Weekly status #186

tomp · February 22, 2021, 10:09am

Weekly status for the week of the 15th of February to the 21st of February.

Introduction

This past week LXD gained support for restricting particular client certificates to particular projects, OVN ACL support and initial work began on automatically generating our API docs.

LXD

LXD now supports assigning one or more projects to a trusted client certificate, with the effect of restricting that client certificate to the equivalent of the operator role on those projects, and denying access to any other projects.

Also related to projects, we now support dumping and recreating project configs when doing lxd init dump or pre-seed.

Following on from the initial Netwok ACL database schema and API endpoints added last week, this past week has seen OVN networks again ACL support. Once ACLs have been created using the lxc network acl create command, they can then be assigned to OVN networks or NIC devices by setting the security.acls config property. ACLs assigned to networks will be automatically assigned to all NICs connected to that network.

We have begun moving our REST API docs to a swagger based automatic generation from the actual code structures and comments. This way the API docs will be kept up to date with the actual API endpoints rather than requiring manual updates each time an API change is made. It is still a work in progress, but to get an idea of how it will function take a look at https://dl.stgraber.org/swag-lxd/

There have also been the usual set of fixes and improvements:

Storage volume DB records are now removed when a backup import fails.
The size property on a new BTRFS storage pool is now not automatically generated in scenarios where it is not used (namely when using an existing BTRFS filesystem as the source of the pool).
When using the shift=true option when attaching a directory disk device to a container, mount options are now passed through to the shiftfs mount, this fixes an issue where combining shift=true and readonly=true didn’t result in the mount in the container being fully readonly.
An issue with block size handling affecting s390x and other big endian systems was fixed.
When using bridged network in fan mode, firewall rules were not being added to allow access to the DHCP server due to a recent regression to allow static IP assignment when using fan mode.
Log removal for instances in non-default projects has now been fixed.
Moving instances between cluster members using the --target argument now works when the instances are in non-default projects.
The config drive ISO generation for VMs now uses the joilet filesystem to support filenames longer than 8 characters.

LXC

The work hardening the use of cgroups, fd-only codepaths and mount restrictions has continued apace.

Distrobuilder

Several improvements to better support Windows ISO rebuilds were added in the past week, including support for Windows Server 2016.

Also, the RunScript functionality has been updated to write the script to execute into a temporary memfd in order to support executing the script using a different interpreter than sh which was previously hard coded.

Dqlite

Several bugs have been fixed in relation to barriers which were causing crashes in certain scenarios.

Youtube channel

We’ve started a Youtube channel with live streams covering LXD releases and its use in the wider ecosystem.

You may want to give it a watch and/or subscribe for more content in the coming weeks.

Contribute to LXD

Ever wanted to contribute to LXD but not sure where to start?
We’ve recently gone through some effort to properly tag issues suitable for new contributors on Github: Easy issues for new contributors

Upcoming events

Nothing to report this week

Ongoing projects

The list below is feature or refactoring work which will span several weeks/months and can’t be tied directly to a single Github issue or pull request.

Distrobuilder Windows support
Virtual networks in LXD
Various kernel work
Stable release work for LXC, LXCFS and LXD

Upstream changes

The items listed below are highlights of the work which happened upstream over the past week and which will be included in the next release.

LXD

LXC

LXCFS

Nothing to report this week

Distrobuilder

Dqlite (RAFT library)

Dqlite (database)

Nothing to report this week

Dqlite (Go bindings)

Nothing to report this week

Distribution work

This section is used to track the work done in downstream Linux distributions to ship the latest LXC, LXD and LXCFS as well as work to get various software to work properly inside containers.

Ubuntu

Nothing to report this week

Snap

Nothing to report this week