Comment # 40 on bug 1156336 from Aleksa Sarai

(In reply to seve skeis from comment #39)
> (In reply to seve skeis from comment #38)
> > (In reply to Aleksa Sarai from comment #36)
> > > (In reply to seve skeis from comment #35)
> > > > (In reply to Aleksa Sarai from comment #33)
> > > > > (In reply to seve skeis from comment #31)
> > > > > > Good job, how can i test it?
> > > > > 
> > > > > I'm about to send an SR (so you'll need to wait a bit for the build to
> > > > > finish), but you can add the development repo for lxd to test it:
> > > > > 
> > > > > zypper ar -f obs://Virtualization:containers obs-vc
> > > > > 
> > > > > And then you do
> > > > > 
> > > > > zypper in -r obs-vc lxd
> > > > > 
> > > > > And you'll get the development version of LXD. Note that you should undo
> > > > > this afterwards since the development versions of LXD could break (you
> > > > > should stick with the Leap repos).
> > > > 
> > > > Hi, i do not want to sound weird, but i just tried it from this repo, it is
> > > > not working, same old problem.
> > > 
> > > The updated packages haven't been published yet -- see that in [1] the
> > > package is listed as "finished" not "succeeded" with a published icon. For
> > > some reason, OBS has finished the build (more than 2 hours ago) but hasn't
> > > yet published the actual package. We've been having problems with this for
> > > the past few weeks, I've got no idea what's going on.
> > > 
> > > You can download the RPMs from here[2] -- but note that this is even more
> > > unsafe-to-rely-on than using the development repos. The other option would
> > > be to build the package locally using osc.
> > > 
> > > [1]: https://build.opensuse.org/package/show/Virtualization:containers/lxd
> > > [2]:
> > > https://build.opensuse.org/package/binaries/Virtualization:containers/lxd/
> > > openSUSE_Leap_15.1
> > i just installed it from the repo, you mentioned, it complained that libuv1
> > nothing provides it, i continued then installed from the normal repo, among
> > other packages like dns and cirus ..etc. now bash-completion is not working.
> > and first time launch on a container it freezes the whole system, so i do
> > hard reboot. did you guys face sth similar ?
> 
> 1. i confirm the hangout after container creation was a cause of bridge
> mis-configuration. am stuck with bash-complation now.

If bash-completion isn't working, please open a new bug with a description of
the problem (I don't personally use bash -- so it's entirely possible I screwed
up the bash-completion installation).

> 2. i do not know if this is a bug or it is the way it should be. after
> creating a container using an lxd user, then the created container should
> use that user subgid and subuid in its conf file no? but i notice it only
> uses the root subuid subgid. i made sure /etc/subuid /etc/subgid has an
> entry for the user creating the containers and its a member of lxd group
> too. please correct me here.

The way we set up /etc/sub[ug]id in the package is correct and will work out of
the box. LXD always[*] uses root's subid configuration because it is running as
the root user -- it is not running as the user running "lxc" commands. There
are also a bunch of other annoying technical reasons why this is done this way
("lxd" is a server and the client could be on a different machine -- in that
case, there is no way to associate the user running "lxc" with user on the LXD
host).

There's nothing wrong with setting up your own subid configuration (though it's
not a good idea to overlap the LXD ones with your own users', because it allows
your user to gain privileged access to the containers) but it's not necessary.

[*}: Except if you're running under snap. In those cases, LXD has special
handling but that really doesn't matter right now.