Re: [PATCH container/qemu-server 0/2] qemu: lxc: refuse moving disks/volumes of protected VMs/CTs

["Michael Köppl" <m.koeppl@proxmox.com>]

Thanks for these patches!

Tested the following scenarios:
- Attempted to move a disk from a protected VM to another VM. This was
  denied as expected.
- Moved a disk from an unprotected VM to a protected VM, which worked,
  since adding a disk to a protected VM is not in scope for these
  patches.
- Attempted to move a volume from an unprotected container to a
  protected one as well as from a protected one to an unprotected one.
  Both were denied with "cannot move volumes to a protected container".

Even though the actions above all work as expected, I noticed that the
behavior is different between CTs and VMs regarding moving a disk/volume
to another storage. I'm not entirely sure that's in scope, though. I
added a comment on the qemu-server patch regarding that.

I also looked at the implementation and added comments to the individual
patches.

On Mon Sep 21, 2026 at 5:35 PM CEST, Jakob Klocker wrote:
> According to the documentation, the protection flag on a container
> prevents disk remove and update operations. This is currently not
> enforced for the move operation, as reported on the mailing list [0]:
> a volume can be moved off a protected CT even though the move removes
> it from the source.
>
> VMs are similar, with one difference: the protection flag blocks
> removing a disk but still allows adding one. Moving a disk still
> removes it from the source, so moving a disk away from a protected VM

[snip]