Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: NixOS/nixpkgs
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: 80e263b38905^
Choose a base ref
...
head repository: NixOS/nixpkgs
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: 161a35b0b8e4
Choose a head ref
  • 4 commits
  • 3 files changed
  • 2 contributors

Commits on Apr 29, 2021

  1. nixos/lxd: explicitly load kernel modules 

    This is analogous to #70447 and #76487.

These are all needed to attach a container to the default bridge
network, without which the final line of the following script fails with
the error for each respective kernel module listed below.

```sh
lxc storage create foo dir
lxc launch -s foo ubuntu:trusty bar
lxc network attach lxdbr0 bar
```

veth
----

> Error: Failed to start device 'lxdbr0': Failed to create the veth interfaces vethefbc3cd6 and vetha4abbcbc: Failed to run: ip link add dev vethefbc3cd6 type veth peer name vetha4abbcbc: RTNETLINK answers: Operation not supported

iptable_mangle
--------------

> lvl=eror msg="Failed to bring up network" err="Failed to list ipv4 rules for LXD network lxdbr0 (table mangle)" name=lxdbr0

xt_comment
----------

> lvl=error msg="Failed to bring up network" err="Failed to run: iptables -w -t filter -I INPUT -i lxdbr0 -p udp --dport 67 -j ACCEPT -m comment --comment generated for LXD network lxdbr0: iptables v1.8.4 (legacy): Couldn't load match `comment':No such file or directory\n\nTry `iptables -h' or 'iptables --help' for more information." name=lxdbr0

xt_MASQUERADE
-------------

> vl=eror msg="Failed to bring up network" err="Failed to run: iptables -w -t nat -I POSTROUTING -s 10.0.107.0/24 ! -d 10.0.107.0/24 -j MASQUERADE -m comment --comment generated for LXD network lxdbr0: iptables v1.8.4 (legacy): Couldn't load target `MASQUERADE':No such file or directory\n\nTry `iptables -h' or 'iptables --help' for more information." name=lxdbr0
    @ryneeverett @mkg20001
    ryneeverett authored and mkg20001 committed Apr 29, 2021

    Verified

    This commit was signed with the committer’s verified signature.
    costrouc Christopher Ostrouchov
    GPG key ID: 9ED59B0AB1EAF573
    Verified
    Learn about vigilant mode
    Copy the full SHA
    80e263b View commit details

  2. lxd: reference nixos tests

    @Mic92 @mkg20001
    Mic92 authored and mkg20001 committed Apr 29, 2021

    Verified

    This commit was signed with the committer’s verified signature.
    costrouc Christopher Ostrouchov
    GPG key ID: 9ED59B0AB1EAF573
    Verified
    Learn about vigilant mode
    Copy the full SHA
    c1b8fdf View commit details

  3. nixos/lxd: fix race condition in test

    @Mic92 @mkg20001
    Mic92 authored and mkg20001 committed Apr 29, 2021

    Verified

    This commit was signed with the committer’s verified signature.
    costrouc Christopher Ostrouchov
    GPG key ID: 9ED59B0AB1EAF573
    Verified
    Learn about vigilant mode
    Copy the full SHA
    243521f View commit details

  4. nixos/lxd: explicitly load xt_CHECKSUM module 

    This module is needed to create bridge networks such as the default
lxdbr0 created by `lxd init`. Without this module, running `lxc network
create lxdbr0` errors with:

> Error: Failed to create network 'lxdbr0': Failed to run: iptables -w -t mangle -I POSTROUTING -o lxdbr0 -p udp --dport 68 -j CHECKSUM --checksum-fill -m comment --comment generated for LXD network lxdbr0: iptables v1.8.5 (legacy): unknown option "--checksum-fill"
    @ryneeverett @mkg20001
    ryneeverett authored and mkg20001 committed Apr 29, 2021

    Verified

    This commit was signed with the committer’s verified signature.
    costrouc Christopher Ostrouchov
    GPG key ID: 9ED59B0AB1EAF573
    Verified
    Learn about vigilant mode
    Copy the full SHA
    161a35b View commit details
Showing with 10 additions and 0 deletions.
  1. +3 −0 nixos/modules/virtualisation/lxd.nix
  2. +4 −0 nixos/tests/lxd.nix
  3. +3 −0 pkgs/tools/admin/lxd/default.nix
3 changes: 3 additions & 0 deletions nixos/modules/virtualisation/lxd.nix
View file
Original file line number Diff line number Diff line change
@@ -169,5 +169,8 @@ in {
"net.ipv6.neigh.default.gc_thresh3" = 8192;
"kernel.keys.maxkeys" = 2000;
};

boot.kernelModules = [ "veth" "xt_comment" "xt_CHECKSUM" "xt_MASQUERADE" ]
++ optionals (!config.networking.nftables.enable) [ "iptable_mangle" ];
};
}
4 changes: 4 additions & 0 deletions nixos/tests/lxd.nix
View file
Original file line number Diff line number Diff line change
@@ -96,6 +96,7 @@ in {
## limits.cpu ##
machine.succeed("lxc config set test limits.cpu 1")
machine.succeed("lxc restart test")
# Since Alpine doesn't have `nproc` pre-installed, we've gotta resort
# to the primal methods
@@ -105,6 +106,7 @@ in {
)
machine.succeed("lxc config set test limits.cpu 2")
machine.succeed("lxc restart test")
assert (
"2"
@@ -115,13 +117,15 @@ in {
## limits.memory ##
machine.succeed("lxc config set test limits.memory 64MB")
machine.succeed("lxc restart test")
assert (
"MemTotal: 62500 kB"
== machine.succeed("lxc exec test grep -- MemTotal /proc/meminfo").strip()
)
machine.succeed("lxc config set test limits.memory 128MB")
machine.succeed("lxc restart test")
assert (
"MemTotal: 125000 kB"
3 changes: 3 additions & 0 deletions pkgs/tools/admin/lxd/default.nix
View file
Original file line number Diff line number Diff line change
@@ -7,6 +7,7 @@
, bash
, installShellFiles
, nftablesSupport ? false
, nixosTests
}:

let
@@ -58,6 +59,8 @@ buildGoPackage rec {
installShellCompletion --bash --name lxd go/src/github.com/lxc/lxd/scripts/bash/lxd-client
'';

passthru.tests.lxd = nixosTests.lxd;

nativeBuildInputs = [ installShellFiles pkg-config makeWrapper ];
buildInputs = [ lxc acl libcap libco-canonical.dev dqlite.dev
raft-canonical.dev sqlite-replication udev.dev ];