Ubuntu MAAS on LXC

LXC
1

Has anyone got this working on LXC? I am facing issues with snap even after running it with an unconfined profile;

root@maas:~# sudo snap install --channel=2.9/stable maas
error: cannot perform the following tasks:

  • Setup snap “snapd” (11588) security profiles (cannot setup profiles for snap “snapd”: cannot create host snap-confine apparmor configuration: cannot reload snap-confine apparmor profile: cannot load apparmor profiles: exit status 243
    apparmor_parser output:
    apparmor_parser: Unable to replace “mount-namespace-capture-helper”. Permission denied; attempted to load a profile while confined?
    apparmor_parser: Unable to replace “/snap/snapd/11588/usr/lib/snapd/snap-confine”. Permission denied; attempted to load a profile while confined?

lxc container is the 20.04 base and the host is 16.04

container config is

Container specific configuration

lxc.start.auto = 1
lxc.start.delay = 5
lxc.cgroup.devices.allow = b 7:* rwm # allow loop devices
lxc.cgroup.devices.allow = c 10:237 rwm # allow loop-control device
lxc.autodev = 1
security.privileged = true
lxc.aa_profile = unconfined
lxc.rootfs = /var/lib/lxc/maas/rootfs
lxc.rootfs.backend = dir
lxc.utsname = maas

2

With LXD it’s trivial as LXD sets up apparmor namespaces for you to allow this to work.
With pure LXC it’s quite a bit harder though I believe recent versions (4.0 and higher) have alternative values for lxc.apparmor.profile to setup at least a minimal namespace.

3

I’m running 2.0.x is this not possible in that version?

4

No, it’s not.