net_cls interfering with lxd

[Miosame]

Issue report

Operating system: Arch Linux (5.18.3-zen1-1-zen)

App version: 2022.2-beta2

Issue description

mullvad automatically mounts what I assume is a v1 cgroup for net_cls, causing lxd to not be able to start containers as it now thinks it's an unsupported/broken cgroup host, unmounting net_cls makes mullvad-exclude (obviously) not work with No net_cls controller

reading #1893 supposedly there's some device setting you can do, to mount net_cls elsewhere? but I could not find such setting anywhere in the beta app, what's the solution to avoid having it break lxd?

[faern]

Pleas see #3660. We have added more documentation on this now.

[Miosame]

@faern thanks! though would you be able to hint at where I should mount it to, so it doesn't interfere with v2?

[pinkisemils]

Technically any directory will work - any reasonable consumer of the old controller should be able to find it anywhere. If you believe our daemon will be the only user of the old controller, it'd be reasonable to mount it in /sys/fs/net-cls-v1, but Fedora mounts the V1 controller under the V2 cgroup - /sys/fs/cgroup/net_cls, and debian does the same.

[Miosame]

@pinkisemils does that mean that net_cls is v1 only? so wherever I will mount it to, it'll taint v2 groups and make it mixed again?

[pinkisemils]

Yes.

[Miosame]

I guess you can't use LXD/LXC together with mullvad-exclude then, that's unfortunate, is there any workarounds for this to still be able to keep using both?

[pinkisemils]

I've gotten it working by just mounting the net_cls crgoup literally anywhere else but /sys/fs/cgroup/net_cls. /tmp/whatever works, but you may want to mount it somewhere else with a saner name. I can confirm that mounting the old cgroup controller into cgroupv2 will fail. On a fresh install of Arch, LXD containers do work just fine as long as the mount directory of the V1 cgroup net_cls controller is put somewhere else.

[Miosame]

oh wow I wasn't aware it can literally be mounted anywhere, will try that shortly, thanks!

[Miosame]

that worked, thanks so much!

[paride]

Given that AIUI the mountpoint is arbitrary, can't the default be changed so that it doesn't interfere with LXD?