Firefox fails to install inside LXD

pfsmorigo · January 7, 2025, 5:53pm

Hello,

When you try to install firefox inside a fresh ubuntu noble lxd container, it gives the following message:

ubuntu@ubuntu-noble:~$ sudo apt install firefox
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following NEW packages will be installed:
  firefox
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 77.3 kB of archives.
After this operation, 124 kB of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu noble/main amd64 firefox amd64 1:1snap1-0ubuntu5 [77.3 kB]
Fetched 77.3 kB in 1s (95.6 kB/s)
Preconfiguring packages ...
Selecting previously unselected package firefox.
(Reading database ... 37259 files and directories currently installed.)
Preparing to unpack .../firefox_1%3a1snap1-0ubuntu5_amd64.deb ...
=> Installing the firefox snap
==> Checking connectivity with the snap store
==> Installing the firefox snap
error: cannot perform the following tasks:
- Setup snap "snapd" (23258) security profiles (cannot reload udev rules: exit status 1
udev output:
Failed to send reload request: No such file or directory
)
dpkg: error processing archive /var/cache/apt/archives/firefox_1%3a1snap1-0ubuntu5_amd64.deb (--unpack):
 new firefox package pre-installation script subprocess returned error exit status 1
Errors were encountered while processing:
 /var/cache/apt/archives/firefox_1%3a1snap1-0ubuntu5_amd64.deb
E: Sub-process /usr/bin/dpkg returned an error code (1)

I’ve noticed that the systemd-udevd service is dead:

ubuntu@ubuntu-noble:~$ sudo systemctl status systemd-udevd
Warning: The unit file, source configuration file or drop-ins of systemd-udevd.service changed on disk. Run 'systemctl daemon-reload' to reload units.
○ systemd-udevd.service - Rule-based Manager for Device Events and Files
     Loaded: loaded (/usr/lib/systemd/system/systemd-udevd.service; static)
    Drop-In: /usr/lib/systemd/system/systemd-udevd.service.d
             └─syscall-architecture.conf
     Active: inactive (dead)
TriggeredBy: ○ systemd-udevd-control.socket
             ○ systemd-udevd-kernel.socket
  Condition: start condition unmet at Tue 2025-01-07 17:43:53 UTC; 1s ago
             └─ ConditionPathIsReadWrite=/sys was not met
       Docs: man:systemd-udevd.service(8)
             man:udev(7)

Jan 07 17:28:16 ubuntu-noble systemd[1]: systemd-udevd.service - Rule-based Manager for Device Events and Files was skipped because of an unmet condition check (ConditionPathIsReadWrite=/sys).

If I manually, run systemd-udevd, firefox installation works fine:

ubuntu@ubuntu-noble:~$ sudo /lib/systemd/systemd-udevd --daemon
Starting systemd-udevd version 255.4-1ubuntu8.4
ubuntu@ubuntu-noble:~$ sudo apt install firefox
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following NEW packages will be installed:
  firefox
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 0 B/77.3 kB of archives.
After this operation, 124 kB of additional disk space will be used.
Preconfiguring packages ...
(Reading database ... 37259 files and directories currently installed.)
Preparing to unpack .../firefox_1%3a1snap1-0ubuntu5_amd64.deb ...
=> Installing the firefox snap
==> Checking connectivity with the snap store
==> Installing the firefox snap
2025-01-07T17:31:20Z INFO Waiting for automatic snapd restart...
firefox 134.0-1 from Mozilla✓ installed
=> Snap installation complete
Unpacking firefox (1:1snap1-0ubuntu5) ...
Setting up firefox (1:1snap1-0ubuntu5) ...
update-alternatives: using /usr/bin/firefox to provide /usr/bin/gnome-www-browser (gnome-www-browser) in auto mode
update-alternatives: using /usr/bin/firefox to provide /usr/bin/x-www-browser (x-www-browser) in auto mode
Scanning processes...                                                                                                                                                                                                                                                                                 

No services need to be restarted.

No containers need to be restarted.

No user sessions are running outdated binaries.

No VM guests are running outdated hypervisor (qemu) binaries on this host.

Is there something I’m missing? What’s the correct way to fix it?

sdeziel1 · January 8, 2025, 1:52am

I tried reproducing on a Jammy host with the HWE kernel (6.8) but couldn’t, it installs well.

Could you try to simply apt-get install snapd followed by snap install snapd and see if that’s enough to run into the issue?

pfsmorigo · January 8, 2025, 6:56pm

Hello, Thanks for the reply. I’ve found out that the error only occur if you use security.privileged true and security.nesting true:

pfsmorigo@pisa:~$ lxc launch ubuntu:24.04 test
Creating test
Starting test
pfsmorigo@pisa:~$ lxc config set test security.privileged true
pfsmorigo@pisa:~$ lxc config set test security.nesting true
pfsmorigo@pisa:~$ lxc restart test
pfsmorigo@pisa:~$ lxc shell test
root@test:~# apt install firefox
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following NEW packages will be installed:
  firefox
0 upgraded, 1 newly installed, 0 to remove and 41 not upgraded.
Need to get 77.3 kB of archives.
After this operation, 124 kB of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu noble/main amd64 firefox amd64 1:1snap1-0ubuntu5 [77.3 kB]
Fetched 77.3 kB in 1s (119 kB/s)   
Preconfiguring packages ...
Selecting previously unselected package firefox.
(Reading database ... 37259 files and directories currently installed.)
Preparing to unpack .../firefox_1%3a1snap1-0ubuntu5_amd64.deb ...
=> Installing the firefox snap
==> Checking connectivity with the snap store
==> Installing the firefox snap
error: cannot perform the following tasks:
- Setup snap "snapd" (23258) security profiles (cannot reload udev rules: exit status 1
udev output:
Failed to send reload request: No such file or directory
)
dpkg: error processing archive /var/cache/apt/archives/firefox_1%3a1snap1-0ubuntu5_amd64.deb (--unpack):
 new firefox package pre-installation script subprocess returned error exit status 1
Errors were encountered while processing:
 /var/cache/apt/archives/firefox_1%3a1snap1-0ubuntu5_amd64.deb
E: Sub-process /usr/bin/dpkg returned an error code (1)
root@test:~#

sdeziel1 · January 8, 2025, 7:44pm

I concur that both security.privileged and security.nesting need to be set to reproduce the issue. Here’s the minimal reproducer I could get:

$ lxc launch ubuntu-minimal-daily:24.04 c1 -c security.privileged=true -c security.nesting=true
$ lxc exec c1 -- snap wait system seed.loaded
$ lxc exec c1 -- snap install snapd
error: cannot perform the following tasks:
- Setup snap "snapd" (23258) security profiles (cannot reload udev rules: exit status 1
udev output:
Failed to send reload request: No such file or directory
)

FYI, combining nesting and privileged gives you what we colloquially refer to as “insecure” container… best avoided if possible.

cc @amikhalitsyn

pfsmorigo · January 9, 2025, 12:12pm

Yeah, I know the risk. Is this really a bug or a limitation while using privileged container?

sdeziel1 · January 9, 2025, 2:21pm

Seems like it could be a snapd issue https://warthogs.atlassian.net/browse/SNAPDENG-24757

sdeziel1 · January 15, 2025, 4:12pm

interfaces: disable udev backend when insider container by zyga · Pull Request #14930 · canonical/snapd · GitHub is also worth nothing.