diff options
Diffstat (limited to 'docs/lxd.md')
| -rw-r--r-- | docs/lxd.md | 106 |
1 files changed, 106 insertions, 0 deletions
diff --git a/docs/lxd.md b/docs/lxd.md new file mode 100644 index 0000000..4c0a676 --- /dev/null +++ b/docs/lxd.md @@ -0,0 +1,106 @@ +# LXD on Arch + +The host package list includes LXD. The system unit list enables `lxd.socket`. +Use `sudo lxc` to manage instances. Do not expose the LXD socket to aibox or +grant agents permanent membership in the `lxd` group. The +[Canonical VM test](canonical-vm.md) permits a separately authorized host +session with temporary LXD access. This access is root-equivalent. + +## First Setup + +Before starting LXD, complete the AppArmor setup below. Check `/etc/subuid` and +`/etc/subgid` for existing allocations. Native LXD needs subordinate IDs for +root; retain all Podman allocations. On this host, root uses +`1000000-1000999999`, and sommerfeld uses `100000-165535`. + +On a new host, only if the root range is free and not yet allocated, run: + +```sh +sudo usermod --add-subuids 1000000-1000999999 --add-subgids 1000000-1000999999 root +``` + +Restart `lxd.service` if it was already running when the allocations changed. + +On a new Arch host with Btrfs storage, run: + +```sh +just pkg-apply base +just unit-apply +sudo lxd init --preseed < docs/lxd-init.yaml +``` + +Do not apply the preseed to an existing installation. It selects IPv4 and IPv6 +subnets automatically. Check them against LAN and VPN routes before use: + +```sh +sudo lxc network show lxdbr0 +ip -4 route +ip -6 route +``` + +## Firewall + +Run these commands on the host, outside aibox: + +```sh +sudo nft --check --file etc/nftables.conf +just apply +sudo nft --file /etc/nftables.conf +``` + +The rules permit DNS and DHCP from `lxdbr0`, connections from instances, and +return traffic to instances. Existing ICMP rules permit IPv6 neighbour discovery. +Instances can initiate connections to the LAN and VPN networks as well as the +internet. Unsolicited forwarded connections into the bridge remain blocked. + +LXD owns the bridge, address allocation, NAT, and its own firewall table. The repo +replaces only `inet filter`. Do not flush the complete ruleset or restart nftables +with a stop action that flushes LXD's rules. + +An IPv6 bridge address does not provide IPv6 internet access without a suitable +host route. + +## AppArmor + +The package and unit lists include AppArmor. Both kernel command-line templates +enable it alongside the existing security modules. On the host, run: + +```sh +just pkg-apply base +just apply +sudo systemctl enable apparmor.service +sudo mkinitcpio -P +``` + +Do not reboot if image generation fails. If Secure Boot is enabled, ensure the +rebuilt UKIs are signed using the host's existing signing setup before rebooting. +After a successful rebuild, reboot and verify: + +```sh +cat /sys/module/apparmor/parameters/enabled +sudo cat /sys/kernel/security/lsm +sudo aa-status +sudo lxc start ubuntu-dev +sudo lxc exec ubuntu-dev -- cat /proc/1/attr/current +``` + +Skip `lxc start` if the instance is already running. AppArmor must report `Y`, +and the container's process label must show an enforced LXD profile rather than +`unconfined`. If it does not, inspect `journalctl -b -u lxd.service` and kernel +AppArmor messages. Do not disable confinement to bypass a failed start. + +## First Container + +```sh +sudo lxc launch ubuntu:24.04 ubuntu-dev +sudo lxc exec ubuntu-dev -- cloud-init status --wait +sudo lxc exec ubuntu-dev -- apt-get update +sudo lxc exec ubuntu-dev -- su - ubuntu +``` + +The container shares the host kernel. Use a VM for kernel and bootloader tests. +The host list includes `cdrtools` for LXD VM support. Pacman supplies LXD's +QEMU and OVMF dependencies. + +References: [LXD installation](https://canonical.com/lxd/docs/latest/installing/) +and [firewall configuration](https://canonical.com/lxd/docs/latest/howto/network_bridge_firewalld/). |