[pve-devel] [PATCH v5 pve-container 3/5] fix #6897: warn that nesting may be required for systemd

[Robert Obkircher]

Recent versions of systemd require nesting to isolate services. If
nesting is disabled Debian 11 and 12 containers hang for 25 seconds
after login and Debian 13 just shows an empty console. To make this
less confusing for users, add a task-log warning on CT start if a
systemd version >241 (used by Debian 10) is detected.

Signed-off-by: Robert Obkircher <r.obkircher at proxmox.com>
---
 src/PVE/LXC/Setup.pm      | 10 ++++++++++
 src/PVE/LXC/Setup/Base.pm | 19 +++++++++++++++++++
 2 files changed, 29 insertions(+)

diff --git a/src/PVE/LXC/Setup.pm b/src/PVE/LXC/Setup.pm
index 57b8df1..adb8d6c 100644
--- a/src/PVE/LXC/Setup.pm
+++ b/src/PVE/LXC/Setup.pm
@@ -296,10 +296,20 @@ sub rewrite_ssh_host_keys {
     });
 }
 
+sub check_systemd_nesting {
+    my ($self) = @_;
+
+    my $init = $self->get_ct_init_path();
+    # not a protected_call because it calls objdump
+    my $warning = $self->{plugin}->check_systemd_nesting($self->{conf}, $init);
+    $self->{log_warn}->($warning) if $warning;
+}
+
 sub pre_start_hook {
     my ($self) = @_;
 
     $self->protected_call(sub { $self->{plugin}->pre_start_hook($self->{conf}) });
+    $self->check_systemd_nesting();
 }
 
 sub post_clone_hook {
diff --git a/src/PVE/LXC/Setup/Base.pm b/src/PVE/LXC/Setup/Base.pm
index ffd4bac..370f3fa 100644
--- a/src/PVE/LXC/Setup/Base.pm
+++ b/src/PVE/LXC/Setup/Base.pm
@@ -649,6 +649,25 @@ sub get_ct_init_path {
     return $init_path;
 }
 
+sub check_systemd_nesting {
+    my ($self, $conf, $init) = @_;
+
+    my $features = PVE::LXC::Config->parse_features($conf->{features});
+    return if $features->{nesting};
+
+    return if (!defined($init) || $init !~ m@/systemd$@);
+
+    my $sdver = $self->get_systemd_version($init);
+
+    # 241 is the systemd version used by Debian 10. It was chosen based
+    # on a forum post that suggested enabling nesting for the upgrade
+    # from PMG 6.x to 7 and after a quick test where a Debian 11 container
+    # hung 25 seconds after login.
+    return if (!defined($sdver) || $sdver <= 241);
+
+    return "Systemd $sdver detected. You may need to enable nesting.";
+}
+
 sub ssh_host_key_types_to_generate {
     my ($self) = @_;
 
-- 
2.47.3