Unprivileged containers are recommended for normal use. There is potential for a badly configured container or badly configured application to allow control to escape from the container. Since containers invoke system calls in the host kernel, if the container is running as the root, the system calls will also run as the root. However, unprivileged containers run with normal user privileges and are thus safer.
To create unprivileged containers, the host must support Linux Control Groups and uid mapping. This support is included in basic Ubuntu distributions, but it needs to be added to other distributions. The cgmanager package is not available in all distributions. You cannot start an unprivileged container without this package:
# apt-get install cgmanager uidmap systemd-services
Start cgmanager:
$ sudo service cgmanager start
Debian systems may require that clone support be enabled. If you receive a chown error when creating a container, these lines will fix it:
# echo 1 > /sys/fs/cgroup/cpuset/cgroup.clone_children
# echo 1 > /proc/sys/kernel/unprivileged_userns_clone
The username of an account that's allowed to create containers must be included in the etc mapping tables:
$ sudo usermod --add-subuids 100000-165536 $USER
$ sudo usermod --add-subgids 100000-165536 $USER
$ sudo chmod +x $HOME
These commands add the user to the User ID and Group ID mapping tables (/etc/subuid and /etc/subgid) and assign UIDs from 100000 -> 165536 to the user.
Next, set up the configuration file for your containers:
$ mkdir ~/.config/lxc
$ cp /etc/lxc/default.conf ~/.config/lxc
Add the following lines to ~/.config/lxc/default.conf:
lxc.id_map = u 0 100000 65536
lxc.id_map = g 0 100000 65536
If the containers support network access, add a line to /etc/lxc/lxc-usernet to define the users who will have access to the network bridge:
USERNAME veth BRIDGENAME COUNT
Here, USERNAME is the name of the user who owns the container. veth is the usual name for the virtual Ethernet device. BRIDGENAME is the name that's displayed by ifconfig. It is usually either br0 or lxcbro. COUNT is the number of simultaneous connections that will be allowed:
$ cat /etc/lxc/lxc-usernet
clif veth lxcbr0 10