From 41b83eb5a2bcb77a63f44ee193493e1b9dedf22e Mon Sep 17 00:00:00 2001 From: CyberMind-FR Date: Tue, 28 Jul 2026 16:21:28 +0200 Subject: [PATCH] fix(torrent): LXC create via download template + unprivileged idmap (gk2 rejects -t debian for unprivileged) (ref #917) Co-Authored-By: Gerald KERMA --- packages/secubox-torrent/lxc/install-lxc.sh | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/packages/secubox-torrent/lxc/install-lxc.sh b/packages/secubox-torrent/lxc/install-lxc.sh index f21bd4f2..4df5968a 100755 --- a/packages/secubox-torrent/lxc/install-lxc.sh +++ b/packages/secubox-torrent/lxc/install-lxc.sh @@ -22,14 +22,25 @@ readonly LXC_VETH="${SECUBOX_LXC_VETH:-veth-torrent0}" readonly DATA_DIR="${SECUBOX_DATA_DIR:-/data/torrent}" readonly STATE_DIR="${SECUBOX_STATE_DIR:-/var/lib/secubox/torrent}" readonly SENTINEL="$STATE_DIR/.lxc-provisioned" +# Unprivileged LXC: container-root maps to this host UID (idmap below). The +# bind-mounted /data/torrent must be owned by it so the container can write. +readonly LXC_ROOT_UID="${SECUBOX_LXC_ROOT_UID:-100000}" log() { printf '[torrent-install] %s\n' "$*"; } la() { lxc-attach -n "$LXC_NAME" -P "$LXC_PATH" -- "$@"; } mkdir -p "$STATE_DIR" "$DATA_DIR" +chown -R "$LXC_ROOT_UID:$LXC_ROOT_UID" "$DATA_DIR" if [ -f "$SENTINEL" ]; then log "already provisioned; skipping create"; else - lxc-create -n "$LXC_NAME" -P "$LXC_PATH" -t debian -- -r bookworm -a arm64 - # network: static IP on br-lxc (config appended to the container config) + # Use the DOWNLOAD template (not -t debian): gk2 runs UNPRIVILEGED containers + # and the debian template refuses ("can't be used for unprivileged + # containers"). Download template + idmap is the working pattern (matches + # secubox-peertube). + lxc-create -n "$LXC_NAME" -t download -P "$LXC_PATH" -- \ + --dist debian --release bookworm --arch "$(dpkg --print-architecture)" + # unprivileged idmap + static IP on br-lxc (config appended) cat >> "$LXC_PATH/$LXC_NAME/config" <