Ubuntu session restarts on lxd start

LXD
1

Following the instructions here: MicroK8s - MicroK8s in LXD . My Ubuntu desktop sessions logs off and when I log back in session has restarted. The profile from that page is reproduced below check to see if some configuration is problematic there.

### This is a YAML representation of the profile.
### Any line starting with a '# will be ignored.
###
### A profile consists of a set of configuration items followed by a set of
### devices.
###
### An example would look like:
### name: onenic
### config:
###   raw.lxc: lxc.aa_profile=unconfined
### devices:
###   eth0:
###     nictype: bridged
###     parent: lxdbr0
###     type: nic
###
### Note that the name is shown but cannot be changed

config:
  boot.autostart: "true"
  linux.kernel_modules: ip_vs,ip_vs_rr,ip_vs_wrr,ip_vs_sh,ip_tables,ip6_tables,netlink_diag,nf_nat,overlay,br_netfilter
  raw.lxc: |
    lxc.apparmor.profile=unconfined
    lxc.mount.auto=proc:rw sys:rw cgroup:rw
    lxc.cgroup.devices.allow=a
    lxc.cap.drop=
  security.nesting: "true"
  security.privileged: "true"
description: ""
devices:
  aadisable:
    path: /sys/module/nf_conntrack/parameters/hashsize
    source: /sys/module/nf_conntrack/parameters/hashsize
    type: disk
  aadisable1:
    path: /sys/module/apparmor/parameters/enabled
    source: /dev/null
    type: disk
  aadisable2:
    path: /dev/kmsg
    source: /dev/kmsg
    type: unix-char
  aadisable3:
    path: /sys/fs/bpf
    source: /sys/fs/bpf
    type: disk
  aadisable4:
    path: /proc/sys/net/netfilter/nf_conntrack_max
    source: /proc/sys/net/netfilter/nf_conntrack_max
    type: disk
name: microk8s
used_by:
- /1.0/instances/microk8s-worker0
- /1.0/instances/microk8s-worker1

I have an other instance that doesn’t use this profile and it doesn’t suffer this issue when stopping and starting it.

2

It’s not really surprising. The combination of security.privileged=true and your raw.lxc allows for very terrible things to be possible by the container.

That container can change apparmor profiles, load kernel modules and perform a lot of other actions which could seriously upset your host and cause your desktop session to restart.

3

Please what is the safest LXD profile to get a fully functional Kubernetes up and running?

I see here you have good experience with Kubernetes on LXD:

Even the Charmed Kubernetes bundle suffers the same fate on my machine due to using a similar LXD profile to that of MicroK8s

4

Have you tried a VM? It might be more resource intensive but would give you clean separation (I think).

1 Like