linux/meta-virtualization.git/recipes-containers/lxc, branch master-next

lxc: drop templates-actually-create-DOWNLOAD_TEMP-directory.patch

2026-06-14T03:56:57+00:00

The local patch added in 2018 was meant to ensure DOWNLOAD_TEMP pointed at a directory that actually existed by routing mktemp through the -p option. Its else branch is reached precisely when DOWNLOAD_TEMP is unset (the elif catches the set case), but the rewrite DOWNLOAD_TEMP="$(mktemp -p ${DOWNLOAD_TEMP} -d)" substitutes an empty ${DOWNLOAD_TEMP} into the command line, leaving the shell to parse mktemp -p -d as -d being the argument value for -p rather than its own flag. mktemp then fails immediately with mktemp: failed to create file via template '-d/tmp.XXXXXXXXXX': No such file or directory and lxc-create exits before doing any network work. Every invocation of lxc-create --template download is broken. Ferry Toth reported this on the meta-virt list 2026-06-13 (subject "lxc: starting a container errors out"). His diagnosis is correct and the fix he proposed — drop the patch — is the right one. The original upstream line DOWNLOAD_TEMP="${DOWNLOAD_TEMP}$(mktemp -d)" handles both cases correctly: with DOWNLOAD_TEMP set the elif branch runs first, and with it unset the else branch reduces to just DOWNLOAD_TEMP="$(mktemp -d)" which lets mktemp pick the default TMPDIR / /tmp location and create the directory. The original 2018 motivation ("DOWNLOAD_TEMP will not be pointing to an actual directory") does not match how mktemp -d actually behaves on modern systems — the directory IS created, and that's the whole point of mktemp -d. The reported failure mode was likely a build-host environment quirk specific to that 2018 setup rather than a general bug worth carrying a layer-local patch for. Signed-off-by: Bruce Ashfield

lxc: update to v7.0.0

2026-05-29T19:39:46+00:00

Bumping lxc to version v7.0.0, which comprises the following commits: e4415af07 Release LXC 7.0.0 14754e0b9 usernic: add a test for ovs port deletion permission 7c4348314 lxc-user-nic: clarify and fix aebd808da Don't leak an open fd 565540984 lvm.c: make sure tp gets freed cf5aa7ca5 tests/lxc-test-lxc-attach: Increase sleep time bae8a42f7 lsm/apparmor: allow binfmt_misc RW mounts c57010a38 apparmor: allow nosymfollow remounts b46f872d9 apparmor: allow nosymfollow remounts 9e541fa86 lxc: assume fsopen/open_tree/mount_setattr syscalls are supported 87ff1e31e lxc/start: assume CLONE_PIDFD and clone3 are supported eed40beb1 doc: mention that legacy/hybrid hierarchy support is dropped 27649a1f2 lxc/cgroups: warn if non-unified cgroup layout detected 105385172 config/templates: don't use cgroup1 settings 7d9be4a4b tests: use lxc.cgroup2 instead of lxc.cgroup f29c3a3a6 lxc/conf: drop cgroup1 config options (lxc.cgroup.*) db0d83e42 lxc/cgroups: drop cgroup1 mounting logic 936fa0629 lxc/cgroups: drop special handling logic for cgroup1 cpuset controller dfa8ea976 lxc/cgroup: drop cgroup1 device cgroup support 95ac49ec6 lxc/cgroups: drop cgroup1 freezer support 49bb4fad1 [nesting] Extend mount permissions in apparmor to allow systemd services' restrictions to work 88b44a5f9 cgroups: Skip systemd dbus logic when not using systemd cf5e950ee tests: mount_injection: ensure cleanup on test failure 110974e9c Fix issue where memfd functions were not being detected during meson setup. f5641d697 Fix issue where pidfd_ functions were not being detected during meson setup. 2bc6bac9c utils: Only single quote our own arguments 7174f2e2a utils: Update buffer size to account for quotes 589981f4f utils: Add quotes around exec arguments e4d847bd0 build(deps): bump actions/upload-artifact from 6 to 7 a01f7b4ac Add --rbuser to Japanese lxc-create(1) 29cd84d8e Add description for unprivileged containers to Japanese man page d8f2c55fa cmd/lxc-user-nic: prevent OOB read in name_is_in_groupnames aba5d1fbf lxc/network: define netlink uAPI constants for link properties 5e9b89c8f lxc/network: save/restore physical network interfaces altnames 3ba8131f0 lxc/network: optimize netdev_get_mtu 061acb0b3 meson.build: fix open_how include with glibc-2.43+ 511e4db8f meson.build: fix openat2 include typo, fix with glibc-2.43 +FORTIFY 5b64b5016 lxc: added support OpenRC init system c97f33e1f src/confile: fix values of lxc.cap.keep and lxc.cap.drop 97bd7699c tests/lxc-attach: ensure no data corruption happens during heavy IO on pts 4cb9884ed lxc/{terminal, file_utils}: ensure complete data writes in ptx/peer io handlers 4a30d82af github: test io_uring-based event loop 4a5aa19d7 build: update Makefile and meson.build 6a5550ec2 Improve the dbus scope creation error handling 0f5852edf cgfsng: fix reboots when using dbus 49c34b1bc copy_rdepends: Don't fail on missing source file 9e6caeabe start: Respect lxc.init.groups also in new user namespace e6ad17a79 start: Remove outdated comment about group dropping af691a1fa build(deps): bump actions/upload-artifact from 5 to 6 f085a8cbd Added documentation on unprivileged LXC containers 9799ebacc added doc for --rbduser 1090d85df added "--rbduser" option in "lxc-create -B rbd" fbeb7ce7e Fallback to XDG_RUNTIME_DIR when /run not found 969a3c599 checkonfig: Fixed compatible with toybox/gunzip fee221cae Initial changes without testing 9a1edb704 Enumerated all values in array 5d160e2a5 meson: add meson option for running doxygen in build 4d00d4f80 build: Check if P_PIDFD is defined 661780256 build(deps): bump actions/checkout from 5 to 6 1d1700a23 Ensure do_lxcapi_unfreeze returns false when getstate errors b89ed0a8e apparmor: skip /proc and /sys restrictions if nesting is enabled c81e03eb6 Update lxc.spec.in to use meson f3ff31e58 config/apparmor/abstractions: Drop manually generated container-base file 52929fc21 config/apparmor/abstractions: Fix meson build generation of container-base fc5a9422f build(deps): bump actions/upload-artifact from 4 to 5 4e48c0d09 builds workflow: make .orig.tar.gz unique per build 7f128c968 github: Drop focal source packages aa0fdd1a4 add MFD_EXEC and MFD_NOEXEC_SEAL flag to memfd_create 00f05b13d start: Only include linux/landlock.h when landlock is enabled 20aa142d5 Automatically detect compression format in the lxc-local template fba76ea65 lxccontainer: check if target exists before remove in create_mount_target() d269f0370 Standardize log file create mode to 0640 d79142d41 doc: add lxc.environment.{runtime,hooks} in Japanese man page c7bd5a357 Enable systemd to create /var/lib/lxc at runtime with StateDirectory e0290fa4a doc: add lxc.environment.{runtime, hooks} 9ebe1f11e api_extensions: add environment_runtime_hooks extension fbd37f04c conf: split `lxc.environment` into `runtime` and `hooks` 3f1658526 github: Enable landlock in tests 226bbf62f start: Add Landlock restrictions to monitor 8ef1ac504 start: Make lxc_handler mainloop to run in thread bfacedd4c meson: Add optional landlock protection for monitor 694944a7e commands: Fix indent 9b2422478 README: update links 95cad77e7 Rename CONTRIBUTING to CONTRIBUTING.md cc2a8494b README: Fix CI links e434816f2 build(deps): bump actions/checkout from 4 to 5 b3a5d2814 lxc/conf: do not leak opts.data memory in __lxc_idmapped_mounts_child() 5db329a4b lxc/network: null-terminate ifname string in lxc_network_recv_name_and_ifindex_from_child() 23633ab0f tests/lxc-test-snapdeps: try to load overlay kernel module 1d8d439af tests/lxc-test-rootfs: add idmapped rootfs testcase a53589e06 lxc/lxccontainer: stop printing misleading errors in enter_net_ns() a5189e3f5 lxc/process_utils.h: use strsignal() or sys_siglist[] for Non-GNU distros 39cb6d119 meson.build: use has_header_symbol() instead of get_define() to improve compatibility 0267998bc meson.build: fix checks for fsconfig and calls 6d6f0e1b0 meson.build: set `LXC_DISTRO_SYSCONF` when `-Dspecfile=true` ad0804e41 Add loong64 to list of recognized architectures d5beb15ae Revert "re-add onexec for apparmor, move label assumption until after container has been setup for attach" bba0a0d60 src/tests/oss-fuzz: pin meson to 1.7.2 to workaround build failures afb35f3de lxc/conf: support flag kind of mount options in lxc.mount.entry options 2e08794e0 lxc/conf: support nosymfollow mount flag 30b11e54a conf: Add support for "move" mount flag a9b343f48 src/tests/lxc-test-unpriv: prevent fail on cleanup path a13f86b07 src/tests/lxc-test-apparmor-mount: prevent fail on cleanup path 68e57809e src/tests/lxc-test-apparmor-generated: enable test ea92e49bd meson.build: remove quirk for Ubuntu 14.04 libcap-dev 7b9ee8967 apparmor test: add an overlay container start 50dee37cf re-add onexec for apparmor, move label assumption until after container has been setup for attach 0636ec66b lxc/conf,start: fix setting container_ttys environment variable c69830734 selinux: fix typo (AppArmor) 6cb00878e meson_options.txt: remove space before `:` for consistency 368ac7b80 meson_options.txt: don't use str when defining bool default values fc65c6a79 bionic: Remove custom getline, openpty and prlimit 4d52fe8e0 bionic: Remove bionic detection and support ee022cf05 README: Remove mention of old LXC version 0df81457d start: Re-introduce first SET_DUMPABLE call e5cc7a6be lxc/start: do prctl(PR_SET_DUMPABLE) after last uid/gid switch 3c6ea300b lxc/caps: fix open /proc/sys/kernel/cap_last_cap becd5538e lxc/conf: handle rootfs open_at error in lxc_mount_rootfs ff1ea5099 tools/lxc_attach: fix ENFORCE_MEMFD_REXEC checks c8cc47101 github: Add packaging workflow 7914afb0c global: Switch to new MAC prefix 7bd24f6cb global: Switch MAC generation to Zabbly prefix 31cd14682 sysconfig/lxc: remove false comment d047d81b7 Added LXC_IPV6_ENABLE option for lxc-net to enable or disable IPv6 9c9c27e8c github: Switch to native arm64 runners 59825e187 config-bcast: fix incorrect broadcast address calculation b4248f626 lxc/attach: Revert "- LXC attach should exit on SIGCHLD" 8d8fd27b5 conf: warn when capabilities are disabled or libcap is not found 844c49fcf dbus: replace hardcoded dbus address with environment variable 4c4636830 conf: log name of invalid capability in error 50be11e8d confile-vlanid: undefined is not a zero value f02158439 - LXC attach should exit on SIGCHLD 9589be83c github: Improve progress reporting 4fef63526 github: Cleanup OSS-fuzz 664344d9d github: Rework test workflow 6dd4c9bae github: Introduce shared testsuite logic 5b752b525 github: Introduce shared build logic e47b9ee65 github: Update coverity workflow 4527cec26 lxc.init: Allow SIGHUP from outside the container d25e7f306 lxc.init: Ignore user signals coming from inside the contianer c41c5ebfa lxc.init: Switch to sigaction 87dcdecf5 lxccontainer: fix enter_net_ns helper to work when netns is inherited 31012d49a lxc-net: Replace random IPv6 subnet d03cb0aca meson: fix minor typo f7c758537 fix return code of recursive all of cgroup_tree_prune d5c2d1eff Avoid null pointer dereference when using shared rootfs. rootfs->storage not set by lxc_storage_prepare when using a shared rootfs. d50ee6f7c create_run_template: don't use txtuid and txtguid out of scope 3764c1996 Add suppport for PuzzleFS images in the oci template a8ca9f5f3 meson.build: drop suggest-attribute=noreturn build option 36497cc90 meson.build: add -ffat-lto-objects 83bb86888 fix possible clang compile error in AARCH b79d2a525 README: Update security contact 7be043310 doc: Fix definitions of get_config_path and set_config_path b24d2d45b Exit 0 when there's no error 5db3d7299 idmap: Lower logging level of newXidmap tools to INFO 5603534a9 Remove unused function 01ae1fe55 meson: fix build with -Dtools-multicall=true on NixOS 4892749ef github: exclude clang & ubuntu-24.04 combination 20a14562d lxc/storage/zfs: ignore false-positive use-after-free warning 8a297c3ad github: properly check apparmor profile changes bdba5efee github: start using ubuntu-24.04 d29f72e37 apparmor: regenerate rules 32f88c8fe apparmor: use /{,**} instead of /** 083678be2 apparmor: regenerate rules 9c492b079 apparmor: fix rule path pattern specification syntax 63168bcf4 lxc-local: remove check for template existence before extraction d740a3423 lxc-local: fix incorrect path to `templates` file d7f2a52fd lxc-local: fix use of `LXC_PATH` before init 9a6448af4 Update lxc-execute.sgml.in 3bef71d7e Update lxc-{attach,execute}.sgml.in a7aa2974d Update lxc-execute.sgml.in 52bf34d8a Update lxc-attach.sgml.in ee8063bcf network: netdev_configure_server_veth: reduce scope of disable_ipv6_fd/path vars dd663dcb3 lxc/network: handle non-existing sysctl /disable_ipv6 cca0f8767 github: test the lxc multicall binary builds too 4be1c12c1 meson: fix build on NixOS 054163193 meson: Set DEVEL flag post release Signed-off-by: Bruce Ashfield

lxc: delete extraneous PACKAGECONFIG[systemd] line

2026-04-28T11:46:04+00:00

The PACKAGECONFIG[systemd] variable is assigned twice, with the second assignment overriding the first. This patch removes the unused assignment to avoid confusion. The duplication was introduced in an August 25, 2022 patch: 05f316f7 lxc: update to 5.x and meson Verfied that the build did not change after this deletion by checking the log files before and after and finding the same message: export systemd_system_unitdir="/usr/lib/systemd/system" export systemd_unitdir="/usr/lib/systemd" export systemd_user_unitdir="/usr/lib/systemd/user" Signed-off-by: Kris Gavvala Signed-off-by: Bruce Ashfield

lxc: update to v6.0.6

2026-03-14T15:15:18+00:00

This fixes the build with recent glibc and picks up the following fixes: 2597434ae Release LXC 6.0.6 d128f134d cmd/lxc-user-nic: prevent OOB read in name_is_in_groupnames c43aeaaed lxc/network: define netlink uAPI constants for link properties 42b43b31c lxc/network: save/restore physical network interfaces altnames 810f44ba0 lxc/network: optimize netdev_get_mtu 5e68a7a63 meson.build: fix open_how include with glibc-2.43+ 540f9e2bc meson.build: fix openat2 include typo, fix with glibc-2.43 +FORTIFY 01b9e35a7 lxc: added support OpenRC init system 885496ccc src/confile: fix values of lxc.cap.keep and lxc.cap.drop 99c3206c7 tests/lxc-attach: ensure no data corruption happens during heavy IO on pts b964611b3 lxc/{terminal, file_utils}: ensure complete data writes in ptx/peer io handlers d6ccb9abe github: test io_uring-based event loop 0448c9dd2 build: update Makefile and meson.build aa4212023 Improve the dbus scope creation error handling f9e73517e cgfsng: fix reboots when using dbus 2072ea4c7 copy_rdepends: Don't fail on missing source file c7eac1180 start: Respect lxc.init.groups also in new user namespace 8ed8145d6 start: Remove outdated comment about group dropping e9921c3d7 build(deps): bump actions/upload-artifact from 5 to 6 97a2e4af5 Added documentation on unprivileged LXC containers 59a30025e added doc for --rbduser 54d323a2d added "--rbduser" option in "lxc-create -B rbd" a262afb5d Fallback to XDG_RUNTIME_DIR when /run not found d7068a338 checkonfig: Fixed compatible with toybox/gunzip 4cc343edf Initial changes without testing bdce7a634 Enumerated all values in array edc57196f meson: add meson option for running doxygen in build 058be42aa build: Check if P_PIDFD is defined 099089971 Ensure do_lxcapi_unfreeze returns false when getstate errors f9ff9ea2a build(deps): bump actions/checkout from 5 to 6 Signed-off-by: Bruce Ashfield

lxc: restore DEBUG_PREFIX_MAP in TARGET_LDFLAGS for LTO reproducibility

2026-02-09T03:34:12+00:00

oe-core [1] removed DEBUG_PREFIX_MAP from TARGET_LDFLAGS to avoid passing prefix-map options via the linker flags. This is fine for most projects since DEBUG_PREFIX_MAP is also provided via CFLAGS at configure time. However, lxc enables LTO by default, which causes link-time code generation to (re)emit debug information during the link step. Without DEBUG_PREFIX_MAP on the link command line, TMPDIR/WORKDIR paths can leak into DWARF, triggering the buildpaths QA check and breaking reproducibility. Append DEBUG_PREFIX_MAP back to TARGET_LDFLAGS for lxc to ensure prefix-map options are visible during LTO link-time compilation. [1] https://git.openembedded.org/openembedded-core/commit/?id=1797741aad02b8bf429fac4b81e30cdda64b5448 Signed-off-by: Ricardo Salveti Signed-off-by: Bruce Ashfield

lxc: delete empty lxc state directory

2026-01-06T19:43:13+00:00

lxc systemd service [1] defines a StateDirectory to ensure that the /var/lib/lxc directory is automatically created and managed by systemd during service startup. Do not create lxc directory at build time for systemd. [1] https://github.com/lxc/lxc/blob/f9ff9ea2a92653a823edf25e8e28c9dab08b3090/config/init/systemd/lxc.service.in#L16 Signed-off-by: Vishwas Udupa Signed-off-by: Bruce Ashfield

lxc: Fix build with musl

2025-12-02T04:49:04+00:00

Signed-off-by: Jaeyoon Jung Signed-off-by: Bruce Ashfield

lxc: update to v6.0.5-tip

2025-12-02T03:45:51+00:00

Bumping lxc to version v6.0.5-17-gf9ff9ea2a, which comprises the following commits: f9ff9ea2a build(deps): bump actions/checkout from 5 to 6 c21296262 apparmor: skip /proc and /sys restrictions if nesting is enabled be5ce5529 Update lxc.spec.in to use meson e716bd6c8 config/apparmor/abstractions: Drop manually generated container-base file 5d0182b0d config/apparmor/abstractions: Fix meson build generation of container-base 539424964 build(deps): bump actions/upload-artifact from 4 to 5 fdc302322 builds workflow: make .orig.tar.gz unique per build d0d4f9896 github: Drop focal source packages 944118acd add MFD_EXEC and MFD_NOEXEC_SEAL flag to memfd_create ca9ecef01 Automatically detect compression format in the lxc-local template 50bddb8e3 lxccontainer: check if target exists before remove in create_mount_target() d692ba5a9 Standardize log file create mode to 0640 0e84c43d7 Enable systemd to create /var/lib/lxc at runtime with StateDirectory 277634689 commands: Fix indent 9184960a8 README: update links 7e0e0d1ae Rename CONTRIBUTING to CONTRIBUTING.md 675ffcd71 README: Fix CI links 9e4e69ed1 Release LXC 6.0.5 Signed-off-by: Bruce Ashfield

lxc: update to v6.0.5

2025-10-19T01:01:55+00:00

Bumping lxc to version v6.0.5, which comprises the following commits: 9e4e69ed1 Release LXC 6.0.5 a0fb994a5 build(deps): bump actions/checkout from 4 to 5 93a06e70f lxc/conf: do not leak opts.data memory in __lxc_idmapped_mounts_child() 97eeb8a9a lxc/network: null-terminate ifname string in lxc_network_recv_name_and_ifindex_from_child() 7a94d11d9 tests/lxc-test-snapdeps: try to load overlay kernel module 0bf6aedf0 tests/lxc-test-rootfs: add idmapped rootfs testcase 98ebede63 lxc/lxccontainer: stop printing misleading errors in enter_net_ns() 7111f9d83 lxc/process_utils.h: use strsignal() or sys_siglist[] for Non-GNU distros 032290ec8 meson.build: use has_header_symbol() instead of get_define() to improve compatibility 85c5312be meson.build: fix checks for fsconfig and calls 4da694582 meson.build: set `LXC_DISTRO_SYSCONF` when `-Dspecfile=true` e4cddef06 Add loong64 to list of recognized architectures e9980ac90 Revert "re-add onexec for apparmor, move label assumption until after container has been setup for attach" ab55d52a5 src/tests/oss-fuzz: pin meson to 1.7.2 to workaround build failures 9041ae313 lxc/conf: support flag kind of mount options in lxc.mount.entry options 859f736f0 lxc/conf: support nosymfollow mount flag c42951b71 conf: Add support for "move" mount flag e6bce2a2d src/tests/lxc-test-unpriv: prevent fail on cleanup path 601576a08 src/tests/lxc-test-apparmor-mount: prevent fail on cleanup path b12d1bf89 src/tests/lxc-test-apparmor-generated: enable test e35133a54 meson.build: remove quirk for Ubuntu 14.04 libcap-dev cbe34bcc2 apparmor test: add an overlay container start 1541bd8f2 re-add onexec for apparmor, move label assumption until after container has been setup for attach 8ab6ad25b lxc/conf,start: fix setting container_ttys environment variable b185e523f selinux: fix typo (AppArmor) Signed-off-by: Bruce Ashfield

lxc: update to v6.0.4

2025-07-07T15:42:27+00:00

Bumping lxc to version v6.0.4-7-gb185e523f, which comprises the following commits: b185e523f selinux: fix typo (AppArmor) 4be5e7c65 meson_options.txt: remove space before `:` for consistency 81d00893a meson_options.txt: don't use str when defining bool default values 8a7ea2523 bionic: Remove custom getline, openpty and prlimit 136d5ae08 bionic: Remove bionic detection and support f362f6eed README: Remove mention of old LXC version 2663712e8 start: Re-introduce first SET_DUMPABLE call 0fb6eb66d Release LXC 6.0.4 312976c9b lxc/start: do prctl(PR_SET_DUMPABLE) after last uid/gid switch 77b9cb1dc lxc/caps: fix open /proc/sys/kernel/cap_last_cap dfe473705 lxc/conf: handle rootfs open_at error in lxc_mount_rootfs 782b666dc tools/lxc_attach: fix ENFORCE_MEMFD_REXEC checks bcb6d063d github: Add packaging workflow 3a4003c8c global: Switch to new MAC prefix 5cdef29d8 global: Switch MAC generation to Zabbly prefix 400115de0 sysconfig/lxc: remove false comment 0e99eaa35 Added LXC_IPV6_ENABLE option for lxc-net to enable or disable IPv6 84e02ca8c github: Switch to native arm64 runners f68da1c9f config-bcast: fix incorrect broadcast address calculation 5b31eb51a lxc/attach: Revert "- LXC attach should exit on SIGCHLD" 555276df9 conf: warn when capabilities are disabled or libcap is not found a99f593e3 dbus: replace hardcoded dbus address with environment variable d34b373ca conf: log name of invalid capability in error 56ef15e71 confile-vlanid: undefined is not a zero value b4fda3c60 - LXC attach should exit on SIGCHLD fe31d844e Release LXC 6.0.3 Signed-off-by: Bruce Ashfield