mojo should support unprivileged containers

[James Troup]

mojo should support unprivileged containers; right now I believe it assumes it requires root to use lxc and this is no longer true in Ubuntu 14.04.

[Tom Haddon (mthaddon)]

I've started work on a branch for this. It relies on already having userspace LXC configured, which seems to me like it could be something we require rather than doing for users (certainly as a first pass). That setup is documented https://help.ubuntu.com/lts/serverguide/lxc.html#lxc-basic-usage

[Tim Kuhlman (timkuhlman)]

Another possibility to consider is to switch from using lxc directly to using LXD. That not only gives the unprivileged setup needed but could simplify the code as the lxd is generally simpler to use. The catch of course is lxd isn't in trusty so installation of it is an extra step for trusty. Xenial will solve that.

[Tom Haddon (mthaddon)]

I think supporting LXD might just be another container type that we can add as well - certainly makes sense once we're on xenial

[Tom Haddon (mthaddon)]

I think my branch is dependent on lp:~foli/mojo/mojo-sudo-fix because currently you *have* to run project-new using sudo, which means the container is created as root. We *could* drop back to the user to run the container creation parts, but that seems pretty messy.

The other issue to deal with is project_root. If this is left as the default, we'd currently still need sudo permissions to create the directory. It'd be nicer to default to a location the user can write to (likely ~/.local/share/mojo) for unprivileged LXC so that no part of creating or destroying a project needs sudo permissions. Possibly we should default to /srv/mojo for "lxc" and ~/.local/share/mojo for "unprivilegedlxc".

[David Ames (thedac)]

Attaching a very much WIP branch lp:~thedac/mojo/unprivileged-containers.

The main idea I'd like to see continued is an object oriented approach so that the project and phase code is agnostic about what type of container is being used and all the specifics are in the container code.

[Tim Kuhlman (timkuhlman)]

I like the idea of changing the mojo root for the unprivileged case. Though I vote just '~/.mojo', nothing more than a personal preference I just think .local/share gets too crowded.

On another note I have been setting the MOJO_ROOT for all the tests I am doing in the LXD env and it has worked well so I am confident this feature does work.

Also I haven't checked out this section of the code in awhile but +1 to the idea of good object oriented approach so the project/phase code is agnostic to the type of container being used.

[Tim Kuhlman (timkuhlman)]

Support for LXD which runs unprivileged has merged into mojo.