Background
Container creation (create-a-container/bin/create-container.js) now attaches a hardcoded shared volume to every created container: the node's template storage is assumed to be mounted at /mnt/pve/<storage> (i.e. templates are downloaded to /mnt/pve/<storage>/template/cache), and /mnt/pve/<storage>/volumes/quick_and_dirty is bind-mounted read-only at /mnt/quick_and_dirty via mp0.
This is a quick-and-dirty stopgap (see the TODO on buildSharedVolumeMp0() in create-a-container/bin/create-container.js). It should be replaced with a proper feature where users can define their own volumes and attach them to containers with per-volume permissions.
Proposed scope
- Volume management (CRUD) for named volumes backed by directories on node storage, persisted in the database (scoping TBD: per user, per site, and/or per node)
- Attach one or more volumes at container creation and via reconfigure (
mp0..mpN), including detach
- Per-attachment permissions: read-only vs read-write (and possibly other mount options such as
backup, quotas/size limits)
- UI/API support in create-a-container (client form +
/api/v1 endpoints + OpenAPI spec)
- Derive the host path from the node's actual storage configuration (query the storage's
path via the Proxmox API) instead of assuming the /mnt/pve/<storage> layout
- Validate volume names (safe path characters, no traversal) and ensure the source directory exists before mounting
- Handle unprivileged container UID/GID mapping so read-write volumes are actually writable from inside containers
- Decide behavior for Docker nodes (bind-mount options are currently ignored by the Docker backend)
- Document privilege requirements: Proxmox restricts raw bind mounts (
mp0 with a host path) to root@pam, so the API credentials used by the manager must allow it
Current stopgap behavior (to be removed)
- Volume name hardcoded to
quick_and_dirty
- Always mounted read-only at
/mnt/quick_and_dirty
- Applied to all containers created on Proxmox nodes (both the OCI image path and the template clone path)
Background
Container creation (
create-a-container/bin/create-container.js) now attaches a hardcoded shared volume to every created container: the node's template storage is assumed to be mounted at/mnt/pve/<storage>(i.e. templates are downloaded to/mnt/pve/<storage>/template/cache), and/mnt/pve/<storage>/volumes/quick_and_dirtyis bind-mounted read-only at/mnt/quick_and_dirtyviamp0.This is a quick-and-dirty stopgap (see the
TODOonbuildSharedVolumeMp0()increate-a-container/bin/create-container.js). It should be replaced with a proper feature where users can define their own volumes and attach them to containers with per-volume permissions.Proposed scope
mp0..mpN), including detachbackup, quotas/size limits)/api/v1endpoints + OpenAPI spec)pathvia the Proxmox API) instead of assuming the/mnt/pve/<storage>layoutmp0with a host path) to root@pam, so the API credentials used by the manager must allow itCurrent stopgap behavior (to be removed)
quick_and_dirty/mnt/quick_and_dirty