Set security.nesting=true for LXD projects

[mr-cal]

What needs to get done

• set security.nesting=true in the LXD project profile
• determine which versions of systemd are affected and which LXD images will need this set

Why it needs to get done

Newer versions of systemd does not work well in nested containers.

This needs to be fixed at least for Oracular images.

Source:

• Enable security.nesting by default for unprivileged containers and modern enough images lxd#13631
• https://matrix.to/#/!NPPCseDHKRvSBMUEXN:ubuntu.com/$l9-msw901I7b885eH4LaGs_T9gmLKbSqE8tVrGLnAAk?via=ubuntu.com&via=matrix.org

[syncronize-issues-to-jira]

Thank you for reporting us your feedback!

The internal ticket has been created: https://warthogs.atlassian.net/browse/CRAFT-3096.

This message was autogenerated

[tomponline]

Following on from this post https://discourse.ubuntu.com/t/questions-about-security-nesting-and-recent-systemd/51560

I'd like to understand the specific scenario that is causing an issue and what version(s) of LXD and host OS you are using?

Thanks

[tomponline]

From looking at https://matrix.to/#/!NPPCseDHKRvSBMUEXN:ubuntu.com/$l9-msw901I7b885eH4LaGs_T9gmLKbSqE8tVrGLnAAk?via=ubuntu.com&via=matrix.org

it works locally (noble), but it fails in our CI (focal)

This seems to be more the specific problem, that you're using Focal host.

This is because systemd v256 doesn't support cgroupv1 anymore, so even with security.nesting=true, Oracular containers on a Focal host won't work (without the HWE kernel).

See canonical/lxd#13844 (comment)

See https://discourse.ubuntu.com/t/questions-about-security-nesting-and-recent-systemd/51560/3?u=tomp

[tomponline]

Enabling security.nesting=true on Focal does not fix Oracular containers

lxc launch ubuntu:20.04 v1 --vm
lxc exec v1 -- snap refresh lxd --channel=5.21/stable
lxd (5.21/stable) 5.21.2-084c8c8 from Canonical✓ refreshed

lxc exec v1 -- lxd init --auto
lxc exec v1 -- lxc launch ubuntu:oracular c1
Creating c1
Starting c1                                   

lxc exec v1 -- lxc ls # No IPv4 as systemd isn't starting properly
+------+---------+------+-----------------------------------------------+-----------+-----------+
| NAME |  STATE  | IPV4 |                     IPV6                      |   TYPE    | SNAPSHOTS |
+------+---------+------+-----------------------------------------------+-----------+-----------+
| c1   | RUNNING |      | fd42:ec4f:9a40:d68e:216:3eff:fe8e:887d (eth0) | CONTAINER | 0         |
+------+---------+------+-----------------------------------------------+-----------+-----------+

lxc exec v1 -- lxc stop -f c1
lxc exec v1 -- lxc config set c1 security.nesting=true
lxc exec v1 -- lxc start c1

lxc exec v1 -- lxc ls # Still no IPv4 with security.nesting=true
+------+---------+------+-----------------------------------------------+-----------+-----------+
| NAME |  STATE  | IPV4 |                     IPV6                      |   TYPE    | SNAPSHOTS |
+------+---------+------+-----------------------------------------------+-----------+-----------+
| c1   | RUNNING |      | fd42:ec4f:9a40:d68e:216:3eff:fe8e:887d (eth0) | CONTAINER | 0         |
+------+---------+------+-----------------------------------------------+-----------+-----------+

[tomponline]

So I suspect your CI runners need to be updated to run either Focal's HWE kernel or move to Jammy onwards.