** Description changed: [Impact] Incus supports Linux's idmapping to allow transparent host-to-guest UID and GID mapping in containers. This eliminates a manual configuration step for the UID/GID maps in many use cases. It is activated by adding a `disk` device to a container with the `shift=true` parameter. Linux kernels v6.9 and newer are more strict with setting up this idmapping feature, meaning Ubuntu users on Noble who update from the GA v6.8 kernel to any HWE kernel will have this feature in Incus break with the misleading error "Error: Failed to setup device mount "sharedir": idmapping abilities are required but aren't supported on system" and Incus will refuse to launch the container until the `shift=true` parameter is removed. The upstream patch fixes this by adding the needed boilerplate now enforced by the kernel to correctly set up the idmapped mount. [Test plan] Adapted from upstream bug report. # Install dependencies and setup (fresh Noble cloud img) 0. su ubuntu 1. cd; mkdir share 2. sudo apt install incus login 3. sudo usermod -aG incus-admin ubuntu # your user here 4. newgrp incus-admin # or reboot - 5. incus admin init + 5. incus admin init # exact config doesn't really matter # Launch test container and add `shift=true` mount - 5. incus launch images:ubuntu/22.04 test - 6. incus stop test - 7. incus config device add demo sharedir disk source=/home/share path=/mnt/share shift=true - 8. incus start demo + 6. incus launch images:ubuntu/22.04 test + 7. incus stop test + 8. incus config device add demo sharedir disk source=/home/share path=/mnt/share shift=true + 9. incus start demo # Fail output (unpatched package) ``` Error: Failed to setup device mount "sharedir": idmapping abilities are required but aren't supported on system Try `incus info --show-log demo` for more info ``` Incus refuses to launch the container. # Success output (patched package) The container launches successfully and the directory share can be read from and written to from the host and the guest. [Where problems could occur] The patch touches code that handles idmapped mounts, which are used mainly by unprivileged containers and the aforementioned `shift=true` mounts. Thus, regression risk entails breaking storage for unprivileged containers or breaking `shift=true` mounts on the GA v6.8 kernel for Noble. This patch has been upstream since May 2024 and is already present in the source tree for Resolute. No regressions have been reported against the package in Resolute or upstream. The patch does slightly modify the error case by always returning `-1` on failure instead of a specific errno as in the previous implementation, but no functionality in Incus seems to care about the exact error value returned by this internal function. [Other info] Upstream bug report: https://github.com/lxc/incus/issues/882 Upstream patch: https://github.com/stgraber/incus/commit/ec223f75e7056f271fb84be56980243cd68e67b3 LP builds: Normal: https://launchpad.net/~kicchou/+archive/ubuntu/lp2143389/+packages Proposed: https://launchpad.net/~kicchou/+archive/ubuntu/lp2143389-proposed/+packages [Original bug] This really annoying bug with no safe workaround (https://github.com/lxc/incus/issues/882) exists in current incus package on Ubuntu24.04 and it be great if the fix was available for ubuntu users without having to compile from source themselves.
** Description changed: [Impact] Incus supports Linux's idmapping to allow transparent host-to-guest UID and GID mapping in containers. This eliminates a manual configuration step for the UID/GID maps in many use cases. It is activated by adding a `disk` device to a container with the `shift=true` parameter. Linux kernels v6.9 and newer are more strict with setting up this idmapping feature, meaning Ubuntu users on Noble who update from the GA v6.8 kernel to any HWE kernel will have this feature in Incus break with the misleading error "Error: Failed to setup device mount "sharedir": idmapping abilities are required but aren't supported on system" and Incus will refuse to launch the container until the `shift=true` parameter is removed. The upstream patch fixes this by adding the needed boilerplate now enforced by the kernel to correctly set up the idmapped mount. [Test plan] Adapted from upstream bug report. # Install dependencies and setup (fresh Noble cloud img) 0. su ubuntu 1. cd; mkdir share 2. sudo apt install incus login 3. sudo usermod -aG incus-admin ubuntu # your user here 4. newgrp incus-admin # or reboot 5. incus admin init # exact config doesn't really matter # Launch test container and add `shift=true` mount 6. incus launch images:ubuntu/22.04 test 7. incus stop test - 8. incus config device add demo sharedir disk source=/home/share path=/mnt/share shift=true - 9. incus start demo + 8. incus config device add test sharedir disk source=/home/share path=/mnt/share shift=true + 9. incus start test # Fail output (unpatched package) ``` Error: Failed to setup device mount "sharedir": idmapping abilities are required but aren't supported on system Try `incus info --show-log demo` for more info ``` Incus refuses to launch the container. # Success output (patched package) The container launches successfully and the directory share can be read from and written to from the host and the guest. [Where problems could occur] The patch touches code that handles idmapped mounts, which are used mainly by unprivileged containers and the aforementioned `shift=true` mounts. Thus, regression risk entails breaking storage for unprivileged containers or breaking `shift=true` mounts on the GA v6.8 kernel for Noble. This patch has been upstream since May 2024 and is already present in the source tree for Resolute. No regressions have been reported against the package in Resolute or upstream. The patch does slightly modify the error case by always returning `-1` on failure instead of a specific errno as in the previous implementation, but no functionality in Incus seems to care about the exact error value returned by this internal function. [Other info] Upstream bug report: https://github.com/lxc/incus/issues/882 Upstream patch: https://github.com/stgraber/incus/commit/ec223f75e7056f271fb84be56980243cd68e67b3 LP builds: Normal: https://launchpad.net/~kicchou/+archive/ubuntu/lp2143389/+packages Proposed: https://launchpad.net/~kicchou/+archive/ubuntu/lp2143389-proposed/+packages [Original bug] This really annoying bug with no safe workaround (https://github.com/lxc/incus/issues/882) exists in current incus package on Ubuntu24.04 and it be great if the fix was available for ubuntu users without having to compile from source themselves. ** Description changed: [Impact] Incus supports Linux's idmapping to allow transparent host-to-guest UID and GID mapping in containers. This eliminates a manual configuration step for the UID/GID maps in many use cases. It is activated by adding a `disk` device to a container with the `shift=true` parameter. Linux kernels v6.9 and newer are more strict with setting up this idmapping feature, meaning Ubuntu users on Noble who update from the GA v6.8 kernel to any HWE kernel will have this feature in Incus break with the misleading error "Error: Failed to setup device mount "sharedir": idmapping abilities are required but aren't supported on system" and Incus will refuse to launch the container until the `shift=true` parameter is removed. The upstream patch fixes this by adding the needed boilerplate now enforced by the kernel to correctly set up the idmapped mount. [Test plan] Adapted from upstream bug report. # Install dependencies and setup (fresh Noble cloud img) 0. su ubuntu 1. cd; mkdir share 2. sudo apt install incus login 3. sudo usermod -aG incus-admin ubuntu # your user here 4. newgrp incus-admin # or reboot 5. incus admin init # exact config doesn't really matter # Launch test container and add `shift=true` mount 6. incus launch images:ubuntu/22.04 test - 7. incus stop test + 7. incus stop test # mount fails silently if container is running 8. incus config device add test sharedir disk source=/home/share path=/mnt/share shift=true 9. incus start test # Fail output (unpatched package) ``` Error: Failed to setup device mount "sharedir": idmapping abilities are required but aren't supported on system Try `incus info --show-log demo` for more info ``` Incus refuses to launch the container. # Success output (patched package) The container launches successfully and the directory share can be read from and written to from the host and the guest. [Where problems could occur] The patch touches code that handles idmapped mounts, which are used mainly by unprivileged containers and the aforementioned `shift=true` mounts. Thus, regression risk entails breaking storage for unprivileged containers or breaking `shift=true` mounts on the GA v6.8 kernel for Noble. This patch has been upstream since May 2024 and is already present in the source tree for Resolute. No regressions have been reported against the package in Resolute or upstream. The patch does slightly modify the error case by always returning `-1` on failure instead of a specific errno as in the previous implementation, but no functionality in Incus seems to care about the exact error value returned by this internal function. [Other info] Upstream bug report: https://github.com/lxc/incus/issues/882 Upstream patch: https://github.com/stgraber/incus/commit/ec223f75e7056f271fb84be56980243cd68e67b3 LP builds: Normal: https://launchpad.net/~kicchou/+archive/ubuntu/lp2143389/+packages Proposed: https://launchpad.net/~kicchou/+archive/ubuntu/lp2143389-proposed/+packages [Original bug] This really annoying bug with no safe workaround (https://github.com/lxc/incus/issues/882) exists in current incus package on Ubuntu24.04 and it be great if the fix was available for ubuntu users without having to compile from source themselves. ** Description changed: [Impact] Incus supports Linux's idmapping to allow transparent host-to-guest UID and GID mapping in containers. This eliminates a manual configuration step for the UID/GID maps in many use cases. It is activated by adding a `disk` device to a container with the `shift=true` parameter. Linux kernels v6.9 and newer are more strict with setting up this idmapping feature, meaning Ubuntu users on Noble who update from the GA v6.8 kernel to any HWE kernel will have this feature in Incus break with the misleading error "Error: Failed to setup device mount "sharedir": idmapping abilities are required but aren't supported on system" and Incus will refuse to launch the container until the `shift=true` parameter is removed. The upstream patch fixes this by adding the needed boilerplate now enforced by the kernel to correctly set up the idmapped mount. [Test plan] Adapted from upstream bug report. # Install dependencies and setup (fresh Noble cloud img) 0. su ubuntu 1. cd; mkdir share 2. sudo apt install incus login 3. sudo usermod -aG incus-admin ubuntu # your user here 4. newgrp incus-admin # or reboot 5. incus admin init # exact config doesn't really matter # Launch test container and add `shift=true` mount 6. incus launch images:ubuntu/22.04 test - 7. incus stop test # mount fails silently if container is running + 7. incus stop test # makes failure more explicit when relaunching container 8. incus config device add test sharedir disk source=/home/share path=/mnt/share shift=true 9. incus start test # Fail output (unpatched package) ``` Error: Failed to setup device mount "sharedir": idmapping abilities are required but aren't supported on system Try `incus info --show-log demo` for more info ``` Incus refuses to launch the container. # Success output (patched package) The container launches successfully and the directory share can be read from and written to from the host and the guest. [Where problems could occur] The patch touches code that handles idmapped mounts, which are used mainly by unprivileged containers and the aforementioned `shift=true` mounts. Thus, regression risk entails breaking storage for unprivileged containers or breaking `shift=true` mounts on the GA v6.8 kernel for Noble. This patch has been upstream since May 2024 and is already present in the source tree for Resolute. No regressions have been reported against the package in Resolute or upstream. The patch does slightly modify the error case by always returning `-1` on failure instead of a specific errno as in the previous implementation, but no functionality in Incus seems to care about the exact error value returned by this internal function. [Other info] Upstream bug report: https://github.com/lxc/incus/issues/882 Upstream patch: https://github.com/stgraber/incus/commit/ec223f75e7056f271fb84be56980243cd68e67b3 LP builds: Normal: https://launchpad.net/~kicchou/+archive/ubuntu/lp2143389/+packages Proposed: https://launchpad.net/~kicchou/+archive/ubuntu/lp2143389-proposed/+packages [Original bug] This really annoying bug with no safe workaround (https://github.com/lxc/incus/issues/882) exists in current incus package on Ubuntu24.04 and it be great if the fix was available for ubuntu users without having to compile from source themselves. ** Description changed: [Impact] Incus supports Linux's idmapping to allow transparent host-to-guest UID and GID mapping in containers. This eliminates a manual configuration step for the UID/GID maps in many use cases. It is activated by adding a `disk` device to a container with the `shift=true` parameter. Linux kernels v6.9 and newer are more strict with setting up this idmapping feature, meaning Ubuntu users on Noble who update from the GA v6.8 kernel to any HWE kernel will have this feature in Incus break with the misleading error "Error: Failed to setup device mount "sharedir": idmapping abilities are required but aren't supported on system" and Incus will refuse to launch the container until the `shift=true` parameter is removed. The upstream patch fixes this by adding the needed boilerplate now enforced by the kernel to correctly set up the idmapped mount. [Test plan] Adapted from upstream bug report. # Install dependencies and setup (fresh Noble cloud img) 0. su ubuntu 1. cd; mkdir share 2. sudo apt install incus login 3. sudo usermod -aG incus-admin ubuntu # your user here 4. newgrp incus-admin # or reboot 5. incus admin init # exact config doesn't really matter # Launch test container and add `shift=true` mount 6. incus launch images:ubuntu/22.04 test 7. incus stop test # makes failure more explicit when relaunching container - 8. incus config device add test sharedir disk source=/home/share path=/mnt/share shift=true + 8. incus config device add test sharedir disk source=/home/ubuntu/share path=/mnt/share shift=true 9. incus start test # Fail output (unpatched package) ``` Error: Failed to setup device mount "sharedir": idmapping abilities are required but aren't supported on system Try `incus info --show-log demo` for more info ``` Incus refuses to launch the container. # Success output (patched package) The container launches successfully and the directory share can be read from and written to from the host and the guest. [Where problems could occur] The patch touches code that handles idmapped mounts, which are used mainly by unprivileged containers and the aforementioned `shift=true` mounts. Thus, regression risk entails breaking storage for unprivileged containers or breaking `shift=true` mounts on the GA v6.8 kernel for Noble. This patch has been upstream since May 2024 and is already present in the source tree for Resolute. No regressions have been reported against the package in Resolute or upstream. The patch does slightly modify the error case by always returning `-1` on failure instead of a specific errno as in the previous implementation, but no functionality in Incus seems to care about the exact error value returned by this internal function. [Other info] Upstream bug report: https://github.com/lxc/incus/issues/882 Upstream patch: https://github.com/stgraber/incus/commit/ec223f75e7056f271fb84be56980243cd68e67b3 LP builds: Normal: https://launchpad.net/~kicchou/+archive/ubuntu/lp2143389/+packages Proposed: https://launchpad.net/~kicchou/+archive/ubuntu/lp2143389-proposed/+packages [Original bug] This really annoying bug with no safe workaround (https://github.com/lxc/incus/issues/882) exists in current incus package on Ubuntu24.04 and it be great if the fix was available for ubuntu users without having to compile from source themselves. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2143389 Title: [SRU] Container directory shares fail with 'shift=true' on Linux 6.9+ To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/incus/+bug/2143389/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
