nspawn should support passing wifi adapters to containers, like other environments (LXC, …) apparently can do

Submission type

• Bug report

systemd version the issue has been seen with

systemctl --version
systemd 236
+PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD -IDN2 +IDN default-hierarchy=hybrid

Used distribution

cat /etc/debian_version
buster/sid

In case of bug report: Expected behaviour you didn't see

the container should be started and the wireless network adapter should be moved to the namespace. the problem does not appear when starting the container via LXC.

In case of bug report: Unexpected behaviour you saw

machinectl start server037
Job for systemd-nspawn@server037.service failed because the control process exited with error code.
See "systemctl status systemd-nspawn@server037.service" and "journalctl -xe" for details.

systemctl status systemd-nspawn@server037.service
● systemd-nspawn@server037.service - Container server037
Loaded: loaded (/lib/systemd/system/systemd-nspawn@.service; indirect; vendor preset: enabled)
Active: failed (Result: exit-code) since Sat 2018-01-13 17:49:18 CET; 16s ago
Docs: man:systemd-nspawn(1)
Process: 23733 ExecStart=/usr/bin/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-veth -U --settings=override --machine=server037 (code=exited, status=1/FAILURE)
Main PID: 23733 (code=exited, status=1/FAILURE)
Status: "Terminating..."

Jan 13 17:49:18 server060 systemd[1]: Starting Container server037...
Jan 13 17:49:18 server060 systemd-nspawn[23733]: Failed to move interface wlx001c4afd2f29 to namespace: Invalid argument
Jan 13 17:49:18 server060 systemd[1]: systemd-nspawn@server037.service: Main process exited, code=exited, status=1/FAILURE
Jan 13 17:49:18 server060 systemd[1]: systemd-nspawn@server037.service: Failed with result 'exit-code'.
Jan 13 17:49:18 server060 systemd[1]: Failed to start Container server037.

cat /etc/systemd/nspawn/server037.nspawn
[Exec]
PrivateUsers=False
[Network]
Bridge=br0
Interface=wlx001c4afd2f29

In case of bug report: Steps to reproduce the problem

create a container and try to start the container with the --network-interface= option using a wireless network adapter

[poettering]

Last time I looked wifi devices were not compatible with network namespaces in the Linux kernel, and there's nothing we can do about that in nspawn, it's a kernel limitation. As soon as the kernel gets fixed in this regard it should start working in nspawn too without further changes.

Sorry! Please ping the kernel developers about this instead!

but it is actually working if you do it manually.

removed the wireless network adapter from container:

cat /etc/systemd/nspawn/server037.nspawn
[Exec]
PrivateUsers=False

[Network]
Bridge=br0

starting the container without error:

machinectl start server037

container status is green:

machinectl status server037
server037(c9f48eb179fb4b1c9eb0a6abd0174047)
Since: Mon 2018-01-15 19:03:08 CET; 13s ago
Leader: 11352 (systemd)
Service: systemd-nspawn; class container
Root: /srv/machines/server037
Iface: br0
Address: 192.168.178.37
OS: Debian GNU/Linux buster/sid
Unit: systemd-nspawn@server037.service
├─payload
│ ├─init.scope
│ │ └─11352 /lib/systemd/systemd

add the wireless network adapter to the nspawn container:

iw phy phy0 set netns 11352

works well:

machinectl shell server037 /sbin/ip addr show wlx001c4afd2f29
Connected to machine server037. Press ^] three times within 1s to exit session.
4: wlx001c4afd2f29: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether 00:1c:4a:fd:2f:29 brd ff:ff:ff:ff:ff:ff
Connection to machine server037 terminated.

can you please have a second look? it looks like systemd is not taking into consideration that for wireless adapters the whole interface needs to be moved to the namespace:

https://www.spinics.net/lists/linux-wireless/msg115408.html

the wireless configuration tools (iw) have namespace support at least since march 2015:

https://git.kernel.org/pub/scm/linux/kernel/git/jberg/iw.git/commit/?id=91454b655808e6721aa7425744632bbe943edc27

my wireless adapter supports namespaces:

iw phy phy0 info | grep --after-context=19 "Supported commands:"
Supported commands:
* new_interface
* set_interface
* new_key
* start_ap
* new_station
* new_mpath
* set_mesh_config
* set_bss
* authenticate
* associate
* deauthenticate
* disassociate
* join_ibss
* join_mesh
* remain_on_channel
* set_tx_bitrate_mask
* frame
* frame_wait_cancel
* set_wiphy_netns

[poettering]

Reopening, as apparently other sw can do this now, and hence we should be able to do too, as the kernel was apparently fixed in this regard.

[wsw70]

@mog71

but it is actually working if you do it manually

Out of curiosity - wouldn't this require a driver in the container anyway? I just tried to add manually per your description (it works, thanks!) but then wpa_supplicant failed with some mysterious errors (failed dependency, device not supported, ...)

@wsw70

within the container my network is bridged:

$ networkctl status

State: routable
       Address: 192.168.178.37 on br0
                fe80::2c27:20ff:fe35:6ad2 on host0
                fe80::44e9:b8ff:fe91:c20a on br0
                fe80::21c:4aff:fefd:2f29 on wlx001c4afd2f29
       Gateway: 192.168.178.1 on br0
           DNS: 192.168.178.3
           NTP: 192.168.178.7

the bridge interface is setup and configured via systemd:

$ cat /etc/systemd/network/br0.netdev 
[NetDev]
Name=br0
Kind=bridge

$ cat /etc/systemd/network/br0.network 
[Match]
Name=br0

[Network]
DHCP=yes
LinkLocalAddressing=no

the container host interface is overwritten to include bridging:

$ cat /etc/systemd/network/80-container-host0.network 
[Match]
Name=host0

[Network]
Bridge=br0

the wifi interface is also configured by systemd, but only up until the bridge (because of the current missing wlan implementation). the interface is added by systemd but not added to the bridge:

$ cat /etc/systemd/network/wlx001c4afd2f29.network 
[Match]
Name=wlx001c4afd2f29

[Network]
#Bridge=br0
LinkLocalAddressing=no

hostapd is configured with bridging enabled:

$ grep --extended-regexp "(^interface|^bridge)" /etc/hostapd/hostapd.conf 
interface=wlx001c4afd2f29
bridge=br0

unfortunately you have to manually restart hostapd after each container boot:

$ systemctl restart hostapd.service

@wsw70

i've also 2 systemd timers running on the host which will do the pain after each host reboot.

one timer is run 60 seconds after reboot which does the following (assuming your container is named "myAPcontainer":

if [[ $(networkctl list) =~ wlx001c4afd2f29 ]]
then
  iw phy phy0 set netns $(machinectl status myAPcontainer | awk '/Leader:/{print $2}')
fi

and another one 120 seconds after reboot which does the following:

systemctl --machine myAPcontainer restart hostapd.service