I am testing TrueNAS 26 Beta 1 containers/LXC and ran into a Docker-in-LXC issue.
The LXC itself works: Ubuntu boots, networking works, SSH works, Docker starts, and hello-world runs. But real multi-layer images fail during layer extraction/registration. fuse-overlayfs also appears blocked because /dev/fuse is not available inside the LXC.
Environment
- TrueNAS 26 Beta 1
- TrueNAS managed LXC /
container.*/ libvirt LXC - Guest OS: Ubuntu 24.04.4 LTS
- Privileged container
- Capabilities policy: Allow All
- Init process:
/sbin/init - VirtIO NIC attached to bridge
- Docker installed inside the LXC with Docker’s official install script
- Docker Compose:
v5.1.3
What works
docker run --rm hello-world
This works and prints the normal Hello from Docker! message.
Docker Compose also works:
docker compose version
Docker Compose version v5.1.3
What fails
A real image fails:
docker pull lscr.io/linuxserver/radarr:latest
docker run --rm lscr.io/linuxserver/radarr:latest /bin/sh -c 'echo radarr image works'
Failure:
latest: Pulling from linuxserver/radarr
ccc6d199fc4b: Extracting [==================================================>] 6.275MB/6.275MB
f6a4c3e338ed: Download complete
4c9d9a005bd6: Download complete
f63ecd910bdc: Download complete
5afbe1a83c1a: Download complete
bc8e3ac89381: Download complete
fef015f8fe2b: Download complete
41d7626389d1: Download complete
c1e5bb986614: Download complete
failed to register layer: operation not permitted
A larger Docker Compose stack also failed with:
failed to extract layer ... to overlayfs ...
mount callback failed on /var/lib/containerd/tmpmounts/containerd-mount...: operation not permitted
Things tried
Docker bridge IPv6
Docker initially failed trying to disable IPv6 on container interfaces, so I configured:
{
"ipv6": true,
"fixed-cidr-v6": "fd00:dead:beef:11::/64"
}
After that, hello-world worked.
fuse-overlayfs
Installed fuse-overlayfs and configured Docker:
{
"ipv6": true,
"fixed-cidr-v6": "fd00:dead:beef:11::/64",
"storage-driver": "fuse-overlayfs"
}
Docker reported fuse-overlayfs, but containers failed with:
fuse: device not found, try 'modprobe fuse' first
fuse-overlayfs: cannot mount: No such file or directory
So /dev/fuse does not seem available inside the LXC.
vfs storage driver
Configured:
{
"ipv6": true,
"fixed-cidr-v6": "fd00:dead:beef:11::/64",
"storage-driver": "vfs"
}
Docker showed:
Storage Driver: vfs
Docker Root Dir: /var/lib/docker
hello-world worked, but real images still failed with:
failed to register layer: operation not permitted
Disabled Docker containerd snapshotter
Also tried:
{
"ipv6": true,
"fixed-cidr-v6": "fd00:dead:beef:11::/64",
"storage-driver": "vfs",
"features": {
"containerd-snapshotter": false
}
}
After clearing /var/lib/docker and /var/lib/containerd, restarting Docker, and retesting, hello-world still worked but Radarr still failed with:
failed to register layer: operation not permitted
Question
Since this is TrueNAS 26 Beta 1, I am trying to understand whether this is expected beta behavior, a missing configuration option, or a bug worth reporting.
Specifically:
- Is Docker inside a TrueNAS-managed LXC expected to support real multi-layer images?
- Is there a supported way to expose
/dev/fuseto a TrueNAS LXC? - Is
fuse-overlayfsexpected to work? - Are extra LXC/libvirt settings needed for Docker image layer extraction?
- Should Docker-in-LXC be avoided on TrueNAS containers except for trivial images?
- Is a VM the recommended path if I want Docker isolation?
Current takeaway: the LXC works well for native Linux services, but I cannot currently use it as a reliable Docker host. hello-world works, but real application images fail during layer extraction.