Mapping & mounting a Ceph RBD volume in a container

Hello,

I need to map & mount a Ceph RBD in a guest environment.

The mapping command is failing in a container, even with security.privileged=true, while it runs fine in a virtual machine in the same subnet.

The command is the following:

rbd map <container name> --pool <pool name> -n <ceph client name> -c /etc/ceph/ceph.conf -k /etc/ceph/ceph.keyring

The error in the container is the following:

rbd: failed to set udev buffer size: (1) Operation not permitted
rbd: sysfs write failed
In some cases useful info is found in syslog - try "dmesg | tail".
rbd: map failed: (13) Permission denied

Please note that the command:

rbd ls --pool <pool name> -n <ceph client name> -c /etc/ceph/ceph.conf -k /etc/ceph/ceph.keyring

works fine in both the container and the VM, so connection or authorization errors to Ceph should be excluded.

Is there some setting that allows mapping then mounting the Ceph RBD volume in a container?

Using LXD 5.21.7 and microceph 19.2.3.

Hi, this doesn’t seem to be a supported scenario today. See Storage drivers - LXD documentation 5.21.7 which has a x (not supported) in the Storage driver usable inside a container row.

However what I would propose is mapping the volume on the host and attach it to the container after a FS was put on top. Raw block vols (without a FS) cannot be attached to containers.
Is there a reason you cannot use a LXD storage pool using the ceph Ceph RBD driver?

Hello,

Thanks for the input.

My use case is the following. I need to mount all the volumes of a container (instance and device volumes, if any) in order to back them up or to restore them with the Proxmox Backup Client. I’m doing it in a script that works well on the host with ZFS pools. Now I need to extend it to Ceph pools.

For security and operations-related reasons I’m evaluating whether it is feasible to move the backup operation in a guest, let’s call it Control Node, being it a container or a virtual machine.

Raw block vols (without a FS) cannot be attached to containers.

I understand this is the key limitation of the container as Control Node for my purpose. At this point, even if a container would be better, it is fine for me to use a Virtual Machine.

The question is then different: is it possible to mount a ZFS dataset from a VM in the same host?

This is the command that I need to issue.

mount -t zfs <INSTANCE_POOL_NAME}>/containers/<INSTANCE_PROJECT>_<INSTANCE_NAME>@snapshot-BACKUP /tmp/<INSTANCE_PROJECT>_<INSTANCE_NAME>/container/backup/container

Thanks!

The question is then different: is it possible to mount a ZFS dataset from a VM in the same host?

I am not sure I am following you but if you want to attach e.g. the root vol of one instance to another instance you can do this with LXD the same way as you would do for custom volumes:

lxc storage volume attach <pool> (virtual-machine|container)/<instance name> <vm name to attach to>

Make sure the instance vol you want to attach has lxc storage volume set <pool> (virtual-machine|container)/<instance name> security.shared=true set.

This would allow you to run your backup jobs inside a VM with the vols of other instances attached to this VM, may it be from a ZFS or Ceph pool without manually running any mount command.

Hello @jpelizaeus ,

This would allow you to run your backup jobs inside a VM with the vols of other instances attached to this VM, may it be from a ZFS or Ceph pool.

This is my goal! That would be fantastic if I could abstract away the storage driver from the backup script logic.

I’ve tried your proposed approach with a slight difference, that is using trying to attach snapshots instead of their volumes.

However I get the following error:

# lxc storage volume attach pool01 container/c01/snap0 vm01
Error: Only “custom” and “virtual-machine” volumes can be attached to instances

The error seems quite clear, but wanted to double check with you.

If confirmed can be considered as a potential improvement?

Sorry for the confusion, looks like this isn’t available for containers as of today. I wasn’t able to find the reasoning why containers are excluded, so feel free to open up a feature request on GitHub.

Feature request created here: Allow attach container volumes into a guest virtual machine · Issue #19061 · canonical/lxd · GitHub

Thanks for your help, @jpelizaeus !