Cannot install in an LXD container without workarounds: `error: mounting /proc: Operation not permitted`

[andersk]

$ lxc exec test -- sudo -iu ubuntu
To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.

ubuntu@test:~$ curl -L https://nixos.org/nix/install | sh
…
2021-11-02 06:38:07 (12.5 MB/s) - ‘/tmp/nix-binary-tarball-unpack.RHCMdZKCUs/nix-2.4-x86_64-linux.tar.xz’ saved [28432840/28432840]

Note: a multi-user installation is possible. See https://nixos.org/nix/manual/#sect-multi-user-installation
performing a single-user installation of Nix...
directory /nix does not exist; creating it by running 'mkdir -m 0755 /nix && chown ubuntu /nix' using sudo
copying Nix to /nix/store...

installing 'nix-2.4'
error: mounting /proc: Operation not permitted
(use '--show-trace' to show detailed location information)
/tmp/nix-binary-tarball-unpack.RHCMdZKCUs/unpack/nix-2.4-x86_64-linux/install: unable to install Nix into your default profile

I am aware of two workarounds:

• It works if I first sudo umount /proc/sys/fs/binfmt_misc /proc/sys/kernel/random/boot_id in the container.
• Alternatively, it works if I create the container with lxc launch -c security.nesting=true.

These workarounds should not be necessary. The installer should detect this problem and either correct it or print a helpful message.

[stale[bot]]

I marked this as stale due to inactivity. → More info

[andersk]

Still an issue in 2.8.0.

[andronat]

Still an issue in 2.11.0. I'm trying to install Nix in mcr.microsoft.com/vscode/devcontainers/base:0-jammy the official MS container for vscode.

[domenkozar]

Same issue on RHEL

[toraritte]

Tried installing Nix in an Ubuntu LXD container on a Ubuntu host, but got the same issue. Is this even a NixOS issue? (edit: Nonetheless, the workaround works: lxc config set <instance_name> security.nesting=true.)

[nixos-discourse]

This issue has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/how-to-run-the-nix-installer-silently-from-a-shell-script/25633/1