Juju bootstrap on LXD fails with `error code 100` (apt timeout) on host connected via USB WiFi

Project Discussion OpenStack MicroStack
, , ,
1

Hello everyone,

I recently ran into a frustrating issue trying to bootstrap a Juju controller on LXD (juju bootstrap localhost mycloud). The bootstrap process would hang for a long time and eventually fail with subprocess encountered error code 100.

After running with --debug, I discovered the LXD container was booting up perfectly, getting an IP from DHCP, and starting the SSH server, but cloud-init was failing during the apt-get update phase. The container simply could not reach archive.ubuntu.com (connection timed out). Because cloud-init failed to install required packages, Juju destroyed the instance.

My Environment:

  • Hardware: Dell Precision T7920 Workstation
  • Network: Home network connected to a 5G MiFi router via a USB WiFi adapter (wlan0)
  • OS: Ubuntu 24.04 Host
  • Juju version: 3.6.25

The Root Cause:
Because my host machine connects to the internet via a USB WiFi adapter, the host’s kernel was not routing network packets from the LXD bridge (br0) out to the WiFi interface (wlan0). Additionally, the default iptables FORWARD policy was blocking the NAT’d traffic.

The Fix:
I had to manually enable IP forwarding and allow forwarded traffic on the host machine.

  1. Enable IP forwarding on the host:

    sudo sysctl -w net.ipv4.ip_forward=1

    (To make it permanent: echo "net.ipv4.ip_forward = 1" | sudo tee -a /etc/sysctl.d/99-ipforward.conf)

  2. Set the iptables FORWARD policy to ACCEPT (UFW was disabled, but the default iptables policy was still blocking it):

    sudo iptables -P FORWARD ACCEPT

After running these two commands, I tested a generic LXD container (lxc launch ubuntu:24.04 test-container → lxc exec test-container -- apt-get update) and it was able to reach the internet perfectly. The Juju bootstrap succeeded immediately after.

Security Note:
Leaving iptables -P FORWARD ACCEPT globally open is a bit broad. For tighter security, you can revert the policy to DROP and explicitly allow only the LXD bridge to route out to your WiFi interface:

sudo iptables -P FORWARD DROP
sudo iptables -A FORWARD -i br0 -o wlan0 -j ACCEPT
sudo iptables -A FORWARD -i wlan0 -o br0 -m state --state RELATED,ESTABLISHED -j ACCEPT

If anyone else is running a home lab using a MiFi or USB WiFi adapter, keep an eye on your host’s forwarding rules! Hope this helps someone.

1 Like