LXC Mount Points (Host ↔ Container)

How it works (the big picture)

A bind mount is exactly what the name says: Proxmox tells the kernel "the host directory X should also appear at path Y inside this container". There's no copy, no sync, no network — both sides see the same files at the same time.

# What the script writes:
pct set <ctid> -mpN  /mnt/data, mp=/mnt/data, shared=1, backup=0

The host path on the left and the container path on the right can be different — for example, /mnt/nas-films on the host can become /media/films inside the container. The script adds the entry to the container config (/etc/pve/lxc/<ctid>.conf) using the next free mpN index, with two safe-defaults baked in:

• shared=1 — tells Proxmox the data is shared storage, so it does not try to migrate the disk when you migrate the container.
• backup=0 — excludes the bind mount from vzdump backups (the data lives on the host, you back it up separately).

Permission handling — the smart part

Bind mounts are easy in principle. The hard part is permissions: an unprivileged LXC container shifts every UID by +100000, so a file created inside the container by user 1000 appears on the host as UID 101000 — a UID nobody on the host owns. To make this work without aligning UIDs across hosts and containers, ProxMenux applies the right "open up permissions" trick on the host side, depending on what kind of directory you picked:

What ProxMenux writes — and what it doesn't

A common confusion when bind-mounting into an unprivileged CT: people assume ProxMenux must be writing lxc.idmap entries into /etc/pve/lxc/<CTID>.conf. It does not. Only one line is appended to that file — the bind mount itself:

# /etc/pve/lxc/545.conf  — single line added by the script
mp0: /mnt/NAS/hdd_cache,mp=/mnt/NAS/hdd_cache,shared=1,backup=0

The output line you see at the end of the run, "Unprivileged container — UID offset: 100000", is purely informational — it just tells you the CT is using Proxmox's default unprivileged mapping (root in CT = UID 100000 on host). The script does not configure anything around it.

The two ways to make permissions work — and why ProxMenux picks one

Opening the tool

From ProxMenux's main menu, open Storage & Share Manager → Configure LXC Mount Points (Host ↔ Container). You will see this sub-menu with three options:

Add a mount — full flow

The technical view, for when you want to know exactly what each dialog does:

┌─────────────────────────────────────────────┐
│  PHASE 1 — Pick CT, host dir, mount point   │
│  (nothing touched yet)                      │
└──────────────────┬──────────────────────────┘
                   ▼
      pct list — pick the target container
                   │
                   ▼
      Unified host-directory picker
      Lists every candidate the script can detect:
      ├─ Mounted CIFS / NFS shares (/proc/mounts)
      ├─ fstab-inactive network mounts (defined
      │   but not currently mounted) — labelled
      │   "fstab(off)-"
      ├─ Local /mnt/* directories
      ├─ Proxmox-managed storages under /mnt/pve/*
      │   (NFS / CIFS shares registered via pvesm)
      │   — labelled "PVE-"
      └─ "Enter path manually"  for anything else
                   │
                   ▼
      Detect the host directory TYPE
      └─ local  /  cifs  /  nfs
         (drives the permission-fix branch later)
                   │
                   ▼
      Container mount point picker
      ├─ Create new directory in /mnt
      │    (auto-suggests basename of host dir)
      ├─ Enter manual path (must be absolute)
      └─ Cancel
      Validates the path is not already used as
      a mount point in this CT.
                   │
                   ▼
      Detect CT type:
      ├─ Privileged   → no UID shift
      └─ Unprivileged → +100000 (default idmap)
                   │
                   ▼
      ACTIVE FIX FOR THE HOST DIRECTORY
      (depends on the type detected earlier)
      ├─ cifs  → offer remount with open uid/gid
      ├─ nfs   → offer chmod + setfacl on share
      └─ local → handled AFTER the bind mount
                 (only if CT is unprivileged)
                   │
   ┌──────── Cancel   OR   Confirm ────┐
   ▼                                   ▼
Exit, nothing        ┌─────────────────┴─────────────────┐
was changed          │  PHASE 2 — Apply                   │
                     └─────────────────┬─────────────────┘
                                       ▼
                       Find next free mpN slot
                       (scans /etc/pve/lxc/<ctid>.conf)
                                       ▼
                       pct set <ctid> -mpN \
                            <host-dir>,
                            mp=<container-path>,
                            shared=1, backup=0
                                       ▼
                       For local + unprivileged:
                       └─ lmm_offer_host_permissions
                          (chmod o+rwx + ACL on host dir,
                           only if perms were insufficient)
                                       ▼
                       Offer to restart the container
                       └─ pct reboot <ctid>
                          (mounts only become active on
                           the next CT start)
                                       ▼
                       Verify: pct exec <ctid> -- test -d
                       <container-path>  → "accessible"

What you can pick as a host directory

The host-directory picker is the most thorough one in the Storage & Share section. It scans four sources and presents a deduplicated list:

Manual equivalent

For a privileged container — the simplest case, no permission tricks:

# 1. add the bind mount to the CT config
pct set 101 -mp0 /mnt/data,mp=/mnt/data,shared=1,backup=0

# 2. restart the CT to activate the mount
pct reboot 101

# 3. verify from inside
pct exec 101 -- ls -la /mnt/data

For an unprivileged container with a local host directory — open up permissions on the host first:

# host: open the directory for any mapped UID
chmod o+rwx /mnt/data
setfacl -m o::rwx /mnt/data
setfacl -m d:o::rwx /mnt/data    # default ACL = applies to new files

# add the bind mount + restart
pct set 102 -mp0 /mnt/data,mp=/mnt/data,shared=1,backup=0
pct reboot 102

For an unprivileged container with a CIFS share already mounted on the host:

# host: remount the CIFS with open uid/gid
umount /mnt/pve/cifs-nas
mount -t cifs //10.0.0.50/share /mnt/pve/cifs-nas \
  -o "username=user,password=pass,uid=0,gid=0,file_mode=0777,dir_mode=0777"

# update /etc/fstab if the mount is persistent
sed -i 's|^\(//10.0.0.50/share .*cifs \).*|\1username=user,password=pass,uid=0,gid=0,file_mode=0777,dir_mode=0777 0 0|' /etc/fstab

# bind mount + restart
pct set 102 -mp0 /mnt/pve/cifs-nas,mp=/mnt/nas,shared=1,backup=0
pct reboot 102

View mount points

Lists every mpN entry across every container on this Proxmox host, grouped by CT id and showing host path → container path plus any extra options. Read-only — useful as a sanity check before you add or remove anything.

Remove a mount point

Pick the container, pick the mpN entry, confirm. The script runs pct set --delete mpN to drop the entry from the CT config and offers to restart the container if it's running. The host directory and its contents are not touched — you can re-add the mount later (or attach the same directory to a different CT).

Troubleshooting

Related

• Add Shared Directory on Host — typical first step: prepare a /mnt/shared on the host before bind-mounting it into one or more CTs here.
• Add NFS share as Proxmox storage / Add Samba share as Proxmox storage — register an external share in Proxmox first, then bind-mount its /mnt/pve/<id> path into the CT here.
• NFS client in LXC / Samba client in LXC — the alternative when you want the CT itself to mount the share (requires a privileged container).