<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">How can I convince systemd-nspawn to let me create loop devices inside a container?<div class=""><br class=""></div><div class="">I just learned that docker apparently has a —privileged=true, which allows this. man docker says:</div><div class=""><br class=""></div><div class=""></div><blockquote type="cite" class=""><div class="">The <code class="">--privileged</code> flag gives <em class="">all</em> capabilities to the container, and it also lifts all the limitations enforced by the <code class="">device</code> cgroup controller. In other words, the container can then do almost everything that the host can do. This flag exists to allow special use-cases, like running Docker within Docker.</div></blockquote><div class=""><br class=""></div><div class=""><div class="">Is that “just” a matter of adding the right privileges? And if so, how would I do that?</div><div class=""><br class=""></div></div><div class="">I tried with:</div><div class=""> systemd-nspawn … —capability=all</div><div class=""><br class=""></div><div class="">and perhaps I have to allow mknod in the container with something like</div><div class=""> echo b 7:0 rwm > /sys/fs/cgroup/devices/machine.slice/machine-<name>.scope/devices.allow</div><div class="">but it also seems that the container mounts tmpfs rather than devtmpfs at /dev</div><div class=""><br class=""></div><div class="">I’m a bit lost here …</div><div class=""><br class=""></div><div class="">Thanks,</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Johannes.</div><div class=""><br class=""></div></body></html>