Bug#915397: systemd-container: fails to start a container going through machines.target or machinectl

[ed.gomez at free.fr]

Package: systemd-container
Version: 239-14
Severity: important

Dear Maintainer,

Current systemd-nspawn fails to start a container when going through
the systemd machine target or using machinectl.

I'll illustrate this using a debian stable debootstrap.

I found a thread discussing similar issues on systemd >= 239 for other host systems
and/or other guest containers that lead me to:
https://github.com/systemd/systemd/issues/10026

I eventually applied the corresponding upstream patch fixing the issue:
https://github.com/systemd/systemd-stable/commit/3371efc365046b5ed9921ab80687f5add81bdc16

Reproduction steps
==================

    # as root, i don't have a big /, so i'll be using /home. Do as you see fit
    $ mkdir -p /home/chroots
    $ cd /home/chroots
    $ debootstrap stable stable
    [... does its work successfully ... ]
    $ ln -sf /home/chroots/stable /var/lib/machines/stable
    $ systemctl enable machines.target
    $ systemctl enable systemd-nspawn at stable
    
    # then this last command is executed w/ patched or unpatched
    # systemd-container package
    $ machinectl start stable
    # or 
    $ systemctl start systemd-nspawn at stable

Results without patch, the container doesn't start
==================================================

    root at WKS-423P992-LN:/home/ed/tmp/systemd# machinectl status stable
    stable(60ba5d8188c044eb9de0abab8c67ddcb)
               Since: Mon 2018-12-03 14:14:51 CET; 3s ago
              Leader: 14714 (systemd)
             Service: systemd-nspawn; class container
                Root: /home/chroots/stable
               Iface: ve-stable
                  OS: Debian GNU/Linux 9 (stretch)
           UID Shift: 1309540352
                Unit: systemd-nspawn at stable.service
                      ├─payload
                      │ └─14714 /lib/systemd/systemd
                      └─supervisor
                        └─14712 /usr/bin/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-veth -U --settings=override 

    Dec 03 14:14:51 WKS-423P992-LN systemd-nspawn[14712]: [1B blob data]
    Dec 03 14:14:51 WKS-423P992-LN systemd-nspawn[14712]: Welcome to Debian GNU/Linux 9 (stretch)!
    Dec 03 14:14:51 WKS-423P992-LN systemd-nspawn[14712]: [1B blob data]
    Dec 03 14:14:51 WKS-423P992-LN systemd-nspawn[14712]: Set hostname to <WKS-423P992-LN>.
    Dec 03 14:14:51 WKS-423P992-LN systemd-nspawn[14712]: Failed to read AF_UNIX datagram queue length, ignoring: No such file or directory
    Dec 03 14:14:51 WKS-423P992-LN systemd-nspawn[14712]: Failed to install release agent, ignoring: No such file or directory
    Dec 03 14:14:51 WKS-423P992-LN systemd-nspawn[14712]: Failed to create /init.scope control group: Permission denied
    Dec 03 14:14:51 WKS-423P992-LN systemd-nspawn[14712]: Failed to allocate manager object: Permission denied
    Dec 03 14:14:51 WKS-423P992-LN systemd-nspawn[14712]: [!!!!!!] Failed to allocate manager object, freezing.
    Dec 03 14:14:51 WKS-423P992-LN systemd-nspawn[14712]: Freezing execution.

With patch, everything works as expected
========================================

stable(60ba5d8188c044eb9de0abab8c67ddcb)
           Since: Mon 2018-12-03 14:11:41 CET; 11s ago
          Leader: 14153 (systemd)
         Service: systemd-nspawn; class container
            Root: /home/chroots/stable
           Iface: ve-stable
              OS: Debian GNU/Linux 9 (stretch)
       UID Shift: 1309540352
            Unit: systemd-nspawn at stable.service
                  ├─payload
                  │ ├─14153 /lib/systemd/systemd
                  │ ├─14173 /lib/systemd/systemd-journald
                  │ ├─14201 /usr/sbin/cron -f
                  │ ├─14202 /usr/sbin/rsyslogd -n
                  │ └─14203 /sbin/agetty --noclear --keep-baud console 115200,38400,9600 vt220
                  └─supervisor
                    └─14151 /usr/bin/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-veth -U --settings=override 

Dec 03 14:11:41 WKS-423P992-LN systemd-nspawn[14151]: [  OK  ] Started Console Getty.
Dec 03 14:11:41 WKS-423P992-LN systemd-nspawn[14151]: [  OK  ] Reached target Login Prompts.
Dec 03 14:11:41 WKS-423P992-LN systemd-nspawn[14151]: [  OK  ] Started System Logging Service.
Dec 03 14:11:41 WKS-423P992-LN systemd-nspawn[14151]: [  OK  ] Reached target Multi-User System.
Dec 03 14:11:41 WKS-423P992-LN systemd-nspawn[14151]: [  OK  ] Reached target Graphical Interface.
Dec 03 14:11:41 WKS-423P992-LN systemd-nspawn[14151]:          Starting Update UTMP about System Runlevel Changes...
Dec 03 14:11:41 WKS-423P992-LN systemd-nspawn[14151]: [  OK  ] Started Update UTMP about System Runlevel Changes.
Dec 03 14:11:42 WKS-423P992-LN systemd-nspawn[14151]: [2B blob data]
Dec 03 14:11:42 WKS-423P992-LN systemd-nspawn[14151]: Debian GNU/Linux 9 WKS-423P992-LN console
Dec 03 14:11:42 WKS-423P992-LN systemd-nspawn[14151]: [1B blob data]


-- System Information:
Debian Release: 9.0
  APT prefers unstable
  APT policy: (800, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386, arm64

Kernel: Linux 4.19.0 (SMP w/8 CPU cores; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages systemd-container depends on:
ii  dbus             1.12.10-1
ii  libacl1          2.2.52-3+b1
ii  libbz2-1.0       1.0.6-9
ii  libc6            2.28-1
ii  libcurl3-gnutls  7.62.0-1
ii  libgcrypt20      1.8.4-4
ii  liblzma5         5.2.2-1.3
ii  libseccomp2      2.3.3-3
ii  libselinux1      2.8-1+b1
ii  systemd          239-14
ii  zlib1g           1:1.2.11.dfsg-1

Versions of packages systemd-container recommends:
pn  btrfs-progs        <none>
pn  libnss-mymachines  <none>

systemd-container suggests no packages.

-- no debconf information