Live Migration and Proxy

1

I’m testing live migration of containers between 2 LXD hosts (LXD 3.7).
Both the LXD hosts are configured to use the same internal network for the containers:

config:
  ipv4.address: 10.10.0.1/24
  ipv4.nat: "true"
  ipv6.address: none

so that each container, after a live migration, maintains the previous IP address, and everything works as expected.

Now I’m trying to expose the port 80 inside the container to the internet, using the LXD proxy feature:

lxc config device add <container> proxy8081 proxy listen=tcp:0.0.0.0:8081 connect=tcp:<container_ip>:80

This actually works.
From a remote client I can see the website in the container at the address: http://<lxd_node>:8081

Unfortunately, it seems that the live migration of the container doesn’t maintain the proxy configuration.
Or, more precisely, I can see that the proxy configuration is correctly copied:

lxc config device get <container> proxy8081 connect
tcp:<container_ip>:80

but it doesn’t work, until I restart the container.

Am I missing something, or this isn’t yet supported?

Thanks.
Alessandro

2

I think that should be a bug report at Issues · lxc/incus · GitHub
The live migration should trigger the activation of the proxy device.

If you can peek into the source, you can check whether other devices are activated as well or not.
If other devices are activated, then it’s definitely a bug report.

3

Oh yeah, this is going to be a fun one as the proxy is half inside and half outside the container.

We can certainly restart it when that happens though that means any established connection will be dropped.

I’m frankly surprised that CRIU even allowed you to checkpoint/restore such a container, it’s usually very picky about cases where a process is only partly in the container, as is the case here.

Anyway, yes, please file a bug against LXD with a reproducer, it shouldn’t be too hard for us to sort out.

4

Ok, I reported the bug here: https://github.com/lxc/lxd/issues/5333

Just to talk: do you think there is a better way to achieve the same result?