I thought @Peter Van Heusden'sPeterVanHeusden's answer was precise and thorough (also kind, since as he said, there's an argument to be saidmade that my question was a duplicate, only I haven't realized what's actually behind the behavior I was seeing), but it did have some formatting issues.
@murumuru corrected those, but in so doing s/he also made a change which I feel needs to be rolled back:
- The question dealt with LXD; Peter Van HeusdenPeterVanHeusden made an example involving a shell in both the host and the container, and used the shell prompt to distinguish the two (in a container, typically one gets a
root@container:~#
prompt). muru felt it was "unnecessarily long", but I actually think they helpand edited it to understand which parts ofa simple$
prompt. Also note that, as KazWolfe mentions below, PeterVanHeusden specified in the example worktext which part works in which context. However, I object to the edit on two grounds: (a) it makes the example less clear, rather than more so (a graphic cue really helps there), and (b) the$
prompt doesn't appear inside a container, because by default one executes commands as root in it (includingbash
, to get a shell into it); this just adds to the confusion, and the space saved by shrinking the prompt does't help in this case (there's more than enough space in the answer).
- A
sudo
call was used in the example to run thelxc
LXD command-line toollxc
, which is redundant. In practice, I believe it therefore shouldn't be used (hence I edited it out; again, I was thinking it's a roll-back), but as an edit it might be considered superficial -- I'll be glad to hear what you thinkFrom LinuxContainers.org:
The package creates a new "lxd" group which contains all users allowed to talk to lxd over the local unix socket. All members of the "admin" and "sudoers" groups are automatically added. If your user isn't a member of one of these groups, you'll need to manually add your user to the "lxd" group.
This implies that any user able to escalate sudo
should already be able to call lxc
; moreover, the preferred way of gaining privileges is to add a user to the "lxd" group, rather than using sudo
.
Keep in mind the following two points: (a) using sudo
for tasks which don't require it is a bad habit to encourage. (b) A user following this example has already installed LXD and launched a container. All tutorials I've seen, including those on Ubuntu Insights written by Stéphane Graber (project head), use unprivileged containers that don't require sudo
. If for some reason users find themselves in a situation where sudo
is required to manage LXD, they quite surly already know why and how that happened.
Hence, I contend that almost everyone, and most particularly novices, are safe to remove the sudo
call from the example, and therefore it's better not to include it.