="lxc/4.0.12 compat:7" https://repo.turris.cz/lxc/ -P /your/preferred/path/
You can then create your own index file for unprivileged containers, for example, assuming we want to keep the same list for both privileged and unprivileged containers
cp /your/preferred/path/repo.turris.cz/lxc/meta/1.0/index-system /your/preferred/path/repo.turris.cz/lxc/meta/1.0/index-user
Once you’ve done this you can create a specific lighttpd configuration to host your custom copy of the Turris repository, for instance you can create a /etc/lighttpd/conf.d/99-custom-lxc-repo.conf file as follow:
# lighttpd include file for LXC images repository
$HTTP["url"] =~ "^/lxc" {
alias.url = ( "/lxc/" => "/your/preferred/path/repo.turris.cz/lxc/" )
}
Once the new configuration file is created you’ll have to restart lighttpd (service lighttpd restart) and point the Containers URL under LuCI - Services - LXC Containers to your localhost, your /etc/config/lxc file should then look similar to the following:
config lxc 'lxc'
option min_space '100000'
option min_temp '100000'
option url 'localhost/lxc'
option ssl_enabled '1'
Please note this requires a proper certificate file configured on the lighttpd web server, wget must be able to download the required files upon server’s certificate verification. This configuration is beyond the scope of this post.
3 Redirect requests
This workaround is similar to the previous one with the exception that in this scenario we’ll not create a copy of the Turris repository but simply leverage on lighttpd to redirect the requests to the Turris repository, notably we’ll intercept requests for unprivileged containers (index-user file) and redirect those towards another index file, in this case the one for privileged containers (index-system file). This is a task more suited for a proxy server rather than lighttpd but still it’s just another workaround.
In order to do so, you can create a /etc/lighttpd/conf.d/99-custom-lxc-repo.conf file as follow:
# lighttpd include file for Turris LXC images repository
$HTTP["url"] =~ "^/lxc" {
url.redirect = ( ".*/lxc/(.*)" => "https://repo.turris.cz/lxc/$1" )
}
$HTTP["url"] =~ "^/lxc/meta/1.0/index-user" {
url.redirect = ( ".*" => "https://repo.turris.cz/lxc/meta/1.0/index-system" )
}
Once the new configuration file is created you’ll have to restart lighttpd (service lighttpd restart) and point the Containers URL under LuCI - Services - LXC Containers to your localhost, your /etc/config/lxc file should then look similar to the following:
config lxc 'lxc'
option min_space '100000'
option min_temp '100000'
option url 'localhost/lxc'
option ssl_enabled '1'
Please note this requires a proper certificate file configured on the lighttpd web server, wget must be able to download the required files upon server’s certificate verification. This configuration is beyond the scope of this post.
I hope this post provided a better understanding of the issue and how this should be addressed, please note the workarounds proposed are just examples on how to bypass the issue, feel free to reach out in case of any doubt or questions.
