Debdiff for Noble ** Description changed:
[Impact] - TBD + Incus supports Linux's idmapping to allow transparent host-to-guest UID and GID mapping in containers. This eliminates a manual configuration step for the UID/GID maps in many use cases. + + It is activated by adding a `disk` device to a container with the + `shift=true` parameter. + + Linux kernels v6.9 and newer are more strict with setting up this + idmapping feature, meaning Ubuntu users on Noble who update from the GA + v6.8 kernel to any HWE kernel will have this feature in Incus break with + the misleading error "Error: Failed to setup device mount "sharedir": + idmapping abilities are required but aren't supported on system" and + Incus will refuse to launch the container until the `shift=true` + parameter is removed. + + The upstream patch fixes this by adding the needed boilerplate now + enforced by the kernel to correctly set up the idmapped mount. [Test plan] - TBD + Adapted from upstream bug report. + + # Install dependencies and setup (fresh Noble cloud img) + 0. su ubuntu + 1. cd; mkdir share + 2. sudo apt install incus login + 3. sudo usermod -aG incus-admin ubuntu # your user here + 4. newgrp incus-admin # or reboot + 5. incus admin init + + # Launch test container and add `shift=true` mount + 5. incus launch images:ubuntu/22.04 test + 6. incus stop test + 7. incus config device add demo sharedir disk source=/home/share path=/mnt/share shift=true + 8. incus start demo + + # Fail output (unpatched package) + ``` + Error: Failed to setup device mount "sharedir": idmapping abilities are required but aren't supported on system + Try `incus info --show-log demo` for more info + ``` + Incus refuses to launch the container. + + # Success output (patched package) + The container launches successfully and the directory share can be read from and written to from the host and the guest. [Where problems could occur] - TBD + The patch touches code that handles idmapped mounts, which are used mainly by unprivileged containers and the aforementioned `shift=true` mounts. Thus, regression risk entails breaking storage for unprivileged containers or breaking `shift=true` mounts on the GA v6.8 kernel for Noble. + + This patch has been upstream since May 2024 and is already present in + the source tree for Resolute. No regressions have been reported against + the package in Resolute or upstream. + + The patch does slightly modify the error case by always returning `-1` + on failure instead of a specific errno as in the previous + implementation, but no functionality in Incus seems to care about the + exact error value returned by this internal function. [Other info] - TBD + Upstream bug report: https://github.com/lxc/incus/issues/882 + Upstream patch: https://github.com/stgraber/incus/commit/ec223f75e7056f271fb84be56980243cd68e67b3 + + LP builds: + Normal: https://launchpad.net/~kicchou/+archive/ubuntu/lp2143389/+packages + Proposed: https://launchpad.net/~kicchou/+archive/ubuntu/lp2143389-proposed/+packages [Original bug] This really annoying bug with no safe workaround (https://github.com/lxc/incus/issues/882) exists in current incus package on Ubuntu24.04 and it be great if the fix was available for ubuntu users without having to compile from source themselves. ** Changed in: incus (Ubuntu Noble) Status: Confirmed => In Progress ** Patch added: "lp2143389-noble-0.debdiff" https://bugs.launchpad.net/ubuntu/+source/incus/+bug/2143389/+attachment/6015476/+files/lp2143389-noble-0.debdiff -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2143389 Title: [SRU] Container directory shares fail with 'shift=true' on Linux 6.9+ To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/incus/+bug/2143389/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
