Lxd init & lxc network create fail `Error: Failed to list ipv6 rules for test (table filter)`

LXD
1

I’m attempting to run a few tests in a nested lxd configuration. In this scenario master is the bare metal host, and cloudctl is the first layer lxd container.

I’ve come to experience lxd network create & lxd init failure due to an ipv6 error I dont understand well enough to troubleshoot.

For the time being I have a workaround using OVS to carry the physical network into the nested containers.

Example:

root@cloudctl:~# lxd --version
3.13
root@cloudctl:~# lxc network create test ipv6.address=auto                                                                             
Error: Failed to list ipv6 rules for test (table filter)

First Layer cloudctl container config:

root@master:~# lxc config show cloudctl
architecture: x86_64
config:
  image.architecture: amd64
  image.description: ubuntu 18.04 LTS amd64 (release) (20190604)
  image.label: release
  image.os: ubuntu
  image.release: bionic
  image.serial: "20190604"
  image.version: "18.04"
  security.nesting: "true"
  security.privileged: "true"
  volatile.base_image: c234ecee3baaee25db84af8e3565347e948bfceb3bf7c820bb1ce95adcffeaa8                                                
  volatile.eth0.hwaddr: 00:16:3e:2d:f6:ad
  volatile.eth1.hwaddr: 00:16:3e:64:5f:63
  volatile.idmap.base: "0"
  volatile.idmap.next: '[]'
  volatile.last_state.idmap: '[]'
  volatile.last_state.power: RUNNING
devices:
  eth0:
    name: eth0
    nictype: bridged
    parent: external
    type: nic
  eth1:
    name: eth1
    nictype: bridged
    parent: internal
    type: nic
ephemeral: false
profiles:
- cloudctl
stateful: false
description: ""

Workaround:

root@cloudctl:~# cat <<EOF > /etc/systemd/network/eth0.network
[Match]
Name=eth0

[Network]
DHCP=no
IPv6AcceptRA=no
LinkLocalAddressing=no
EOF

sed -i 's/eth0/lxdbr0/g' /etc/netplan/*.yaml
ovs-vsctl add-br lxdbr0 -- add-port lxdbr0 eth0
systemctl restart systemd-networkd.service
netplan apply

root@cloudctl:~# lxc network show lxdbr0
config: {}
description: ""
name: lxdbr0
type: bridge
used_by:
- /1.0/containers/t01
managed: false
status: ""
locations: []
root@cloudctl:~# ovs-vsctl show
7ec003e6-4c92-45f6-b0d9-43a8e15174e0
    Bridge "lxdbr0"
        Port "eth0"
            Interface "eth0"
        Port "lxdbr0"
            Interface "lxdbr0"
                type: internal
    ovs_version: "2.9.2"
2

Sounds like some iptables kernel modules aren’t loaded on the host system prior to that nested container trying to make use of those features.

Tracking down what’s needed (in this case ip6table_filter and iptable_filter) and putting them into linux.kernel_modules in the container’s config should fix this.

3

You’re awesome. Actually that was just the ticket. I had to explicitly pass them to the first layer container.

To resolve:

lxc profile set cloudctl linux.kernel_modules iptable_filter,ip6table_filter
lxc restart cloudctl

Then I was able to lxd init and create a nested nat lxdbr0.

Thanks @stgraber !!!