LXC for Debian
--------------

Most templates ship without a root password, so you cannot login with
 lxc-console -n <container>
You can, however, get a shell (without a tty) by running
 lxc-attach -n <container>

If you really need a root password set, you can do so by calling
 lxc-attach -n <container> passwd
or you could allow a password-less login by calling
 lxc-attach -n <container> sed -i '/root/ s/:\*:/::/' /etc/shadow
After either of these you will be again able to login via lxc-console.

Unprivileged containers
-----------------------

To be able to start a user (unprivileged) container, one needs to change the
'/etc/sysctl.conf' file to append kernel.unprivileged_userns_clone=1 and run
`sysctl -p`.

One would also need to also set an AppArmor profile adapted to these, either in
their `.config/lxc/default.conf` or in the newly created container's
configuration for it to start.

Both 'lxc.apparmor.profile = lxc-container-default-cgns' and
'lxc.apparmor.profile = unconfined' are appropriate configurations for it to
start.

 -- Evgeni Golov <evgeni@debian.org>  Sat, 16 Jul 2016 11:49:16 +0200
