Source: wireguard Version: 1.0.20260223-1 Severity: important Justification: fails autopkgtest on Debian CI infrastructure Tags: forky sid User: [email protected] Usertags: lxc
Hi, Debian CI is switching away from lxc containers in favor of incus Containers. This is motivated by security concerns from us; incus is based on lxc, but orchestrates containers substantially different: containers are not privileged (so root in the container is not uid 0 outside of it), and incus imposes a stricter isolation from the host system). wireguard passes its tests under lxc, but fails under incus. The relevant part of the failure is (hopefully): > dracut: Generating /boot/initrd.img-7.1.7+deb14-amd64 > dracut-install: WARNING: could not locate dlopen dependency for gcrypt > feature requested by > '/usr/lib/x86_64-linux-gnu/systemd/libsystemd-shared-261.so' > Setting up linux-image-amd64 (7.1.7-1) ... > Setting up wireguard (1.0.20260223-1) ... > Processing triggers for libc-bin (2.42-17) ... > Processing triggers for dracut (112-1) ... > update-initramfs: Generating /boot/initrd.img-7.1.7+deb14-amd64 > dracut-install: WARNING: could not locate dlopen dependency for gcrypt > feature requested by > '/usr/lib/x86_64-linux-gnu/systemd/libsystemd-shared-261.so' > autopkgtest [20:53:53]: test wg-quick: [----------------------- > Setting things up > Generating keys > Generating wireguard config > Cleaning up old namespaces > Creating new namespaces left_ns and right_ns and adding loopback interface to > them > mount of /sys failed: Operation not permitted > mount of /sys failed: Operation not permitted > Creating veth interface connecting both namespaces > mount of /sys failed: Operation not permitted > mount of /sys failed: Operation not permitted > mount of /sys failed: Operation not permitted > mount of /sys failed: Operation not permitted > Bringing up LEFT wireguard interface in namespace left_ns > mount of /sys failed: Operation not permitted > Bringing up RIGHT wireguard interface in namespace right_ns > mount of /sys failed: Operation not permitted > Failed vpn test setup > Some test failed, here is some debugging > dmesg: read kernel buffer failed: Operation not permitted > autopkgtest [20:53:53]: test wg-quick: -----------------------] > autopkgtest [20:53:53]: test wg-quick: - - - - - - - - - - results - - - - - > - - - - - > wg-quick FAIL non-zero exit status 1 The full autokpgtest logs are available at: https://ci.debian.net/experiments/8/regressions/ (please beware of pagination) Common types of failure and suggested fixes are being documented at: https://wiki.debian.org/ContinuousIntegration/LxcToIncus Note that for the time being, wireguard is still being tested under lxc to avoid disturbing its testing migration test results. If you decide to add the `isolation-machine` restriction to get this package tested under qemu, please mention that explicitly when closing this bug (it's fine to do that only in the package changelog entry that closes the bug) so that we can configure your package for qemu on ci.debian.net.
signature.asc
Description: PGP signature
