search

lxc / incus

Powerful system container and virtual machine manager
https://linuxcontainers.org/incus
Apache License 2.0
2.82k stars 225 forks source link

Read-only file operations on instance snapshots #1174

Open vic-t opened 2 months ago

vic-t commented 2 months ago

It would be great if lxc file mount could be used on container snapshots, too. This would be particularly helpful in situations where lxc file mount is used to make a backup of data in a running container that is currently being accessed.

See discussion on https://discuss.linuxcontainers.org/t/backup-specific-files-in-container-from-host/15638

( I created this issue for LXD last year. Since I switched to Incus in the meantime, I thought it may be worth it to copy it over.)

stgraber commented 2 months ago

That would be interesting to get but it may not always be possible or at least not without some odd workarounds.

One big limitation will be that we'd only be able to offer it for containers. Virtual machine file operations depend on a running agent in the virtual machine.

For storage backends, this shouldn't be too hard to get working on dir, btrfs and zfs. LVM and Ceph will be harder. It should be fine when the filesystem is ext4 but when it's xfs or btrfs, the kernel usually won't let us mount it as the internal identifier will clash with the main mount.

One workaround for this is to not access the snapshot directly but instead create a temporary volume from the snapshot, then alter the uuid within that volume (can take a while as for btrfs, this is encoded throughout the whole btree) and finally access that temporary volume, destroying it after use.

vic-t commented 2 months ago

Is it absolutely necessary to have feature parity for VMs and containers in Incus? I mean, it's an admirable goal but I don't think it would hurt if some feature A would be available for containers earlier and for VMs later, if at all. Or the other way around.

stgraber commented 2 months ago

It's not necessary, it's definitely preferred but file operations are already working differently as for example you can't access files on a stopped VM whereas you can for containers.