LXC 7.0 arrives, LXC 6 becomes the default, LXC 3 is deprecated

News
1

LXC 6 is becoming the default container runtime in meta-pantavisor, LXC 7.0 is coming as an option to try, and LXC 3 is deprecated. Most builds need to do nothing: they move from LXC 3 to LXC 6 on their own. Only a board that cannot move yet needs one line to stay on LXC 3.

These changes ship with meta-pantavisor’s next release. LXC 7 also needs Pantavisor 031 (the next release, not yet out). The cgroup side is covered in Pantavisor 031: cgroup v2 support and how to migrate.

What is LXC?

LXC is the container runtime: the part that starts each container and applies its settings. Pantavisor uses its own LXC branch with a small set of Pantavisor changes: GitHub - pantavisor/lxc · GitHub

Choosing a version

meta-pantavisor picks the LXC version with a feature in PANTAVISOR_FEATURES:

Feature LXC version Status
lxc-stable LXC 6 the new default
lxc-next LXC 7.0 for testing; needs cgroup v2
lxc-deprecated LXC 3 the old default; deprecated

If no lxc feature is set, you get LXC 6. If several are set, lxc-deprecated wins over lxc-next, which wins over lxc-stable.

To select one, use a kas fragment:

./kas-container build kas/build-configs/release/docker-x86_64-scarthgap.yaml:kas/with-lxc-next.yaml

The fragments are kas/with-lxc-next.yaml and kas/with-lxc-deprecated.yaml. kas menu offers the same choice under “Optional overlays”. Or set the feature directly:

PANTAVISOR_FEATURES:append = " lxc-next"

Always use :append. Using += drops the other default features.

What the reference boards use

  • The Raspberry Pi image (rpi, all Pi models) builds with LXC 7 and cgroup v2. All its kernels have the options v2 needs.
  • The Orange Pi 3 LTS builds with LXC 3.
  • Every other board and the appengine build use LXC 6.

Boards that did not pick an LXC version before move from LXC 3 to LXC 6.

LXC 7.0

Pantavisor’s patches were carried over from the LXC 6 branch unchanged. These upstream changes matter most:

  • No cgroup v1 at all. A config with lxc.cgroup.<controller> lines fails to load.
  • Linux 5.12 or newer is required.
  • LXC can restrict its monitor process with Landlock (a build option).
  • lxc.environment gained lxc.environment.runtime and lxc.environment.hooks.

Because LXC 7 has no v1, it relies on the cgroup v2 work from the first post. With lxc-next, meta-pantavisor sets PV_SYSTEM_CGROUP_VERSION=2, and Pantavisor 031 removes the v1 lines before LXC 7 reads the config. The kernel needs CONFIG_BPF_SYSCALL and CONFIG_CGROUP_BPF; the build stops with a clear message if they are missing.

LXC 3

LXC 3 keeps working on cgroup v1 (PV_SYSTEM_CGROUP_VERSION=1 is set automatically) for boards that cannot move yet. It is deprecated, so plan to move away from it.

What do I need to do?

Your situation Action
Most builds Nothing. You get LXC 6.
A board that needs LXC 3 Set lxc-deprecated: PANTAVISOR_FEATURES:append = " lxc-deprecated"
You want to try LXC 7 Use lxc-next with Pantavisor 031 and a kernel 5.12 or newer with the two BPF options

Feedback from your boards is welcome in this thread.