Archived
beatzaplentyandClaude Sonnet 4.6
cf0d62696f
The kernel's NFS client (FS_USERNS_MOUNT not set) rejects NFS mounts from inside any unprivileged container's user namespace with EPERM — AppArmor's mount=nfs feature only whitelists the AppArmor layer; the VFS-level rejection happens before AppArmor is consulted. lxc-pxe-boot mounts server.sweet.home:/tank/pxe-boot/images at /mnt/pxe-images so nginx can serve large ISOs without filling the container's root disk. Same pattern as lxc-docker (already privileged for the same reason since it also mounts several NFS shares). Operator action required: VMID 103 must be recreated as a privileged container (the UID mapping on disk differs between privileged and unprivileged; changing it in-place with pct set is unsafe). Rebuild the tarball and use create-proxmox-resource.sh to replace it. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>