Change:
not working in lxc containers. But sysctl command works fine and /proc/sys/ is writable. This nix option seems to finally take effect via . And the look like this: This looks fine, So I tried to manually run the command in , and it takes effect! But this looks even weirder. Through , I got: There is an unusual . It looks like this: Obviously, there is not is NixOS. So won't run at all. I looked it up on the internet and found out it's from distrobuilder: So maybe we should just patch it? Steps to reproduce the behavior: a privilege container with NixOS in it. something to and rebuild the system , and there is no effect should run and takes effect. <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --Please run and paste the result. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
Are you able to you reproduce this with unstable? There are some improvements post 23.11 to the use of the lxc generator.
Yes, I'm already on latest unstable channel. The channel information in metadata tab is incorrect because I'm using flakes. There are many hard-coded FHS paths in distrobuilder. Such as this line, that causes this problem:
can you test this change?
It works fine for me. But I don’t know if there are any problems caused by other hard-coded paths in distrobuilder. And I don’t know whether using sysctl on an unprivileged container will cause the service to fail to start, and whether the startup failure will cause problems. But it seems that sets , so there should be no problem?
Thanks for testing! There shouldn't be, since we patch and wrap the distrobuilder lxc generator. I audited it again after updating the patch for this fix. You can always see the resulting file by building . The PR has tests which should cover unprivileged containers. I've just updated them to add a check verifying systemd-sysctl successfully started.

Discussion:
configuration = { # Building documentation makes the test unnecessarily take a longer time: documentation.enable = lib.mkForce false; <ins> boot.kernel.sysctl."net.ipv4.ip_forward" = "1"; </ins> } // extra; };

with machine.nested("Waiting for instance to start and be usable"): retry(instance_is_up) <ins> def check_sysctl(instance): with subtest("systemd sysctl settings are applied"): machine.succeed(f"incus exec {instance} -- systemctl status systemd-sysctl") sysctl = machine.succeed(f"incus exec {instance} -- sysctl net.ipv4.ip_forward").strip().split(" ")[-1] assert "1" == sysctl, f"systemd-sysctl configuration not correctly applied, {sysctl} != 1" </ins> machine.wait_for_unit("incus.service") # no preseed should mean no service

with subtest("lxc-container generator configures plain container"): # reuse the existing container to save some time machine.succeed("incus exec container test -- -e /run/systemd/system/service.d/zzz-lxc-service.conf") <ins> check_sysctl("container") </ins> with subtest("lxc-container generator configures nested container"): machine.execute("incus delete --force container")

target = machine.succeed("incus exec container readlink -- -f /run/systemd/system/systemd-binfmt.service").strip() assert target == "/dev/null", "lxc generator did not correctly mask /run/systemd/system/systemd-binfmt.service" <ins> check_sysctl("container") </ins> with subtest("lxc-container generator configures privileged container"): machine.execute("incus delete --force container") machine.succeed("incus launch nixos container --config security.privileged=true")

retry(instance_is_up) machine.succeed("incus exec container test -- -e /run/systemd/system/service.d/zzz-lxc-service.conf") <ins> check_sysctl("container") </ins> ''; })

diff --git a/distrobuilder/lxc.generator b/distrobuilder/lxc.generator <del> index 0ad81d1..69dbfe7 100644 </del> <ins> index 0ad81d1..21ddb39 100644 </ins> --- a/distrobuilder/lxc.generator +++ b/distrobuilder/lxc.generator @@ -25,16 +25,6 @@ is_incus_vm() {

mkdir -p /run/systemd/system/systemd-udev-trigger.service.d cat <<-EOF > /run/systemd/system/systemd-udev-trigger.service.d/zzz-lxc-override.conf <del> @@ -145,24 +97,12 @@ EOF </del> <ins> @@ -132,37 +84,13 @@ ExecStart=-${cmd} trigger --type=devices --action=add EOF </ins> } <ins> -# fix_systemd_sysctl overrides the systemd-sysctl.service to use "ExecStart=-" instead of "ExecStart=". -fix_systemd_sysctl() { -	cmd=/usr/lib/systemd/systemd-sysctl -	! [ -e "${cmd}" ] && cmd=/lib/systemd/systemd-sysctl -	mkdir -p /run/systemd/system/systemd-sysctl.service.d -	cat <<-EOF > /run/systemd/system/systemd-sysctl.service.d/zzz-lxc-override.conf -[Service] -ExecStart= -ExecStart=-${cmd} -EOF -} - </ins> ## Main logic -# Nothing to do in Incus VM but deployed in case it is later converted to a container -is_incus_vm || is_lxd_vm && exit 0

# Determine distro name and release ID="" <del> @@ -222,11 +162,6 @@ ACTION=="add|change|move", ENV{ID_NET_DRIVER}=="veth", ENV{INTERFACE}=="eth[0-9] </del> <ins> @@ -192,7 +120,6 @@ fi # Ignore failures on some units. fix_systemd_udev_trigger -fix_systemd_sysctl # Mask some units. fix_systemd_mask dev-hugepages.mount @@ -222,11 +149,6 @@ ACTION=="add|change|move", ENV{ID_NET_DRIVER}=="veth", ENV{INTERFACE}=="eth[0-9] </ins> EOF fi