Security.privileged true needed with shift=true on some systems/containers

[tomp (Thomas Parrott)]

Yes I’ve been experiencing the same thing as you and came to the same conclusions, see:

Containers won't start after host reboot, unwritable filesystems (shiftfs)

Today I rebooted a LXD host, after which some containers fail to start/launch at all, some start but have an effectively unwritable filesystem and others work just fine. The non starting/launching error: root@myhost:~# lxc launch ubuntu:22.04 mytest Creating mytest Starting mytest Error: Failed to run: /snap/lxd/current/bin/lxd forkstart mytest /var/snap/lxd/common/lxd/containers /var/snap/lxd/common/lxd/logs/mytest/lxc.conf: exit status 1 Try `lxc info --show-log local:mytest` for more info r…

It seems like a recent kernel regression.

You are correct that idmapped mounts replaces shiftfs functionality, but currently doesn’t work on ZFS or TMPFS filesystems.