Package: systemd-container
Version: 232-25+deb9u1
Severity: normal
Dear Maintainer,
on stretch, 'systemd-nspawn --read-only' fails to start the container
entirely. Trivial test case:
# machinectl pull-tar
https://cloud-images.ubuntu.com/xenial/current/xenial-server-cloudimg-amd64-root.tar.gz
[ output omitted ]
# systemd-nspawn -M xenial-server-cloudimg-amd64-root -- true
# systemd-nspawn -M xenial-server-cloudimg-amd64-root --read-only -- true
Spawning container xenial-server-cloudimg-amd64-root on
/var/lib/machines/xenial-server-cloudimg-amd64-root.
Press ^] three times within 1s to kill container.
Failed to create directory
/var/lib/machines/xenial-server-cloudimg-amd64-root/sys: Read-only file system
(the first systemd-nspawn call is there to implicitly create some
directories inside the container root that must exist for read-only to
work)
The expected behavior is that 'true' is executed in container and exit
status 0 is returned; however, the container is not started and the exit
status is 1.
There is an upstream fix for this in
https://github.com/systemd/systemd/pull/4693 --
acbbf69b718260755a5dff60dd68ba239ac0d61b is the commit that actually
fixes read-only containers, but it requires two other commits to apply
cleanly. I applied the following sequence to systemd-container on
stretch:
https://github.com/systemd/systemd/commit/bdb4e0cb646ff33ecbb1cf4b502870f84bf4016d
https://github.com/systemd/systemd/commit/4f086aab52812472a24c9b8b627589880a38696e
https://github.com/systemd/systemd/commit/acbbf69b718260755a5dff60dd68ba239ac0d61b
and it solved my problem. Could you backport these patches to stretch?
-- System Information:
Debian Release: 9.1
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 4.9.0-3-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8),
LANGUAGE=en_US:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages systemd-container depends on:
ii dbus 1.10.18-1
ii libacl1 2.2.52-3+b1
ii libblkid1 2.29.2-1
ii libbz2-1.0 1.0.6-8.1
ii libc6 2.24-11+deb9u1
ii libcurl3-gnutls 7.52.1-5
ii libgcrypt20 1.7.6-2+deb9u2
ii libip4tc0 1.6.0+snapshot20161117-6
ii liblzma5 5.2.2-1.2+b1
ii libseccomp2 2.3.1-2.1
ii libselinux1 2.6-3+b1
ii systemd 232-25+deb9u1
ii zlib1g 1:1.2.8.dfsg-5
Versions of packages systemd-container recommends:
ii btrfs-progs 4.7.3-1
ii libnss-mymachines 232-25+deb9u1
systemd-container suggests no packages.
-- no debconf information
