Weekly news #389

LXD News
,
1

Weekly status for the week of 24th March to 30th March.

Introduction

The highlight of the past week in LXD is added support for BPF Token delegation inside containers. Several bugs were also fixed, further improving LXD’s stability. Last but not least, LXD UI received several new features, including SSH key management and security.csm configuration for instances and profiles.

Thanks to all contributors!

BPF token support

LXD now supports enabling BPF Token delegation for containers. This allows containerized applications to access BPF syscall commands like BPF_PROG_LOAD by using a BPF Token they can make from a mounted BPF file system (BPFFS), provided the kernel supports BPF Tokens (Linux ≥ 6.9). Configuration is customizable via instance options and allows to specify which commands, maps, programs, and attach types are available inside the container.

LXD documentation provides an example where a socket filter is configured using BPF Token delegation.

Documentation: Privilege delegation using BPF Token

Bug Fixes

  • Fixed an issue where snapshots didn’t get profiles applied during instance copy and used creation-time profiles instead.

  • Fixed an issue where updates to ceph.osd.pg_num were not applied to the actual storage subsystem. Also, ceph.cluster_name and ceph.osd.pool_name are now immutable after pool creation to prevent breakage.

  • The admin group with admin permissions is now created on LXD install, simplifying UI onboarding by ensuring it’s always present.

  • Disabled post-quantum curves for simplestream remotes to avoid ClientHello message splitting, which can trigger connection reset by peer errors when interacting with simplestream remotes, such as images: or ubuntu:. This is a temporary mitigation to workaround broken middleboxes breaking standard compliant TLS connections. For more information on this problem, please see tldr.fail.

  • Fixed an issue where importing images smaller than 512B resulted in unwritable images. Image size is now rounded up to 512B.

  • Fixed regression in nftables port range rule where a missing - broke the generated rules.

LXD UI

  • Added SSH key management for instance and profile configurations.

  • Enhanced the onboarding flow with a new user type that supports limited permissions.

  • Introduced the security.csm configuration key for instance and profile configurations.

  • Various fixes, including improved mouse position accuracy on smaller screens in the browser graphics console.

All changes

The items listed below is all of the work which happened over the past week and which will be included in the next release.

LXD

LXD UI

LXD Charm

LXD Terraform provider

PyLXD

LXD snap

3 Likes