[systemd-devel] Systemd-nspawn: Cannot create tun device in container

[Tom Gundersen]

On Fri, Oct 3, 2014 at 7:46 PM, James Lott <james at lottspot.com> wrote:
> Hello, list!
>
> In some work I've been doing with systemd-nspawn containers, I've been trying
> to connect one of my containers to an openvpn network. This conteiner is being
> run with the --network-bridge flag to setup its networking, so according to the
> documentation, should retain CAP_NET_ADMIN capabilities. However, the
> container appears to be unable to create a new tun device

Hi James,

Thanks for the report, and sorry for the late reply. I just pushed a
fix to git which creates /dev/net/tun in the container (if it exists
on the host) and it appears to work for me. Please let me know whether
this solves your problem.

Cheers,

Tom

> [root at lanvpn ~]# ip tuntap add dev tun0 mode tun
> open: No such file or directory
>
> I tried retaining the CAP_MKNOD capability for this container using the --
> capability flag as well, and this met with the same result.
>
> I also tried binding the /dev/net device directory from the parent to the
> /dev/net device directory of the child container, and added the following line
> to the systemd-nspawn service file of the container
>
>  [root at host01 ~]# grep Device /etc/systemd/system/lanvpn.service
> DeviceAllow=/dev/net/tun rwm
>
> This resulted in the error
>
> [root at lanvpn ~]# ip tuntap add tun0 mode tun
> open: Operation not permitted
>
> Is there any way to run my containers which will allow them to create tun/tap
> devices? System is arch linux arm, running systemd 216-r3
> _______________________________________________
> systemd-devel mailing list
> systemd-devel at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/systemd-devel