Recent content by elendiir

Good morning, and good news. After moving all important VMs to the other two servers I have been able to reboot the first Proxmox server. Before the reboot the two mitigations for the recent kernel security issues (Copy Fail and Dirty Frag Exploit) haven been disabled. After the server reboot...

@fabian: ptrace_Scope gets not set via /lib/sysctl.d. The directory /usr/local/lib/sysctl.d does not exist. I think I will try to reboot one server tomorrow morning. Let see to what the value of kernel.yama.ptrace_scope will be set to. And let's hope that we will have a working LXC-environment...

@fabian: no worries. I am glad that we have found the reason for the non-starting LXCs. Even when I still not understand how and why the value has been changed to 3. @Impact: no files found I theory I should be able to change the value on the running server using: echo 1 | sudo tee...

So now I do understand you. The non-default kernel.yama.ptrace_scope = 3 might cause the issues. Now we need to understand why it is not set to 1 which I assume should be the default. At least I see kernel.yama.ptrace_scope = 1 on my home-lab environment.

/etc/sysctl.d/ is empty

As far as I know the only changes that have been made can be found in /etc/modprobe.de: One is dirty-frag.conf install esp4 /bin/false install esp6 /bin/false install rxrpc /bin/false And for copy-fail called disable-algif.conf install algif_aead /bin/false

Hm, not sure if this setting has been touched. Here is the wanted output: root@proxmox-2:~# sysctl kernel.yama.ptrace_scope kernel.yama.ptrace_scope = 3

Thanks Daniel for providing the correct command syntax. Here is the correct output from journalctl that does contain the failed start of LXC. Just the clearify: it is not only this container that fails. I see all containers not working on our 3 Proxmox-servers after installing the update to...

Good morning, apt -U dist-upgrade works fine. No errors. I just have updated librabbitmq4. systemctl --failed shows me those two LXCs that I tried to restart on this server: root@proxmox-2:~# systemctl --failed UNIT LOAD ACTIVE SUB DESCRIPTION ●...

Sorry I forgot to post this part. I am not sure what part is of interest. I think this line might show the error? [Jun12 13:24] audit: type=1400 audit(1781263485.458:15832): apparmor="DENIED" operation="getattr" class="posix_mqueue" profile="/usr/bin/lxc-st> [ +0.051371] audit: type=1400...

Hi, I just have upgraded our PVE environment from 9.1.x (not sure which version it has been) to 9.2.2. using the productive repro. PVE-Container version is 6.1.10 Now I am not able to start any LXCs anymore. Starting the LCX in debug shows me the following errors: lxc-start 501...

@nhasian My privileged LCX haven been running fine over half a year. The containers in the LCX stopped working after upgrading Docker from version 20.10.23 to 23.0.0. After deploying this version I needed to add apparmor:unconfined in order to be able to start the containers again.

Maeries, I just added the apparmor:unconfined into the yml-file. And now it works. I think I did something wrong the last time. Thanks for your support! This removes a lot of headaches. Cheers Fritz

Thanks a lot Maeries, as far as I do remember disabling apparmor in my docker compose configuration was part of one of my many tries. I will check this when I am back home from my business trip.

Good morning! I spent several hours without being able to get the system running again. So I reverted back to the last backup. Installing the system updates bumps Docker within the LXC from 20.10.23 to 23.0.0. With 20.10.23 the container are starting. With 23.0.0 the container wont start...