hotel-manage-stack/stack-init
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Docker-in-LXC: run containers AppArmor-unconfined (idempotent, fixes existing LXCs)

Browse source
This commit is contained in:
jtricerolph 2026-07-01 13:17:20 +00:00
parent 5fcf1f62e9
commit 69db7d5426
2 changed files with 57 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

7
add-app.sh
View file

@ -124,8 +124,11 @@ pct create "$LXC_ID" "$TEMPLATE" \
--unprivileged 0 \ --unprivileged 0 \
--onboot 1 \ --onboot 1 \
--tags "${POOL}" \ --tags "${POOL}" \
${POOL_OPT} \ ${POOL_OPT} &>/dev/null
--start 1 &>/dev/null # Docker-in-LXC: run AppArmor-unconfined so containers can start
grep -q '^lxc.apparmor.profile: unconfined' "/etc/pve/lxc/${LXC_ID}.conf" 2>/dev/null \
|| echo "lxc.apparmor.profile: unconfined" >> "/etc/pve/lxc/${LXC_ID}.conf"
pct start "$LXC_ID" &>/dev/null
sleep 5 sleep 5
msg_ok "LXC ${LXC_ID} created" msg_ok "LXC ${LXC_ID} created"

45
install-stack.sh
View file

@ -335,13 +335,30 @@ ensure_pool() {
pvesh get "/pools/${POOL}" &>/dev/null && POOL_OPT="--pool ${POOL}" pvesh get "/pools/${POOL}" &>/dev/null && POOL_OPT="--pool ${POOL}"
} }
# Docker-in-LXC needs the container to run AppArmor-unconfined, otherwise
# containers fail with "docker-default profile could not be loaded ... while
# confined". Idempotent: adds the line if missing, (re)starts only when needed.
apply_docker_lxc_conf() {
local id=$1 created=$2
local conf="/etc/pve/lxc/${id}.conf" changed=0
if ! grep -q '^lxc.apparmor.profile: unconfined' "$conf" 2>/dev/null; then
echo "lxc.apparmor.profile: unconfined" >> "$conf"
changed=1
fi
if [[ "$created" == 1 ]]; then
pct start "$id" &>/dev/null; sleep 5
elif [[ "$changed" == 1 ]]; then
pct stop "$id" &>/dev/null || true; pct start "$id" &>/dev/null; sleep 5
elif ! lxc_running "$id"; then
pct start "$id" &>/dev/null; sleep 5
fi
}
create_lxc() { create_lxc() {
local id=$1 ip=$2 name=$3 mem=${4:-512} cores=${5:-1} local id=$1 ip=$2 name=$3 mem=${4:-512} cores=${5:-1} created=0
if lxc_exists "$id"; then if lxc_exists "$id"; then
msg_warn "LXC $id (hotel-manage-${name}) already exists — skipping creation" msg_warn "LXC $id (hotel-manage-${name}) already exists — skipping creation"
lxc_running "$id" || pct start "$id" else
return
fi
local tmpl; tmpl=$(get_template) local tmpl; tmpl=$(get_template)
pct create "$id" "$tmpl" \ pct create "$id" "$tmpl" \
--hostname "hotel-manage-${name}" \ --hostname "hotel-manage-${name}" \
@ -353,18 +370,17 @@ create_lxc() {
--unprivileged 0 \ --unprivileged 0 \
--onboot 1 \ --onboot 1 \
--tags "${POOL}" \ --tags "${POOL}" \
${POOL_OPT} \ ${POOL_OPT} &>/dev/null
--start 1 &>/dev/null created=1
sleep 5 # let systemd start fi
apply_docker_lxc_conf "$id" "$created"
} }
create_npm_lxc() { create_npm_lxc() {
local id=103 local id=103 created=0
if lxc_exists "$id"; then if lxc_exists "$id"; then
msg_warn "LXC $id (hotel-manage-npm) already exists — skipping creation" msg_warn "LXC $id (hotel-manage-npm) already exists — skipping creation"
lxc_running "$id" || pct start "$id" else
return
fi
local tmpl; tmpl=$(get_template) local tmpl; tmpl=$(get_template)
pct create "$id" "$tmpl" \ pct create "$id" "$tmpl" \
--hostname "hotel-manage-npm" \ --hostname "hotel-manage-npm" \
@ -377,9 +393,10 @@ create_npm_lxc() {
--unprivileged 0 \ --unprivileged 0 \
--onboot 1 \ --onboot 1 \
--tags "${POOL}" \ --tags "${POOL}" \
${POOL_OPT} \ ${POOL_OPT} &>/dev/null
--start 1 &>/dev/null created=1
sleep 5 fi
apply_docker_lxc_conf "$id" "$created"
} }
install_docker() { install_docker() {