Arch Linux

HappyAndBreathe

Member

Registered: 2021-05-17

Posts: 6

App inside LXC instance fails on "Unable to initialize net_cls cgroup"

On a fully up-to-date Arch system I'm running an LXC container with Ubuntu 20.04.

Inside this container, I've tried running Wireguard and can successfully connect to Mullvad VPN servers.

However when trying the official app, I get this error when the mullvad-daemon service tries to start (or when I run the service exec line directly with sudo, as well).

[2021-09-29 14:08:09.802][mullvad_daemon][ERROR] Error: Unable to initialize daemon
Caused by: Unable to initialize split tunneling
Caused by: Unable to initialize net_cls cgroup instance
Caused by: EPERM: Operation not permitted

The reason I'm posting here is that rather than being a bug in LXC/LXD or the Mullvad app, I suspect it might be an issue of LXC configuration disallowing the spawning of cgroup instances inside the containers (which admittedly I know little about, and initial reading online has slightly confused me).

Below is the config for the container, which I believe is currently unprivileged.

architecture: x86_64
config:
  image.architecture: amd64
  image.description: ubuntu 20.04 LTS amd64 (release) (20210927)
  image.label: release
  image.os: ubuntu
  image.release: focal
  image.serial: "20210927"
  image.type: squashfs
  image.version: "20.04"
  volatile.base_image: 56296ba81a6fb502c634697a840d7957c3d2aa1a1805820e605ed21475058851
  volatile.eth0.host_name: veth673b88f0
  volatile.eth0.hwaddr: 00:16:3e:f5:23:7a
  volatile.idmap.base: "0"
  volatile.idmap.current: '[{"Isuid":true,"Isgid":false,"Hostid":100000,"Nsid":0,"Maprange":65536},{"Isuid":false,"Isgid":true,"Hostid":100000,"Nsid":0,"Maprange":65536}]'
  volatile.idmap.next: '[{"Isuid":true,"Isgid":false,"Hostid":100000,"Nsid":0,"Maprange":65536},{"Isuid":false,"Isgid":true,"Hostid":100000,"Nsid":0,"Maprange":65536}]'
  volatile.last_state.idmap: '[{"Isuid":true,"Isgid":false,"Hostid":100000,"Nsid":0,"Maprange":65536},{"Isuid":false,"Isgid":true,"Hostid":100000,"Nsid":0,"Maprange":65536}]'
  volatile.last_state.power: RUNNING
  volatile.uuid: d7bc7358-b05f-46dc-95a1-51a28c30f553
devices: {}
ephemeral: false
profiles:
- default
stateful: false
description: ""

Any ideas on what I might try to resolve this issue?

I'd be more than happy to post further config/command outputs, any advice would be massively appreciated.