transient scope could not be started error in bionic lxd container
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
snapd |
New
|
Undecided
|
Unassigned | ||
systemd (Ubuntu) |
Invalid
|
Undecided
|
Unassigned | ||
Bionic |
New
|
Low
|
Unassigned |
Bug Description
On my impish development host machine I tend to use lxd containers to support snap building and other tasks targeting different releases. Today I came to use a bionic container as per usual and found that I could not invoke any snap applications. I installed hello-world as the most simple test of running a snap app:
```
ubuntu@b:~$ hello-world
internal error, please report: running "hello-world" failed: transient scope could not be started, job /org/freedeskto
```
I made sure the container had up to date packages in it (apt & snaps) and rebooted it. But the problem persisted. I then created a second container and installed hello-world in it and again the problem was reproducible. At the time of producing the following attachments I had not attempted to reboot the host.
affects: | snappy → snapd |
Changed in systemd (Ubuntu): | |
status: | Incomplete → Invalid |
Changed in systemd (Ubuntu Bionic): | |
importance: | Undecided → Low |
Let me reiterate what I mentioned in the MM channel. The snap in question apparently uses device access in which case we'll set up device filtering. The host being impish, uses cgroup v2, which percolates to the container. Since it's v2, device filtering is implemented by attaching a BPF program on the cgorup, hence we need to have a separate group otherwise we'd break your session. Snap will ask your systemd --user to create a transient scope for the app, but looking at the logs this fails with:
Mar 17 16:13:22 b2 systemd[2487]: snap.snapcraft. snapcraft. 237e42c2- 4906-439b- a992-743647600b c6.scope: Failed to add PIDs to scope's control snapcraft. 237e42c2- 4906-439b- a992-743647600b c6.scope: Failed with result 'resources'. snapcraft. 237e42c2- 4906-439b- a992-743647600b c6.scope.
Mar 17 16:13:22 b2 systemd[2487]: snap.snapcraft.
Mar 17 16:13:22 b2 systemd[2487]: Failed to start snap.snapcraft.
At this point running snap will fail and the sandbox cannot be completed.
I think the main problem is why create transient scope fails the way it did, and whether systemd from bionic even works properly on a host with unified hierarchy.