lxd fails to start with error: failed group lookup: numerical result out of range

[Lepe]

Using Ubuntu Server 14.04 with repository:
http://ppa.launchpad.net/ubuntu-lxc/lxd-stable/ubuntu trusty main

lxd version: 2.2-0ubuntu1~ubuntu14.04.1~ppa1 (also tried: 2.0.3-0ubuntu2~ubuntu14.04.1)

During installation it gets stuck at:

Processing triggers for ureadahead (0.100.0-16) ...
Setting up liblxc1 (2.0.4-0ubuntu3~ubuntu14.04.1~ppa1) ...
Setting up lxd (2.2-0ubuntu1~ubuntu14.04.1~ppa1) ...

If I stop the service, the installation finishes.

However, starting with: `service lxd start` fails (gets stuck).

Trying to start lxd with:

lxd --group lxd --verbose --debug

Returns:

INFO[09-23|13:45:51] LXD is starting in setup mode path=/var/lib/lxd
WARN[09-23|13:45:51] Couldn't find the CGroup network class controller, network limits will be ignored.
WARN[09-23|13:45:51] Couldn't find the CGroup pids controller, process limits will be ignored.
WARN[09-23|13:45:51] CGroup memory swap accounting is disabled, swap limits will be ignored.
INFO[09-23|13:45:51] Default uid/gid map:
INFO[09-23|13:45:51] - u 0 19695264 65536
INFO[09-23|13:45:51] - g 0 19695264 65536
INFO[09-23|13:45:51] Init driver=storage/dir
INFO[09-23|13:45:51] Looking for existing certificates cert=/var/lib/lxd/server.crt key=/var/lib/lxd/server.key
DBUG[09-23|13:45:51] Expiring log files
DBUG[09-23|13:45:51] Done expiring log files
INFO[09-23|13:45:51] LXD isn't socket activated
DBUG[09-23|13:45:51] Detected stale unix socket, deleting
error: failed group lookup: numerical result out of range

`grep "lx" /etc/group` returns:

lxc-dnsmasq:x:126:
lxd:x:127:sudo_user

If I start it this way: `lxd --auto` it works (except it doesn't bring up the network interface).

If I reconfigure the package (which will ask for several questions, as interface name, network, etc), lxdbr0 is up and running (but goes down with the previous command).

I tried to run `lxd`, and then `lxd init`. These is as far as I got:

Name of the storage backend to use (dir or zfs) [default=dir]:
Would you like LXD to be available over the network (yes/no) [default=no]?
Would you like stale cached images to be updated automatically? (yes/no) [default=yes]?
Do you want to configure the LXD bridge (yes/no) [default=yes]?
start: Job failed to start
invoke-rc.d: initscript lxd, action "start" failed.
error: Failed to configure the bridge

There must be some configuration (missing or mistaken) which may be causing this problem. More information could be added to diagnose this situation.

[Stéphane Graber (stgraber)]

root@trusty:~# apt-add-repository ppa:ubuntu-lxc/lxd-stable
 This PPA contains the latest stable release of LXD as well as the latest stable version of any of its dependencies.
 More info: https://launchpad.net/~ubuntu-lxc/+archive/ubuntu/lxd-stable
Press [ENTER] to continue or ctrl-c to cancel adding it

gpg: keyring `/tmp/tmpaz28wb17/secring.gpg' created
gpg: keyring `/tmp/tmpaz28wb17/pubring.gpg' created
gpg: requesting key 7635B973 from hkp server keyserver.ubuntu.com
gpg: /tmp/tmpaz28wb17/trustdb.gpg: trustdb created [132/258]
gpg: key 7635B973: public key "Launchpad PPA for Ubuntu LXC team" imported
gpg: Total number processed: 1
gpg: imported: 1 (RSA: 1)
OK
aroot@trusty:~# apt update
Hit http://security.ubuntu.com trusty-security InRelease
Hit http://security.ubuntu.com trusty-security/main Sources
Hit http://security.ubuntu.com trusty-security/universe Sources
Get:1 http://ppa.launchpad.net trusty InRelease [20.9 kB]
Ign http://archive.ubuntu.com trusty InRelease
Hit http://security.ubuntu.com trusty-security/main amd64 Packages
Hit http://security.ubuntu.com trusty-security/universe amd64 Packages
Hit http://security.ubuntu.com trusty-security/main Translation-en
Hit http://archive.ubuntu.com trusty-updates InRelease
Hit http://security.ubuntu.com trusty-security/universe Translation-en
Get:2 http://ppa.launchpad.net trusty/main amd64 Packages [5618 B]
Hit http://archive.ubuntu.com trusty-backports InRelease
Hit http://archive.ubuntu.com trusty Release.gpg
Get:3 http://ppa.launchpad.net trusty/main Translation-en [4266 B]
Hit http://archive.ubuntu.com trusty-updates/main Sources
Hit http://archive.ubuntu.com trusty-updates/restricted Sources
Hit http://archive.ubuntu.com trusty-updates/universe Sources
Hit http://archive.ubuntu.com trusty-updates/multiverse Sources
Hit http://archive.ubuntu.com trusty-updates/main amd64 Packages
Hit http://archive.ubuntu.com trusty-updates/restricted amd64 Packages
Hit http://archive.ubuntu.com trusty-updates/universe amd64 Packages
Hit http://archive.ubuntu.com trusty-updates/multiverse amd64 Packages
Hit http://archive.ubuntu.com trusty-updates/main Translation-en
Hit http://archive.ubuntu.com trusty-updates/multiverse Translation-en
Hit http://archive.ubuntu.com trusty-updates/restricted Translation-en
Hit http://archive.ubuntu.com trusty-updates/universe Translation-en
Hit http://archive.ubuntu.com trusty-backports/main Sources
Hit http://archive.ubuntu.com trusty-backports/restricted Sources
Hit http://archive.ubuntu.com trusty-backports/universe Sources
Hit http://archive.ubuntu.com trusty-backports/multiverse Sources
Hit http://archive.ubuntu.com trusty-backports/main amd64 Packages
Hit http://archive.ubuntu.com trusty-backports/restricted amd64 Packages
Hit http://archive.ubuntu.com trusty-backports/universe amd64 Packages
Hit http://archive.ubuntu.com trusty-backports/multiverse amd64 Packages
Hit http://archive.ubuntu.com trusty-backports/main Translation-en
Hit http://archive.ubuntu.com trusty-backports/multiverse Translation-en
Hit http://archive.ubuntu.com trusty-backports/re...

[Stéphane Graber (stgraber)]

Any chance you can attach /etc/nsswitch.conf, /etc/passwd, /etc/group, /etc/subuid and /etc/subgid?

That may help figure out what's making the nss parser fail for you.

[Lepe (alepe-com)]

cat /etc/nsswitch.conf:

# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd: compat
group: compat
shadow: compat

hosts: files dns
networks: files

protocols: db files
services: db files
ethers: db files
rpc: db files

netgroup: nis

grep "lx" /etc/passwd

lxc-dnsmasq:x:118:126:LXC dnsmasq,,,:/var/lib/lxc:/bin/false
lxd:x:123:65534::/var/lib/lxd/:/bin/false

grep "lx" /etc/subuid

lxd:19695264:65536

grep "lx" /etc/subgid

lxd:19695264:65536

[Stéphane Graber (stgraber)]

Sorry but I asked for the full files for a reason, can you please attach those?

[Lepe (alepe-com)]

Stephane: for security reasons I will post only those users/groups that were created by the system (those files contains more than 1600 users and 300 groups):

/etc/passwd

root:x:0:
daemon:x:1:
bin:x:2:
sys:x:3:
adm:x:4:syslog
tty:x:5:
disk:x:6:
lp:x:7:
mail:x:8:
news:x:9:
uucp:x:10:
man:x:12:
proxy:x:13:
kmem:x:15:
dialout:x:20:
fax:x:21:
voice:x:22:
cdrom:x:24:
floppy:x:25:
tape:x:26:
sudo:x:27:sudo_user (not real username)
audio:x:29:
dip:x:30:
www-data:x:33:
backup:x:34:
operator:x:37:
list:x:38:
irc:x:39:
src:x:40:
gnats:x:41:
shadow:x:42:
utmp:x:43:
video:x:44:
sasl:x:45:
plugdev:x:46:
staff:x:50:
games:x:60:
users:x:100:
nogroup:x:65534:
libuuid:x:101:
crontab:x:102:
syslog:x:103:
fuse:x:104:
messagebus:x:105:
mlocate:x:106:
ssh:x:107:
lpadmin:x:108:
sambashare:x:109:
ntp:x:110:
snmp:x:111:
netdev:x:112:
mysql:x:113:
munin:x:114:
ssl-cert:x:115:
serveradmin:x:1001:
clamav:x:116:amavis
dovenull:x:118:
postfix:x:119:
postdrop:x:120:
amavis:x:121:clamav
debian-spamd:x:122:
netdev:x:124:
messagebus:x:125:
amavis:x:121:
dovecot:x:117:
dspam:x:123:
lxc-dnsmasq:x:126:
vmail:x:5000:
lxd:x:127:sudo_user

/etc/subuid:

sudo_user:100000:65536
vmail:165536:65536
root:19695264:65536
lxd:19760800:65536
root:19760800:65536

/etc/subgid:

sudo_user:100000:65536
vmail:165536:65536
root:19695264:65536
lxd:19760800:65536
root:19760800:65536

Is there anything special you want to see in those files?

[Lepe (alepe-com)]

You gave me a hint and now its working. What I did was to move lxd group to the top of the group file. It seems some groups in there caused some parse problem. Thanks!