setup-lxd-profile.sh

#!/bin/bash
set -eu
_UID=$(id -u)
GID=$(id -g)

# give lxd permission to map your user/group id through
grep root:$_UID:1 /etc/subuid -qs || sudo usermod --add-subuids ${_UID}-${_UID} --add-subgids ${GID}-${GID} root

# set up a separate key to make sure we can log in automatically via ssh
# with $HOME mounted
KEY=$HOME/.ssh/id_lxd_$USER
PUBKEY=$KEY.pub
AUTHORIZED_KEYS=$HOME/.ssh/authorized_keys
[ -f $PUBKEY ] || ssh-keygen -f $KEY -N '' -C "key for local lxds"
grep "$(cat $PUBKEY)" $AUTHORIZED_KEYS -qs || cat $PUBKEY >> $AUTHORIZED_KEYS

# create a profile to control this, name it after $USER
lxc profile create $USER &> /dev/null || true

# configure profile
# this will rewrite the whole profile
cat << EOF | lxc profile edit $USER
name: $USER
description: allow home dir mounting for $USER
config:
  # this part maps uid/gid on the host to the same on the container
  raw.idmap: |
    uid $_UID 1000
    gid $GID 1000
  # note: user.user-data is still available
  user.vendor-data: |
    #cloud-config
    users:
      - name: $USER
        groups: sudo
        shell: $SHELL
        sudo: ['ALL=(ALL) NOPASSWD:ALL']
    # ensure users shell is installed
    packages:
      - $(dpkg -S $(readlink -m $SHELL) | cut -d: -f1)
# this section adds your \$HOME directory into the container. This is useful for vim, bash and ssh config, and such like.
devices:
  home:
    type: disk
    source: $HOME
    path: $HOME
EOF


# to launch a container using this profile:
# lxc launch ubuntu: -p default -p $USER

# to add an additional bind mount
# lxc config device add <container> <device name> disk source=/path/on/host path=path/in/container

Using this script to help me grok LXD, it helps immensely.

small thing, line 23, $PROFILE should be $USER?

Hi folks

@asi594 thanks, have renamed $PROFILE to $USER, was from an older version

@bmullen never tried with sound. Which application to you want to use inside the lxd?

I suspect the best option for most apps is sharing the host's pulseaudio, a la https://www.stgraber.org/2014/02/09/lxc-1-0-gui-in-containers/

You may also need to expose all of /dev/snd/, perhaps. I would experiment with a privileged container first, as the user perms might be tricky for the unprivileged example above.

Have updated to support newer idmap syntax, which gets rid of the messy shell maths.

Thank you. It's very useful to help solve my problem.

Hi @bloodearnest,

Your script has been very useful, I tested it and it works great.

However, the values provided to the raw.idmap entry need to be like this:

raw.idmap: |
uid $_UID 1000
gid $GID 1000

Or perhaps could be useful to find a way to set a custom set of uid/gid to the user in the container.

This looks very interesting. Is there any way you could provide a little more information on what exactly the script does and how to use it? It just shares your home directory with LXD/LXC containers right? How does it need to be run and with what variables changes? Doesn't look like just a matter of downloading and running. Thanks!

@argearriojas yeah my bad, sorry. Usually, my uid is 1000 on the host, so it worked. Unfortuately, cloud init doesn't support setting uid in trusty. So have applied your change, uid is fixed at 1000 in the container.

Ideally, I'd like to use the same uid as on the host, but that proved tricky and overly complex.

@aaylnx: just run the script as your user, no extra params needed, it will create a lxd profile named after your user. Then follow the comments at the end of the script.

@bloodearnest you are a godsend... i've been trying to resolve the nobody:nobody ownership of mounted folders in my lxc containers and this has really solved my headache! a big THANK YOU!