I can't update packages inside the LXC Ubuntu container

I am using android device with kernel 4.19.87 and I enabled the configurations to have LXC container support, but when I start in the container, when updating the packages I get this:
lxc-start: chapi: /home/builder/.termux-build/lxc/src/src/lxc/cgroups/cgfsng.c: cg_hybrid_init: 2577 Failed parsing mountpoint from "15565 15563 0:26 / /sys/fs/cgroup rw,nosuid,nodev,noexec,relatime master:20 - cgroup2 none rw
"
systemd 249.11-0ubuntu3.12 running in system mode (+PAM +AUDIT +SELINUX +APPARMOR +IMA +SMACK +SECCOMP +GCRYPT +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 -PWQUALITY -P11KIT -QRENCODE +BZIP2 +LZ4 +XZ +ZLIB +ZSTD -XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified)
Detected virtualization lxc.
Detected architecture arm64.

Welcome to Ubuntu 22.04.4 LTS!

Initializing machine ID from random generator.
Failed to attach 1 to compat systemd cgroup /init.scope: No such file or directory
Couldnā€™t move remaining userspace processes, ignoring: Input/output error
Configuration file /run/systemd/system/netplan-ovs-cleanup.service is marked world-inaccessible. This has no effect as configuration data is accessible via APIs without restrictions. Proceeding anyway.
Queued start job for default target Graphical Interface.
-.slice: Failed to migrate controller cgroups from /, ignoring: Input/output error
[ OK ] Created slice Slice /system/container-getty.
[ OK ] Created slice Slice /system/modprobe.
[ OK ] Created slice User and Session Slice.
[ OK ] Started Dispatch Password ā€¦sts to Console Directory Watch.
[ OK ] Started Forward Password Requests to Wall Directory Watch.
[ OK ] Reached target Local Encrypted Volumes.
[ OK ] Reached target Path Units.
[ OK ] Reached target Remote File Systems.
[ OK ] Reached target Slice Units.
[ OK ] Reached target Swaps.
[ OK ] Reached target Local Verity Protected Volumes.
[ OK ] Listening on Syslog Socket.
[ OK ] Listening on initctl Compatibility Named Pipe.
[ OK ] Listening on Journal Socket (/dev/log).
[ OK ] Listening on Journal Socket.
[ OK ] Listening on Network Service Netlink Socket.
[ OK ] Reached target Socket Units.
Mounting POSIX Message Queue File Systemā€¦
systemd-journald.service: Attaching egress BPF program to cgroup /sys/fs/cgroup/unified/system.slice/systemd-journald.service failed: Operation not permitted
Starting Journal Serviceā€¦
Starting Set the console keyboard layoutā€¦
Starting Generate network ā€¦its from Kernel command lineā€¦
Starting Remount Root and Kernel File Systemsā€¦
Starting Apply Kernel Variablesā€¦
[ OK ] Mounted POSIX Message Queue File System.
[ OK ] Finished Remount Root and Kernel File Systems.
[ OK ] Finished Apply Kernel Variables.
Starting Create System Usersā€¦
[ OK ] Finished Generate network units from Kernel command line.
[ OK ] Reached target Preparation for Network.
[ OK ] Finished Create System Users.
[ OK ] Reached target System Time Set.
Starting Create Static Device Nodes in /devā€¦
[ OK ] Started Journal Service.
Starting Flush Journal to Persistent Storageā€¦
[ OK ] Finished Set the console keyboard layout.
[ OK ] Finished Flush Journal to Persistent Storage.
[ OK ] Finished Create Static Device Nodes in /dev.
[ OK ] Reached target Preparation for Local File Systems.
[ OK ] Reached target Local File Systems.
Starting Set console font and keymapā€¦
Starting Create Volatile Files and Directoriesā€¦
Starting Network Configurationā€¦
[ OK ] Finished Set console font and keymap.
[ OK ] Finished Create Volatile Files and Directories.
Starting Record System Boot/Shutdown in UTMPā€¦
[ OK ] Finished Record System Boot/Shutdown in UTMP.
[ OK ] Reached target System Initialization.
[ OK ] Started Daily apt download activities.
[ OK ] Started Daily apt upgrade and clean activities.
[ OK ] Started Daily dpkg database backup timer.
[ OK ] Started Periodic ext4 Onliā€¦data Check for All Filesystems.
[ OK ] Started Daily rotation of log files.
[ OK ] Started Message of the Day.
[ OK ] Started Daily Cleanup of Temporary Directories.
[ OK ] Reached target Basic System.
[ OK ] Reached target Timer Units.
[ OK ] Listening on D-Bus System Message Bus Socket.
[ OK ] Started Regular background program processing daemon.
[ OK ] Started D-Bus System Message Bus.
[ OK ] Started Save initial kernel messages after boot.
Starting Dispatcher daemon for systemd-networkdā€¦
[ OK ] Started Mount BinderFS.
[ OK ] Started LXC Container Configuration.
Starting System Logging Serviceā€¦
Starting User Login Managementā€¦
[ OK ] Started Network Configuration.
Starting Network Name Resolutionā€¦
[ OK ] Started System Logging Service.
[ OK ] Started User Login Management.
[ OK ] Started Network Name Resolution.
[ OK ] Reached target Network.
[ OK ] Reached target Host and Network Name Lookups.
Starting Permit User Sessionsā€¦
[ OK ] Finished Permit User Sessions.
[ OK ] Started Console Getty.
[ OK ] Started Container Getty on /dev/pts/0.
[ OK ] Started Container Getty on /dev/pts/1.
[ OK ] Started Container Getty on /dev/pts/2.
[ OK ] Started Container Getty on /dev/pts/3.
[ OK ] Started Container Getty on /dev/pts/4.
[ OK ] Started Container Getty on /dev/pts/5.
[ OK ] Started Container Getty on /dev/pts/6.
[ OK ] Started Container Getty on /dev/pts/7.
[ OK ] Started Container Getty on /dev/pts/8.
[ OK ] Started Container Getty on /dev/pts/9.
[ OK ] Created slice Slice /system/getty.
[ OK ] Reached target Login Prompts.
[ OK ] Started Dispatcher daemon for systemd-networkd.
[ OK ] Reached target Multi-User System.
[ OK ] Reached target Graphical Interface.
Starting Record Runlevel Change in UTMPā€¦
[ OK ] Finished Record Runlevel Change in UTMP.

Ubuntu 22.04.4 LTS chapi console

chapi login: ubuntu
Password:
Welcome to Ubuntu 22.04.4 LTS (GNU/Linux 4.19.87-g516e8fca6-dirty aarch64)

The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.

The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.

To run a command as administrator (user ā€œrootā€), use ā€œsudo ā€.
See ā€œman sudo_rootā€ for details.

ubuntu@chapi:~$ sudo apt update
Hit:1 Index of /ubuntu-ports jammy InRelease
Err:1 Index of /ubuntu-ports jammy InRelease
Couldnā€™t create temporary file /tmp/apt.conf.etdz0O for passing config to apt-key
Ign:2 Index of /ubuntu-ports jammy-updates InRelease
Ign:3 Index of /ubuntu-ports jammy-security InRelease
Err:4 Index of /ubuntu-ports jammy-updates Release
Could not open file /var/lib/apt/lists/partial/ports.ubuntu.com_ubuntu-ports_dists_jammy-updates_Release - open (126: Required key not available) [IP: 185.125.190.39 80]
Err:5 Index of /ubuntu-ports jammy-security Release
Could not open file /var/lib/apt/lists/partial/ports.ubuntu.com_ubuntu-ports_dists_jammy-security_Release - open (126: Required key not available) [IP: 185.125.190.36 80]
Reading package listsā€¦ Error!
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: Index of /ubuntu-ports jammy InRelease: Couldnā€™t create temporary file /tmp/apt.conf.etdz0O for passing config to apt-key
E: The repository ā€˜Index of /ubuntu-ports jammy-updates Releaseā€™ no longer has a Release file.
N: Updating from such a repository canā€™t be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
E: The repository ā€˜Index of /ubuntu-ports jammy-security Releaseā€™ no longer has a Release file.
N: Updating from such a repository canā€™t be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
E: Unable to mkstemp /tmp/clearsigned.message.Sv9FWA - GetTempFile (126: Required key not available)

E: The package lists or status file could not be parsed or opened.

Can you help me please? I donā€™t know if it is the kernel or the container problem.

The error sounds related to ext4 encryption (fscrypt). So most likely your rootfs is on an encrypted partition. Your kernel obviously has the key loaded but itā€™s likely restricted to the user youā€™re running with.

So once you switch user in the container, there is no more associated key available to handle the data encryption and you get that error.

Iā€™m not very familiar with fscrypt, but hopefully thatā€™s enough pointers for you to do some googling and try to figure out how that works.

1 Like

Thanks for that, and in my kernel I see related to fscrypt in fs/crypto but I donā€™t know what Iā€™m going to manipulate to make it work within the LXC container