Просмотр кода страницы Proxmox - перенос контейнеров из LXC

* Имеем виртуальный хост LXC 3.0.1 на базе Debian Мне надо перенести контейнеры с этого хоста на хост Proxmox.
** Создание архива контейнера исходном хосте:
- останавливаем контейнер:
 lxc-stop -n wiki
- На хосте LXC находим папку с контейнером и переходим в нее, в rootfs.
 cd /var/lib/lxc/wiki/rootfs
- создаем архив контейнера в папке /home:
 tar -czvf /home/wiki.tar.gz ./
- полученный архив переносим на хост Proxmox и выполняем его конвертацию:
 pct create '''101''' '''wiki.tar.gz''' -description '''wiki''' -hostname '''wiki''' -memory 1024 -storage '''vmdata1''' -password '''mypassword'''
** пояснение:
 pct create '''101''' - создание ноды 101
 '''wiki.tar.gz''' -description '''wiki''' - архив wiki.tar.gz с пометкой wiki
 -hostname '''wiki''' - имя контейнера / хоста
 -storage '''vmdata1''' - носитель на Proxmox где будет создан образ с носителем
* [https://wiki.autosys.tk/proxmox/import_containers_from_lxc_host_to_proxmox Источник]
* Если нужно подключить как папаку в Proxmox то смотрим [https://wiki.janforman.com/lxc тут]
<hr>
* Для того чтобы не прописывать массу настроек для вновь созданного контейнера после конвертации в apparmor, правим:
 mcedit /var/lib/lxc/101/101.conf
 ..
 lxc.apparmor.profile = generated
 lxc.apparmor.allow_nesting = 1
 ..

 mcedit /var/lib/lxc/apparmor/lxc-107_\<-var-lib-lxc\>
     #include <tunables/global>
    profile "lxc-107_</var/lib/lxc>" flags=(attach_disconnected,mediate_deleted) {
      ### Base profile
      capability,
      dbus,
      file,
      network,
      umount,
    
      # Allow us to receive signals from anywhere.
      signal (receive),
    
      # Allow us to send signals to ourselves
      signal peer=@{profile_name},
    
      # Allow other processes to read our /proc entries, futexes, perf tracing and
      # kcmp for now (they will need 'read' in the first place). Administrators can
      # override with:
      #   deny ptrace (readby) ...
      ptrace (readby),
    
      # Allow other processes to trace us by default (they will need 'trace' in
      # the first place). Administrators can override with:
      #   deny ptrace (tracedby) ...
      ptrace (tracedby),
    
      # Allow us to ptrace ourselves
      ptrace peer=@{profile_name},
    
      # ignore DENIED message on / remount
      deny mount options=(ro, remount) -> /,
      deny mount options=(ro, remount, silent) -> /,
    
      # allow tmpfs mounts everywhere
      mount fstype=tmpfs,
    
      # allow hugetlbfs mounts everywhere
      mount fstype=hugetlbfs,
    
      # allow mqueue mounts everywhere
      mount fstype=mqueue,
    
      # allow fuse mounts everywhere
      mount fstype=fuse,
      mount fstype=fuse.*,
    
      # deny access under /proc/bus to avoid e.g. messing with pci devices directly
      deny @{PROC}/bus/** wklx,
    
      # deny writes in /proc/sys/fs but allow binfmt_misc to be mounted
      mount fstype=binfmt_misc -> /proc/sys/fs/binfmt_misc/,
      deny @{PROC}/sys/fs/** wklx,
    
      # allow efivars to be mounted, writing to it will be blocked though
      mount fstype=efivarfs -> /sys/firmware/efi/efivars/,
    
      # block some other dangerous paths
      deny @{PROC}/kcore rwklx,
      deny @{PROC}/sysrq-trigger rwklx,
      deny @{PROC}/acpi/** rwklx,
    
      # deny writes in /sys except for /sys/fs/cgroup, also allow
      # fusectl, securityfs and debugfs to be mounted there (read-only)
      mount fstype=fusectl -> /sys/fs/fuse/connections/,
      mount fstype=securityfs -> /sys/kernel/security/,
      mount fstype=debugfs -> /sys/kernel/debug/,
      deny mount fstype=debugfs -> /var/lib/ureadahead/debugfs/,
      mount fstype=proc -> /proc/,
      mount fstype=sysfs -> /sys/,
      mount options=(rw, nosuid, nodev, noexec, remount) -> /sys/,
      deny /sys/firmware/efi/efivars/** rwklx,
      # note, /sys/kernel/security/** handled below
      mount options=(ro, nosuid, nodev, noexec, remount, strictatime) -> /sys/fs/cgroup/,
    
      # deny reads from debugfs
      deny /sys/kernel/debug/{,**} rwklx,
    
      # allow paths to be made dependent, shared, private or unbindable
      # TODO: This currently doesn't work due to the apparmor parser treating those as allowing all mounts.
    #  mount options=(rw,make-slave) -> **,
    #  mount options=(rw,make-rslave) -> **,
    #  mount options=(rw,make-shared) -> **,
    #  mount options=(rw,make-rshared) -> **,
    #  mount options=(rw,make-private) -> **,
    #  mount options=(rw,make-rprivate) -> **,
    #  mount options=(rw,make-unbindable) -> **,
    #  mount options=(rw,make-runbindable) -> **,
    
    # Allow limited modification of mount propagation
      mount options=(rw,make-slave) -> /,
      mount options=(rw,make-rslave) -> /,
      mount options=(rw,make-shared) -> /,
      mount options=(rw,make-rshared) -> /,
      mount options=(rw,make-private) -> /,
      mount options=(rw,make-rprivate) -> /,
      mount options=(rw,make-unbindable) -> /,
      mount options=(rw,make-runbindable) -> /,
    
      # allow bind-mounts of anything except /proc, /sys and /dev
      mount options=(rw,bind) /[^spd]*{,/**},
      mount options=(rw,bind) /d[^e]*{,/**},
      mount options=(rw,bind) /de[^v]*{,/**},
      mount options=(rw,bind) /dev/.[^l]*{,/**},
      mount options=(rw,bind) /dev/.l[^x]*{,/**},
      mount options=(rw,bind) /dev/.lx[^c]*{,/**},
      mount options=(rw,bind) /dev/.lxc?*{,/**},
      mount options=(rw,bind) /dev/[^.]*{,/**},
      mount options=(rw,bind) /dev?*{,/**},
      mount options=(rw,bind) /p[^r]*{,/**},
      mount options=(rw,bind) /pr[^o]*{,/**},
      mount options=(rw,bind) /pro[^c]*{,/**},
      mount options=(rw,bind) /proc?*{,/**},
      mount options=(rw,bind) /s[^y]*{,/**},
      mount options=(rw,bind) /sy[^s]*{,/**},
      mount options=(rw,bind) /sys?*{,/**},
    
      # Allow rbind-mounts of anything except /, /dev, /proc and /sys
      mount options=(rw,rbind) /[^spd]*{,/**},
      mount options=(rw,rbind) /d[^e]*{,/**},
      mount options=(rw,rbind) /de[^v]*{,/**},
      mount options=(rw,rbind) /dev?*{,/**},
      mount options=(rw,rbind) /p[^r]*{,/**},
      mount options=(rw,rbind) /pr[^o]*{,/**},
      mount options=(rw,rbind) /pro[^c]*{,/**},
      mount options=(rw,rbind) /proc?*{,/**},
      mount options=(rw,rbind) /s[^y]*{,/**},
      mount options=(rw,rbind) /sy[^s]*{,/**},
      mount options=(rw,rbind) /sys?*{,/**},
    
      # allow moving mounts except for /proc, /sys and /dev
      mount options=(rw,move) /[^spd]*{,/**},
      mount options=(rw,move) /d[^e]*{,/**},
      mount options=(rw,move) /de[^v]*{,/**},
      mount options=(rw,move) /dev/.[^l]*{,/**},
      mount options=(rw,move) /dev/.l[^x]*{,/**},
      mount options=(rw,move) /dev/.lx[^c]*{,/**},
      mount options=(rw,move) /dev/.lxc?*{,/**},
      mount options=(rw,move) /dev/[^.]*{,/**},
     ..
* [https://wiki.autosys.tk/proxmox/import_containers_from_lxc_host_to_proxmox источник]