[SOLVED] systemd 247 breaks networking in LXC

[moonman]

Running Archlinux in LXC here. Once again upgrading systemd 246.6-1 => 247.1-1 breaks networking within the LXC container.

Downgrading systemd to 246.6-1 fixes the issues.

Solution from https://forum.proxmox.com/threads/systemd-244-1-breaks-networking-in-lxc.61862 is already in place and does not help, unfortunately.

EDIT:
Solution is to enable nesting in CT preferences.

 

[t.lamprecht]

Hi,

works here, just upgraded an Arch Linux CT instance to systemd 247 and rebooted the CT, network came up again fine.

Can you please post our CT config?

 

[moonman]

Hi,

Certainly:

arch: amd64
cores: 4
features: fuse=1
hostname: SRV02
memory: 4096
mp0: /media/8TB,mp=/media/storage-pool
nameserver: 10.0.0.1
net0: name=eth0,bridge=vmbr10,gw=10.0.0.1,hwaddr=xx:xx:xx:xx:xx,ip=10.0.0.6/24,type=veth
onboot: 1
ostype: archlinux
rootfs: local-lvm:vm-106-disk-6,size=64G
searchdomain: home.lan
startup: order=2
swap: 0
unprivileged: 1
lxc.mount.auto: sys

 

[t.lamprecht]

Hi,

can you try to enable the nesting feature in the CTs options?

 

[moonman]

Thank you, that made it work with systemd 247. I also removed lxc.mount.auto: sys and it's still working fine.

Do you know why new systemd would require nesting to be enabled?

 

[t.lamprecht]

It tries to create more namespaces for it's various operations, like running the systemd-networkd with version 247.

As it runs in a container, which is also using namespaces to isolate it from the host, it must be allowed to setup nested namespaces.

Normally this can be avoided by pre-creating the relevant ones, it seems this version added new ones, which are not (yet?) specified in their container runtime interface requirements.

 

[moonman]

Thank you, sir. Much appreciate your help.

 

[geppi]

Will the requirement to set nesting=1 persist in the future for runnning newer versions of systemd without problems or is there a chance that the "container runtime interface requirements" of systemd, which Thomas has mentioned above, will specifiy the required namespaces to pre-create them ?

 

[t.lamprecht]

The container runtime interface requirements are not likely to change, and the required namespaces are dynamic in nature, so I'd really not expect nesting to go away anytime soon.
But, as it has no impact for unprivileged Containers and PVE 7.0 defaults to enable nesting anyway it should not be a real issue.