Systemd-networkd: not working in Debian Sid or Bullseye images

Hello,

I’m preparing the switch to Bullseye for my containers and I’m running into a network problem. I am not using the network management packages provided by Debian. Indeed, I think it is better to use systemd-networkd which is installed anyway.

Here is a part of the network configuration tasks via ansible:

---
# tasks file for common
- name: "systemd-networkd : déployer l'interface de loopback"
  become: yes
  notify:
    - "systemd-networkd : redémarrer le service"
  ansible.builtin.copy:
    owner: "root"
    group: "root"
    mode: u=rw,g=r,o=r
    dest: /etc/systemd/network/1-lo.network
    content: |
      [Match]
      Name=lo

      [Network]
      Address=127.0.0.1/8
      Address=::1/128

- name: "systemd-networkd : déployer la configuration des interfaces"
  become: yes
  notify:
    - "systemd-networkd : redémarrer le service"
  loop: "{{ instance.network.interfaces | dict2items }}"
  ansible.builtin.template:
    owner: "root"
    group: "root"
    mode: u=rw,g=r,o=r
    src: systemd-networkd.j2
    dest: /etc/systemd/network/{{ item.value.filename }}

- name: "systemd-networkd : désactiver le serveur DNS"
  become: yes
  notify:
    - "systemd-networkd : redémarrer le service"
  replace:
    path: /etc/systemd/resolved.conf
    regexp: "#DNSStubListener=yes"
    replace: DNSStubListener=no
  register: dns

- name: "systemd-networkd : démasquer les services"
  become: yes
  register: unmask
  vars:
    items:
      - "systemd-networkd.service"
      - "systemd-networkd.socket"
      - "systemd-networkd-wait-online.service"
      - "systemd-resolved.service"
  loop: "{{ items | flatten(levels=1) }}"
  ansible.builtin.systemd:
    masked: no
    name: "{{ item }}"

- name: "systemd-networkd : activer les services"
  become: yes
  register: enable
  vars:
    items:
      - "systemd-networkd.service"
      - "systemd-resolved.service"
  loop: "{{ items | flatten(levels=1) }}"
  ansible.builtin.systemd:
    enabled: yes
    name: "{{ item }}"

- name: "systemd-networkd : basculer de fournisseur réseau"
  become: yes
  when: unmask.changed or enable.changed
  shell: "systemctl stop networking && systemctl start systemd-networkd.service systemd-resolved.service"

- name: "systemd-networkd : désinstaller les paquets netbase"
  become: yes
  notify:
    - "systemd-networkd : supprimer les résidus de netbase"
    - "systemd-networkd : activer la gestion DNS par systemd-resolved"
  apt:
    state: absent
    name:
      - ifupdown
      - netbase
      - resolvconf

This gives the following file:

root@infra-ansible-test:~# cat /etc/systemd/network/2-eth0.network 
# Ansible managed

[Match]
Name=eth0

[Network]
DHCP=no
IPv6AcceptRA=no
LinkLocalAddressing=no

Address=192.168.50.214/24
Gateway=192.168.50.254
DNS=192.168.50.254

Address=fd00:ff50::d214/64
Gateway=fd00:ff50::d254
DNS=fd00:ff50::d254

That seems to be the problem:

pulsar@erebe:~$ lxc exec infra-ansible-test -- /bin/bash
WARNING: cgroup v2 is not fully supported yet, proceeding with partial confinement
root@infra-ansible-test:~# sudo systemctl status systemd-networkd
● systemd-networkd.service - Network Service
     Loaded: loaded (/lib/systemd/system/systemd-networkd.service; enabled; vendor preset: enabled)
    Drop-In: /run/systemd/system/service.d
             └─zzz-lxc-service.conf
     Active: active (running) since Thu 2021-07-01 11:34:53 UTC; 2h 49min ago
TriggeredBy: ● systemd-networkd.socket
       Docs: man:systemd-networkd.service(8)
   Main PID: 1256 (systemd-network)
     Status: "Processing requests..."
      Tasks: 1 (limit: 4596)
     Memory: 3.8M
        CPU: 229ms
     CGroup: /system.slice/systemd-networkd.service
             └─1256 /lib/systemd/systemd-networkd

Jul 01 11:34:53 infra-ansible-test systemd[1]: Starting Network Service...
Jul 01 11:34:53 infra-ansible-test systemd-networkd[1256]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
Jul 01 11:34:53 infra-ansible-test systemd-networkd[1256]: Failed to increase buffer size for device monitor, ignoring: Operation not permitted
Jul 01 11:34:53 infra-ansible-test systemd-networkd[1256]: Enumeration completed
Jul 01 11:34:53 infra-ansible-test systemd[1]: Started Network Service.
root@infra-ansible-test:~# sudo networkctl status
● State: off

Jul 01 11:34:53 infra-ansible-test systemd[1]: Starting Network Service...
Jul 01 11:34:53 infra-ansible-test systemd-networkd[1256]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
Jul 01 11:34:53 infra-ansible-test systemd-networkd[1256]: Failed to increase buffer size for device monitor, ignoring: Operation not permitted
Jul 01 11:34:53 infra-ansible-test systemd-networkd[1256]: Enumeration completed
Jul 01 11:34:53 infra-ansible-test systemd[1]: Started Network Service.
root@infra-ansible-test:~# sudo networkctl list
IDX LINK TYPE     OPERATIONAL SETUP
  1 lo   loopback carrier     pending
 44 eth0 ether    off         pending

2 links listed.
root@infra-ansible-test:~# sudo networkctl up eth0
root@infra-ansible-test:~# sudo networkctl list
IDX LINK TYPE     OPERATIONAL SETUP
  1 lo   loopback carrier     pending
 44 eth0 ether    degraded    pending

2 links listed.
root@infra-ansible-test:~# sudo networkctl status eth0
● 44: eth0                                                           
                     Link File: n/a
                  Network File: n/a
                          Type: ether
                         State: degraded (pending)
                    HW Address: 00:16:3e:41:43:f0
                           MTU: 1500 (min: 68, max: 65535)
                         QDisc: noqueue
  IPv6 Address Generation Mode: eui64
          Queue Length (Tx/Rx): 1/1
              Auto negotiation: no
                         Speed: 10Gbps
                        Duplex: full
                          Port: tp
                       Address: fe80::216:3eff:fe41:43f0
                       Gateway: fe80::216:3eff:fe29:fea7

Jul 01 14:28:19 infra-ansible-test systemd-networkd[1256]: eth0: Link UP
Jul 01 14:28:19 infra-ansible-test systemd-networkd[1256]: eth0: Gained carrier
Jul 01 14:28:21 infra-ansible-test systemd-networkd[1256]: eth0: Gained IPv6LL
root@infra-ansible-test:~# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
44: eth0@if45: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 00:16:3e:41:43:f0 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet6 fe80::216:3eff:fe41:43f0/64 scope link 
       valid_lft forever preferred_lft forever

It works in privileged mode, but for security reasons you will understand that this is not acceptable. It doesn’t work in nesting mode and in normal mode (neither nesting nor privileged).
Is this a known problem? Is there a solution or a workaround?

Thanks for reading and in advance for your help.

Which image are you using?

Hello,

The problem is the same with these images:

  • debian/bullseye
  • debian/sid

Does this work (just using a plain simple launch to check basic operation)?

lxc launch images:debian/bullseye c1

The image works after it is launched but because Debian does not use systemd-networkd by default. As soon as I switch the network to systemd-networkd, instead of netbase, I have no network. I would like to know if there is a solution to make systemd-networkd work under Bullseye and Sid since it works fine on Buster.

@monstermunchkin do you have any ideas here?

We use systemd-networkd in the Ubuntu images, so should work ok.