Problem installing opensearch on debian in lxc unprivileged container

General Feedback
,
1

Hi.
I am installing opensearch in lxc unprivileged container or Debian. I try to follow the instructions here.

When I try to start the systemd unit I get an error:

May 12 17:14:38 titan-opensearch systemd[1]: Starting opensearch.service - OpenSearch...
May 12 17:14:38 titan-opensearch (mkdir)[6301]: opensearch.service: Failed to set up mount namespacing: /run/systemd/unit-root/sys/fs/cgroup/cpu: No such file or directory
May 12 17:14:38 titan-opensearch (mkdir)[6301]: opensearch.service: Failed at step NAMESPACE spawning /bin/mkdir: No such file or directory
May 12 17:14:38 titan-opensearch systemd[1]: opensearch.service: Control process exited, code=exited, status=226/NAMESPACE
May 12 17:14:38 titan-opensearch systemd[1]: opensearch.service: Failed with result 'exit-code'.
May 12 17:14:38 titan-opensearch systemd[1]: Failed to start opensearch.service - OpenSearch

I am completely new to opensearch, but it looks like it tries to start another lxc inside that one. I probably do not need that, as I already doing it inside the container. How to disable that and allow opensearch to run normally? Or may be something I could do better?

2

Found solution.

mkdir /var/lib/opensearch-shm

systemctl edit opensearch

and add the following overrides:

[Service]
Environment="ES_TMPDIR=/var/lib/opensearch-shm"
# Disable namespace isolation and related mount protections
RestrictNamespaces=false
PrivateTmp=false
ProtectSystem=false
ProtectHome=false
ProtectControlGroups=false
ProtectKernelModules=false
ProtectKernelTunables=false
ProtectProc=noaccess
ProtectClock=false
ProtectHostname=false
ProtectKernelLogs=false
SystemCallFilter=
CapabilityBoundingSet=

# Avoid requiring access to missing cgroup paths in LXC
ReadOnlyPaths=

ExecStartPre=
ExecStartPre=/bin/mkdir -p /var/lib/opensearch-shm/performanceanalyzer
ExecStartPre=/bin/chown opensearch:opensearch /var/lib/opensearch-shm/performanceanalyzer
ReadWritePaths=/var/lib/opensearch-shm

May be it is too much, that needs to be tested, but it works.

3

@sena

Have you tried to just install OpenSearch and OpenSearch Dashboard with APT? Shown here