[PR #17] [MERGED] Fix PVE compatibility for Portainer and GoW #18

New issue

Closed

opened 2026-10-15 12:51:20 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 12:51:20 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/games-on-whales/LXC2Docker/pull/17
Author: @JBailes
Created: 4/18/2026
Status: ✅ Merged
Merged: 4/18/2026
Merged by: @JBailes

Base: main ← Head: fix/portainer-pve-deploy

📝 Commits (3)

6ce1f74 Fix Portainer create flow on PVE
b6b96e1 Fix LXC capability keep/drop translation
0a2eb5b Fix runtime socket mounts for GoW sessions

📊 Changes

8 files changed (+369 additions, -22 deletions)

View changed files

📝 internal/api/containers.go (+8 -7)
📝 internal/api/containers_extra.go (+12 -3)
📝 internal/api/network_portainer_test.go (+90 -0)
📝 internal/api/system.go (+9 -7)
📝 internal/lxc/config.go (+76 -5)
➕ internal/lxc/config_test.go (+115 -0)
📝 internal/lxc/manager.go (+20 -0)
➕ internal/lxc/manager_test.go (+39 -0)

📄 Description

Summary

normalize Docker's built-in default and bridge network aliases to the daemon-managed gow bridge during create, attach, and inspect flows
translate Docker capability keep/drop settings into a valid final LXC capability set so container runners with CapAdd do not fail on startup
mount shared runtime socket directories at their real destinations when a bind keeps the same path, preserving XDG_RUNTIME_DIR semantics for GoW Wayland and PulseAudio session sockets
add regression coverage for the network alias, capability translation, and runtime socket mount paths

Root Cause

Exercising Portainer and GoW on a Proxmox host exposed three daemon-side compatibility bugs:

POST /containers/create could reject NetworkingConfig.EndpointsConfig.default because the daemon treated Docker's implicit bridge aliases literally instead of mapping them to gow.
Containers with CapAdd inherited conflicting LXC drop rules, which caused LXC startup to fail with Keeping and dropping capabilities are mutually exclusive.
Socket binds like /run/user/wolf/wayland-1 -> /run/user/wolf/wayland-1 were rewritten through hidden mount points and symlinks, which broke full runtime-directory sharing for GoW session containers even though single control sockets still worked.

Validation

go test ./...
make build
redeployed the patched docker-lxc-daemon binary to root@192.168.1.253
verified Portainer create/start flows on PVE after the networking and image-path fixes
verified GoW session containers get past the prior LXC capability and runtime socket mount failures on PVE

Notes

The newest commit for the runtime socket directory fix is 0a2eb5b.
This PR now covers the full set of upstream daemon fixes needed to get the current PVE Portainer and GoW deployment paths working.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/games-on-whales/LXC2Docker/pull/17 **Author:** [@JBailes](https://github.com/JBailes) **Created:** 4/18/2026 **Status:** ✅ Merged **Merged:** 4/18/2026 **Merged by:** [@JBailes](https://github.com/JBailes) **Base:** `main` ← **Head:** `fix/portainer-pve-deploy` --- ### 📝 Commits (3) - [`6ce1f74`](https://github.com/games-on-whales/LXC2Docker/commit/6ce1f748c01bcbfc7cc0607ab6231b7b1951aa2f) Fix Portainer create flow on PVE - [`b6b96e1`](https://github.com/games-on-whales/LXC2Docker/commit/b6b96e14e18d66eaf93ee1b5bf86a5b7ae243822) Fix LXC capability keep/drop translation - [`0a2eb5b`](https://github.com/games-on-whales/LXC2Docker/commit/0a2eb5be573f2f80bff6834dda2b294ff02600b4) Fix runtime socket mounts for GoW sessions ### 📊 Changes **8 files changed** (+369 additions, -22 deletions) <details> <summary>View changed files</summary> 📝 `internal/api/containers.go` (+8 -7) 📝 `internal/api/containers_extra.go` (+12 -3) 📝 `internal/api/network_portainer_test.go` (+90 -0) 📝 `internal/api/system.go` (+9 -7) 📝 `internal/lxc/config.go` (+76 -5) ➕ `internal/lxc/config_test.go` (+115 -0) 📝 `internal/lxc/manager.go` (+20 -0) ➕ `internal/lxc/manager_test.go` (+39 -0) </details> ### 📄 Description ## Summary - normalize Docker's built-in `default` and `bridge` network aliases to the daemon-managed `gow` bridge during create, attach, and inspect flows - translate Docker capability keep/drop settings into a valid final LXC capability set so container runners with `CapAdd` do not fail on startup - mount shared runtime socket directories at their real destinations when a bind keeps the same path, preserving `XDG_RUNTIME_DIR` semantics for GoW Wayland and PulseAudio session sockets - add regression coverage for the network alias, capability translation, and runtime socket mount paths ## Root Cause Exercising Portainer and GoW on a Proxmox host exposed three daemon-side compatibility bugs: 1. `POST /containers/create` could reject `NetworkingConfig.EndpointsConfig.default` because the daemon treated Docker's implicit bridge aliases literally instead of mapping them to `gow`. 2. Containers with `CapAdd` inherited conflicting LXC drop rules, which caused LXC startup to fail with `Keeping and dropping capabilities are mutually exclusive`. 3. Socket binds like `/run/user/wolf/wayland-1 -> /run/user/wolf/wayland-1` were rewritten through hidden mount points and symlinks, which broke full runtime-directory sharing for GoW session containers even though single control sockets still worked. ## Validation - `go test ./...` - `make build` - redeployed the patched `docker-lxc-daemon` binary to `root@192.168.1.253` - verified Portainer create/start flows on PVE after the networking and image-path fixes - verified GoW session containers get past the prior LXC capability and runtime socket mount failures on PVE ## Notes - The newest commit for the runtime socket directory fix is `0a2eb5b`. - This PR now covers the full set of upstream daemon fixes needed to get the current PVE Portainer and GoW deployment paths working. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-15 12:51:20 +00:00