Bug#1042880: systemd: service with PrivateNetwork=yes fails to start inside a lxc container

2023-08-02 Thread Michael Biebl
Am 02.08.23 um 16:14 schrieb Simon McVittie: On Wed, 02 Aug 2023 at 13:13:05 +0200, Michael Biebl wrote: Are you by any chance using unprivileged containers? I don't know, but not intentionally! My test VM had no special configuration and no lxc before starting the steps-to-reproduce, so I

Bug#1042880: systemd: service with PrivateNetwork=yes fails to start inside a lxc container

2023-08-02 Thread Simon McVittie
On Wed, 02 Aug 2023 at 13:13:05 +0200, Michael Biebl wrote: > Are you by any chance using unprivileged containers? I don't know, but not intentionally! My test VM had no special configuration and no lxc before starting the steps-to-reproduce, so I was using whatever is the default in bookworm.

Bug#1042880: systemd: service with PrivateNetwork=yes fails to start inside a lxc container

2023-08-02 Thread Michael Biebl
Hi Simon Am 02.08.23 um 12:32 schrieb Simon McVittie: However, in a lxc container, this isn't working for me, causing autopkgtest failure for policykit-1 (>= 123) (which I'm going to work around by removing the PrivateNetwork=yes option for now). This is important because ci.debian.net can

Bug#1042880: systemd: service with PrivateNetwork=yes fails to start inside a lxc container

2023-08-02 Thread Simon McVittie
Package: systemd Version: 254-1 Severity: normal X-Debbugs-Cc: l...@packages.debian.org The PrivateNetwork=yes option hardens services by putting them in a private network namespace. systemd.exec(5) says: > Note that the implementation of this setting might be impossible (for > example if