<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><font face="Helvetica, Arial, sans-serif">The following
instructions (step 2) resolve the situation:</font></p>
<p><font face="Helvetica, Arial, sans-serif"></font><br>
</p>
<pre class="moz-quote-pre" wrap="">lxc (1:3.1.0+really3.0.3-6) unstable; urgency=medium
LXC 3 got some significant changes from LXC 2.
1. The configuration files use different variables. A userland script
lxc-update-config is available to update automatically your
configuration files. An automatic update is possible and offered by
debconf during the upgrade of lxc version < 3.0.2 to lxc version >=
3.0.2. Mind that this update will only work for priviledged containers
with configurations present in <i class="moz-txt-slash"><span class="moz-txt-tag">/</span>var/lib/lxc<span class="moz-txt-tag">/</span></i>*/config and any other
container will not be updated.
2. AppArmor support in Debian has increased, thus preventing some systemd
isolation features to work in LXC 3.0.X. Debian has backported some
patches from LXC 3.1 that, along with some configurations in a
container, will allow systemd isolation features to work.
The required configuration parameters are the ones which follow:
lxc.apparmor.profile = generated
lxc.apparmor.allow_nesting = 1
These parameters are provided in the `/etc/lxc/default.conf` file
shipped with LXC 3. Hence, any newly created container will have these
parameters set properly, execpt if you alter the forementionned file.
3. lxc-templates is deprecated by upstream. The new way of building
containers is via their distrobuilder software. This software isn't in
Debian Buster, and thus, we still provide lxc-templates. If you relied
on it (eg, with lxc.include parameter in some configuration file), you
should install lxc-templates in case it doesn't come by itself (via
recommends). Otherwise you may experience issues after the upgrade.
-- Pierre-Elliott Bécue <a class="moz-txt-link-rfc2396E" href="mailto:peb@debian.org"><peb@debian.org></a> Sat, 09 Mar 2019 13:09:05 +0100</pre>
<div class="moz-cite-prefix">On 2019-02-14 10:51 a.m., Faustin
Lammler wrote:<br>
</div>
<blockquote type="cite" cite="mid:20190214155109.GA10084@falared">
<pre class="moz-quote-pre" wrap="">Control: forwarded -1 <a class="moz-txt-link-freetext" href="https://github.com/lxc/lxc/pull/2758">https://github.com/lxc/lxc/pull/2758</a>
Matthew,
I able to reproduce this and I have the exact same error (mariadb log +
apparmor on host).
Your workaround is working but it seems that removing only these 3 lines
is sufficient:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">ProtectSystem=full
PrivateDevices=true
ProtectHome=true
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
You can leave this one:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">ExecStartPre=/usr/bin/install -m 755 -o mysql -g root -d /var/run/mysqld
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Another workaround is to disable completely apparmor:
<a class="moz-txt-link-freetext" href="https://wiki.debian.org/AppArmor/HowToUse#Disable_AppArmor">https://wiki.debian.org/AppArmor/HowToUse#Disable_AppArmor</a>
I think we should wait until some progress comes from
<a class="moz-txt-link-freetext" href="https://github.com/lxc/lxc/pull/2758">https://github.com/lxc/lxc/pull/2758</a>.
Faustin
</pre>
</blockquote>
</body>
</html>