canonical / lxd

Powerful system container and virtual machine manager
https://canonical.com/lxd
GNU Affero General Public License v3.0
4.38k stars 931 forks source link

Unable to start container with block device mounted on rootfs #7505

Closed dann1 closed 4 years ago

dann1 commented 4 years ago

Required information

Issue description

Containers rootfs are located under /var/snap/lxd/common/lxd/containers/<container>/rootfs, if one would like to have a block device mounted on the rootfs, for example, when creating empty containers, the container fails to start. In lxd3 this didn't happen.

Steps to reproduce

A regular container will be created and started, the one with the block device will fail. The block device contains a copy of the rootfs of the 1st container

  1. Create a normal container and dump it into a block device
    
    root@ubuntu2004-lxd-ssh-5-11-90-adfd7-2:/var/snap/lxd/common/lxd/containers# lxc init images:alpine/edge rootfs
    Creating rootfs

The instance you are starting doesn't have any network attached to it. To create a new network, use: lxc network create To attach a network to an instance, use: lxc network attach

root@ubuntu2004-lxd-ssh-5-11-90-adfd7-2:/var/snap/lxd/common/lxd/containers# truncate -s 1000M alpine.img root@ubuntu2004-lxd-ssh-5-11-90-adfd7-2:/var/snap/lxd/common/lxd/containers# mkfs.ext4 alpine.img mke2fs 1.45.5 (07-Jan-2020) Discarding device blocks: done
Creating filesystem with 256000 4k blocks and 64000 inodes Filesystem UUID: 0177efb6-e818-41ae-b111-667936d22a15 Superblock backups stored on blocks: 32768, 98304, 163840, 229376

Allocating group tables: done
Writing inode tables: done
Creating journal (4096 blocks): done Writing superblocks and filesystem accounting information: done

root@ubuntu2004-lxd-ssh-5-11-90-adfd7-2:/var/snap/lxd/common/lxd/containers# mount alpine.img /mnt/ root@ubuntu2004-lxd-ssh-5-11-90-adfd7-2:/var/snap/lxd/common/lxd/containers# cp -rpa rootfs/rootfs/* /mnt/ root@ubuntu2004-lxd-ssh-5-11-90-adfd7-2:/var/snap/lxd/common/lxd/containers# umount /mnt

 2. Create the blocked backed container

root@ubuntu2004-lxd-ssh-5-11-90-adfd7-2:/var/snap/lxd/common/lxd/containers# lxc init images:alpine/edge alpine-block Creating alpine-block

The instance you are starting doesn't have any network attached to it. To create a new network, use: lxc network create To attach a network to an instance, use: lxc network attach

root@ubuntu2004-lxd-ssh-5-11-90-adfd7-2:/var/snap/lxd/common/lxd/containers# rm -r alpine-block/rootfs/* root@ubuntu2004-lxd-ssh-5-11-90-adfd7-2:/var/snap/lxd/common/lxd/containers# mount alpine.img alpine-block/rootfs/

 3. Start the containers

root@ubuntu2004-lxd-ssh-5-11-90-adfd7-2:/var/snap/lxd/common/lxd/containers# lxc start rootfs root@ubuntu2004-lxd-ssh-5-11-90-adfd7-2:/var/snap/lxd/common/lxd/containers# lxc start alpine-block Error: Failed to run: /snap/lxd/current/bin/lxd forkstart alpine-block /var/snap/lxd/common/lxd/containers /var/snap/lxd/common/lxd/logs/alpine-block/lxc.conf: Try lxc info --show-log alpine-block for more info


The regular one, `rootfs` starts normally, the blocked backed one, `alpine-block` fails.

# Information to attach
 - [ ] Container log (`lxc info NAME --show-log`)
The container log complains about missing `/sbin/init` but it does exist

root@ubuntu2004-lxd-ssh-5-11-90-adfd7-2:/var/snap/lxd/common/lxd/containers# ls -lh alpine-block/rootfs/sbin/init lrwxrwxrwx 1 root root 12 Jun 26 2018 alpine-block/rootfs/sbin/init -> /bin/busybox root@ubuntu2004-lxd-ssh-5-11-90-adfd7-2:/var/snap/lxd/common/lxd/containers# ls -lh alpine-block/rootfs/bin/busybox -rwxr-xr-x 1 root root 822K Jun 5 04:45 alpine-block/rootfs/bin/busybox

root@ubuntu2004-lxd-ssh-5-11-90-adfd7-2:/var/snap/lxd/common/lxd/containers# lxc info --show-log alpine-block Name: alpine-block Location: none Remote: unix:// Architecture: x86_64 Created: 2020/06/09 14:23 UTC Status: Stopped Type: container Profiles: default

Log:

lxc alpine-block 20200609143303.558 WARN cgfsng - cgroups/cgfsng.c:mkdir_eexist_on_last:1152 - File exists - Failed to create directory "/sys/fs/cgroup/cpuset//lxc.monitor.alpine-block" lxc alpine-block 20200609143303.568 WARN cgfsng - cgroups/cgfsng.c:mkdir_eexist_on_last:1152 - File exists - Failed to create directory "/sys/fs/cgroup/cpuset//lxc.payload.alpine-block" lxc alpine-block 20200609143303.582 WARN cgfsng - cgroups/cgfsng.c:fchowmodat:1572 - No such file or directory - Failed to fchownat(17, memory.oom.group, 65536, 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW ) lxc alpine-block 20200609143303.697 ERROR start - start.c:start:2042 - No such file or directory - Failed to exec "/sbin/init" lxc alpine-block 20200609143303.697 ERROR sync - sync.c:sync_wait:41 - An error occurred in another process (expected sequence number 7) lxc alpine-block 20200609143303.697 ERROR lxccontainer - lxccontainer.c:wait_on_daemonized_start:850 - Received container state "ABORTING" instead of "RUNNING" lxc alpine-block 20200609143303.699 ERROR start - start.c:lxc_start:1950 - Failed to spawn container "alpine-block" lxc alpine-block 20200609143303.699 WARN start - start.c:lxc_abort:1018 - No such process - Failed to send SIGKILL via pidfd 30 for process 11649 lxc 20200609143303.780 WARN commands - commands.c:lxc_cmd_rsp_recv:124 - Connection reset by peer - Failed to receive response for command "get_state"

 - [ ] Container configuration (`lxc config show NAME --expanded`)

architecture: x86_64 config: image.architecture: amd64 image.description: Alpine edge amd64 (20200608_13:00) image.os: Alpine image.release: edge image.serial: "20200608_13:00" image.type: squashfs limits.cpu: "1" limits.cpu.allowance: 50% limits.memory: 512MB security.idmap.base: "100000" security.idmap.isolated: "true" security.idmap.size: "65536" volatile.base_image: 25d4e63055e41a70ca129049e5eecfd05e1680e1eb83761bc79ff2fa0dbb0ec7 volatile.idmap.base: "100000" volatile.idmap.current: '[{"Isuid":true,"Isgid":false,"Hostid":100000,"Nsid":0,"Maprange":65536},{"Isuid":false,"Isgid":true,"Hostid":100000,"Nsid":0,"Maprange":65536}]' volatile.idmap.next: '[{"Isuid":true,"Isgid":false,"Hostid":100000,"Nsid":0,"Maprange":65536},{"Isuid":false,"Isgid":true,"Hostid":100000,"Nsid":0,"Maprange":65536}]' volatile.last_state.idmap: '[{"Isuid":true,"Isgid":false,"Hostid":100000,"Nsid":0,"Maprange":65536},{"Isuid":false,"Isgid":true,"Hostid":100000,"Nsid":0,"Maprange":65536}]' volatile.last_state.power: STOPPED devices: root: path: / pool: default type: disk ephemeral: false profiles:

stgraber commented 4 years ago

This is a very very unsupported setup. This type of hack will completely break any of the uid/gid mapping logic, snapshots, file transfers and likely a variety of other features I'm just not thinking of right now.

The reason for what you're seeing is because of the snap's mount namespace. Basically your mount call isn't visible inside the namespace so it just sees an empty directory. This can be worked around if you do the mount inside the right namespace, but again, not something we'll support.