Cannot start Incus container after add security.syscalls.intercept.mount: "true"

Incus
1

I am trying to install Waydroid headlessly into my Incus container on a Debian bookworm VM hosted on my Raspberry PI 5. I want the container itself be as secure as possible.

First thing I encountered is that Waydroid needs binder devices. I finally handled this with:

linux.kernel_modules: binder_linux
devices:
  binder:
    source: /dev/binder
    type: unix-char
  hwbinder:
    source: /dev/hwbinder
    type: unix-char
  vndbinder:
    source: /dev/vndbinder
    type: unix-char

I’m not sure if this is a secure solution by exposing these devices from my host. But Debian 12 Linux kernel seems to support only binder_linux but not binderfs.

Second thing I encountered is that after I tried to start, Waydroid tried mount:

$ waydroid session start
RuntimeError: Command failed: % mount -o ro /var/lib/waydroid/images/system.img /var/lib/waydroid/rootfs

I found the file is in ext2 format:

$ file /var/lib/waydroid/images/system.img
/var/lib/waydroid/images/system.img: Linux rev 1.0 ext2 filesystem data, UUID=xxx (extents) (large files) (huge files)

So after stopping the container, I added:

security.syscalls.intercept.mount: "true"
security.syscalls.intercept.mount.fuse: "ext2=fuse2fs"
security.syscalls.intercept.mount.shift: "true"

Then I cannot start my container again by issuing “incus start …”. Every time after I use the command, “incus list” reports it’s not starting. Also “incus info … --show-log” and /var/log/incus/ has nothing related in log.

I narrow this down and find even if I only enable the mount option itself, I still cannot start the container:

security.syscalls.intercept.mount: "true"

I use bookworm-backports with Incus version 6.0.1.
Is this config option not supported by this version of Incus or some other reason?

2

I am also interested in this (running Waydroid in Incus instead of the default with LXC).

3

Yeah, that’s interesting. But the problem I encountered now is that I can not even start the container after adding security.syscalls.intercept.mount: "true". I just tried other container without Waydroid and same thing happened. :frowning:
I also upgraded to use the version 6.4 from Zabbly. Nothing changed.

4

If you have some reproducible example, it would help to get more people to try things out.

For the case of mounting an image, does this help? incus storage volume import - Incus documentation

5

The setup is:
Host: Raspberry PI 5 Model B 8GB with Raspberry Pi OS Lite 64bit (without desktop).
Then create VM with libvirt from Debian bookworm net-inst iso without desktop.
And just install the official incus, create a container (I use images:ubuntu/noble) and then add the option under config: section:

security.syscalls.intercept.mount: "true"

I don’t think I added something special into them. I may try this setup on brand new VM later to see if same thing happens.

I just want to let the container mount the images itself. Because the images are inside the container’s control, if I mount them from outside, I need to make sure it cannot modify them directly to prevent security concern. Also, it will be convenient if it can mount them by itself.

6

I tested on brand new VM on my another machine Raspberry Pi 400, and I can reproduce it on that. Actually I also installed another Ubuntu VM and this is also presented on that too. (Just FYI, I tried LXD also and that has same problem on that VM, but we cannot do anything about LXD.) Maybe this is presented on all arm64 machines? :thinking:
I have created an issue on github.

7

So I’m also trying to run Waydroid in an incus container… Re-reading the above, am I right to assume that loading the ashmem_linux and binder_linux kernel modules are done on the host and then exposed to the container above as per the first post?

sudo modprobe ashmem_linux
sudo modprobe binder_linux

It also seems that the github issue linked in this thread implies a solution has been found if you are running the latest version of incus 6.0?

I’m also running on x86_64

So I guess my question is, is it now possible to run Waydroid in an incus container (Debian 12) on x86_64?