Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1025793 > unrolled thread

Bug#958910: debci: 'debci setup -a armhf' fails to set up an lxc container on an amd64 host

Back to article view | Back to linux.debian.bugs.dist

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Bug#958910: debci: 'debci setup -a armhf' fails to set up an lxc container on an amd64 host Sven Geuer <debmaint@g-e-u-e-r.de> - 2020-09-20 20:50 +0200
    Bug#958910: debci: 'debci setup -a armhf' fails to set up an lxc container on an amd64 host Antonio Terceiro <terceiro@debian.org> - 2020-09-21 17:10 +0200
      Bug#958910: debci: 'debci setup -a armhf' fails to set up an lxc container on an amd64 host Antonio Terceiro <terceiro@debian.org> - 2020-09-26 15:10 +0200
        Bug#958910: debci: 'debci setup -a armhf' fails to set up an lxc container on an amd64 host Sven Geuer <debmaint@g-e-u-e-r.de> - 2020-09-26 15:50 +0200
        Bug#958910: debci: 'debci setup -a armhf' fails to set up an lxc container on an amd64 host Sven Geuer <debmaint@g-e-u-e-r.de> - 2020-09-26 16:20 +0200
          Bug#958910: debci: 'debci setup -a armhf' fails to set up an lxc container on an amd64 host Antonio Terceiro <terceiro@debian.org> - 2020-09-26 18:00 +0200
            Bug#958910: debci: 'debci setup -a armhf' fails to set up an lxc container on an amd64 host Sven Geuer <debmaint@g-e-u-e-r.de> - 2020-09-26 19:30 +0200
              Bug#958910: debci: 'debci setup -a armhf' fails to set up an lxc container on an amd64 host Sven Geuer <debmaint@g-e-u-e-r.de> - 2020-09-27 13:10 +0200
                Bug#958910: debci: 'debci setup -a armhf' fails to set up an lxc container on an amd64 host Sven Geuer <debmaint@g-e-u-e-r.de> - 2020-09-27 15:50 +0200

#1025793 — Bug#958910: debci: 'debci setup -a armhf' fails to set up an lxc container on an amd64 host

[Multipart message — attachments visible in raw view] — view raw

Dear Maintainer,

I am missing someone has taken a look into this issue. I'd appreciate
to get some feedback.

Please let me know what further input from my side may be helpful.

Regards,
Sven

[toc] | [next] | [standalone]

#1025904

[Multipart message — attachments visible in raw view] — view raw

Control: tag -1 + moreinfo

On Sun, Sep 20, 2020 at 08:32:50PM +0200, Sven Geuer wrote:
> Dear Maintainer,
> 
> I am missing someone has taken a look into this issue. I'd appreciate
> to get some feedback.
> 
> Please let me know what further input from my side may be helpful.

I just tried it here, and it just worked for me. Are you able to start
regular lxc containers?

[toc] | [prev] | [next] | [standalone]

#1026510

[Multipart message — attachments visible in raw view] — view raw

On Fri, Sep 25, 2020 at 10:08:40PM +0200, Sven Geuer wrote:
> Hello Antonio,
> 
> I have no issue with containers of the native amd64 architecture of my
> system. Setting up and using a i386 container also works flawlessly. I
> have been using them even before trying to setup a container of a
> foreign architecture.
> 
> I seem to have a general issue to setup containers of a foreign
> architecture, armhf is a mere example. I repeated a armhf setup. It
> keeps failing, while the error looks different now compared to my first
> post. It presents itself as a network access error:
> 
> [...]
> Running setup script /usr/share/autopkgtest/setup-commands/setup-
> testbed...
> /usr/bin/sh: Attempting to set up Debian/Ubuntu apt sources
> automatically
> /usr/bin/sh: Distribution assumed to resemble Debian
> Err:1 http://deb.debian.org/debian unstable InRelease
>   Temporary failure resolving 'deb.debian.org'
> Reading package lists...
> W: Failed to fetch 
> http://deb.debian.org/debian/dists/unstable/InRelease  Temporary
> failure resolving 'deb.debian.org'
> [...]
> 
> Please see attach a complete log of the setup run. Hope this helps to
> track down what going on.

I already knew you couldn't setup a debci container, that's why I asked
if you are able to create and start a plain lxc container in a foreign
architecture, so we can track down whether the issue is in debci, lxc,
or something else that is broken on your end (since it works for me).

e.g. does this work:

sudo lxc-create --template=debian --name=armhf -- --arch=armhf
sudo lxc-start --name=armhf
sudo lxc-attach --name=armhf

?

[toc] | [prev] | [next] | [standalone]

#1026514

[Multipart message — attachments visible in raw view] — view raw

Hello Antonio,

> e.g. does this work:
> 
> sudo lxc-create --template=debian --name=armhf -- --arch=armhf
> sudo lxc-start --name=armhf
> sudo lxc-attach --name=armhf
> 
> ?

It seems to work in some way. But there are some errors at the end of
the installation process. Also, lxc-stop takes several seconds to
complete and it comes back with an error.

Here's the relevant output:

root@e580sg:~# lxc-create --template=debian --name=armhf -- --
arch=armhf
debootstrap ist /usr/sbin/debootstrap
Checking cache download in /var/cache/lxc/debian/rootfs-stable-armhf
... 
Downloading debian minimal ...
I: Target architecture can be executed
I: Retrieving InRelease 
I: Checking Release signature
I: Valid Release signature (key id
6D33866EDD8FFA41C0143AEDDCC9EFBF77E11517)
I: Retrieving Packages 
I: Validating Packages 
I: Resolving dependencies of required packages...
I: Resolving dependencies of base packages...
I: Checking component main on http://deb.debian.org/debian...
[...]
I: Base system installed successfully.
Download complete.
Copying rootfs to /var/lib/lxc/armhf/rootfs...Generating locales (this
might take a while)...
  de_DE.UTF-8... done
  de_DE.UTF-8... done
Generation complete.
update-rc.d: error: cannot find a LSB script for checkroot.sh
update-rc.d: error: cannot find a LSB script for umountfs
Failed to disable unit, unit hwclock.sh.service does not exist.
update-rc.d: error: cannot find a LSB script for hwclockfirst.sh
Creating SSH2 RSA key; this may take some time ...
2048 SHA256:eyTvbzzRV0YzdRVk9sFLWp9dzK0nRuUPgN2k6QMpkMY root@e580sg
(RSA)
Creating SSH2 ECDSA key; this may take some time ...
256 SHA256:CfbEORbaL5SptfEnhIQDdg3M/3tNkRPX1mkL5FwUyOE root@e580sg
(ECDSA)
Creating SSH2 ED25519 key; this may take some time ...
256 SHA256:rGf9JbAsSf8Go+5CZGLQH5Vag4reEEey/PjEWfVl8Vg root@e580sg
(ED25519)
invoke-rc.d: could not determine current runlevel
invoke-rc.d: policy-rc.d denied execution of start.

Current default time zone: 'Etc/UTC'
Local time is now:      Sat Sep 26 13:31:23 UTC 2020.
Universal Time is now:  Sat Sep 26 13:31:23 UTC 2020.

root@e580sg:~# lxc-start --name=armhf
root@e580sg:~# lxc-attach --name=armhf
root@armhf:~# uname -a
Linux armhf 5.8.0-2-amd64 #1 SMP Debian 5.8.10-1 (2020-09-19) armv7l
GNU/Linux
root@armhf:~# exit
exit
root@e580sg:~# lxc-stop --name=armhf
lxc-stop: armhf: commands_utils.c: lxc_cmd_sock_rcv_state: 72 Resource
temporarily unavailable - Failed to receive message

Hope this helps.

Sven

[toc] | [prev] | [next] | [standalone]

#1026516

[Multipart message — attachments visible in raw view] — view raw

Further tests show that networking does not seem to work:

root@e580sg:~# lxc-start -n armhf 
root@e580sg:~# lxc-attach -n armhf 
root@armhf:~# LANG=C apt update
Err:1 http://security.debian.org stable/updates InRelease
  Temporary failure resolving 'security.debian.org'
Err:2 http://deb.debian.org/debian stable InRelease
  Temporary failure resolving 'deb.debian.org'
Reading package lists... Done    
Building dependency tree... Done
All packages are up to date.
W: Failed to fetch http://deb.debian.org/debian/dists/stable/InRelease 
 Temporary failure resolving 'deb.debian.org'
W: Failed to fetch 
http://security.debian.org/dists/stable/updates/InRelease  Temporary
failure resolving 'security.debian.org'
W: Some index files failed to download. They have been ignored, or old
ones used instead.
root@armhf:~# exit
exit
root@e580sg:~# lxc-stop -n armhf 
lxc-stop: armhf: commands_utils.c: lxc_cmd_sock_rcv_state: 72 Resource
temporarily unavailable - Failed to receive message

[toc] | [prev] | [next] | [standalone]

#1026519

[Multipart message — attachments visible in raw view] — view raw

On Sat, Sep 26, 2020 at 04:09:34PM +0200, Sven Geuer wrote:
> Further tests show that networking does not seem to work:
> 
> root@e580sg:~# lxc-start -n armhf 
> root@e580sg:~# lxc-attach -n armhf 
> root@armhf:~# LANG=C apt update
> Err:1 http://security.debian.org stable/updates InRelease
>   Temporary failure resolving 'security.debian.org'
> Err:2 http://deb.debian.org/debian stable InRelease
>   Temporary failure resolving 'deb.debian.org'
> Reading package lists... Done    
> Building dependency tree... Done
> All packages are up to date.
> W: Failed to fetch http://deb.debian.org/debian/dists/stable/InRelease 
>  Temporary failure resolving 'deb.debian.org'
> W: Failed to fetch 
> http://security.debian.org/dists/stable/updates/InRelease  Temporary
> failure resolving 'security.debian.org'
> W: Some index files failed to download. They have been ignored, or old
> ones used instead.
> root@armhf:~# exit
> exit
> root@e580sg:~# lxc-stop -n armhf 
> lxc-stop: armhf: commands_utils.c: lxc_cmd_sock_rcv_state: 72 Resource
> temporarily unavailable - Failed to receive message

Does networking work in n ative plain lxc container?  What does your
/etc/lxc/default.conf look like?

[toc] | [prev] | [next] | [standalone]

#1026529

[Multipart message — attachments visible in raw view] — view raw

> Does networking work in n ative plain lxc container?

Networking works with plain native containers as is does with debci
generated native ones.

root@e580sg:~# lxc-start -n amd64
root@e580sg:~# lxc-attach -n amd64
root@amd64:~# LANG=C apt update
Get:1 http://security.debian.org stable/updates InRelease [65.4 kB]
Hit:2 http://deb.debian.org/debian stable InRelease  
Get:3 http://deb.debian.org/debian stable/main Translation-en [5968 kB]
Get:4 http://security.debian.org stable/updates/main amd64 Packages
[233 kB]
Get:5 http://security.debian.org stable/updates/main Translation-en
[125 kB]   
Fetched 6392 kB in 5s (1329
kB/s)                                              
Reading package lists... Done
Building dependency tree... Done
All packages are up to date.
root@amd64:~# exit
exit
root@e580sg:~# lxc-stop -n amd64

Note: lxc-stop terminates quickly and without any error message.

> What does your/etc/lxc/default.conf look like?

lxc.net.0.type = veth
lxc.net.0.link = br0
lxc.net.0.flags = up
lxc.apparmor.profile = generated
lxc.apparmor.allow_nesting = 1

Sven

[toc] | [prev] | [next] | [standalone]

#1026591

[Multipart message — attachments visible in raw view] — view raw

I tracked the issue down to the following point:

Networking works only for native containers with my usual local setup
made up of a bridge configured in /etc/network/interfaces, dnsmasq
listing on that bridge and arno-iptables-firewall doing the
masquerading and forwarding.

Networking works for native and armhf containers with using lxc-net and
my firewall disabled.

Networking fails for native and armhf containers with using lxc-net and
my firewall enabled.

So my questions are:

What's the difference between using lcx-net alone and my home-grown
setup (which works perfectly well also for qemu and virtualbox VMs)
with regards to non-native containers?

Does lxc-net anything specific regarding a containers architecture?

Should this be a bug against lxc then?

Off-topic: At present my email provider does not handle sender
validiation properly, so the mail server for debian.org refuses my
mails. Luckily they are accepted at bugs.debian.org.

Sven

[toc] | [prev] | [next] | [standalone]

#1026606

[Multipart message — attachments visible in raw view] — view raw

I solved the issue for my environment. I observed the armhf container
did not receive dnsmasq's UDP replies. Examining /usr/libexec/lxc/lxc-
net I identified this line

iptables $use_iptables_lock -t mangle -A POSTROUTING -o ${LXC_BRIDGE}
-p udp -m udp --dport 68 -j CHECKSUM --checksum-fill

as something special and added its equivalent to my firewall
configuration. Since then networking works perfectly well also for the
armhf container.

I believe the special purpose of this iptables rule should be pointed
out not sure where.

Antonio, our questions helped me to look in the right direction. Thanks
for your patience.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web