[PR #52] [MERGED] fix(cgroup): give host-namespace containers a private cgroup ns #53

New issue

Closed

opened 2026-10-15 12:51:40 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 12:51:40 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/games-on-whales/LXC2Docker/pull/52
Author: @JBailes
Created: 6/4/2026
Status: ✅ Merged
Merged: 6/4/2026
Merged by: @JBailes

Base: main ← Head: fix/cgroup-namespace-for-host-mode

📝 Commits (2)

59fde6a fix(cgroup): give host-namespace containers a private cgroup ns
00fe473 test(cgroup): cover cgroup namespace cloning for host-mode containers

📊 Changes

2 files changed (+33 additions, -1 deletions)

View changed files

📝 internal/lxc/config.go (+8 -1)
➕ internal/lxc/namespace_cgroup_test.go (+25 -0)

📄 Description

Wolf app/compositor sibling containers aborted at cgroup setup (Force-mounting the unified cgroup hierarchy without cgroup namespace support is currently not supported → Failed to mount /sys/fs/cgroup → ABORTING), so Moonlight got Error 2 / a black screen.

When a container shares a host namespace (Wolf shares host IPC for shared memory), rewriteConfig emits an explicit lxc.namespace.clone list — which omitted cgroup, leaving the container in the host cgroup namespace. On cgroup v2, lxc.mount.auto = ...cgroup:rw then force-mounts the unified hierarchy, which LXC rejects without a private cgroup ns. cgroup namespaces are supported on the host (verified), so add cgroup to the clone list. Follows the sibling-mount translation fix (#51) — this is the next abort in the chain.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/games-on-whales/LXC2Docker/pull/52 **Author:** [@JBailes](https://github.com/JBailes) **Created:** 6/4/2026 **Status:** ✅ Merged **Merged:** 6/4/2026 **Merged by:** [@JBailes](https://github.com/JBailes) **Base:** `main` ← **Head:** `fix/cgroup-namespace-for-host-mode` --- ### 📝 Commits (2) - [`59fde6a`](https://github.com/games-on-whales/LXC2Docker/commit/59fde6a1d47bdc3ea4ab832edfde163ed0d429b0) fix(cgroup): give host-namespace containers a private cgroup ns - [`00fe473`](https://github.com/games-on-whales/LXC2Docker/commit/00fe473fa7cc55e0f7763273ba59102f1b121179) test(cgroup): cover cgroup namespace cloning for host-mode containers ### 📊 Changes **2 files changed** (+33 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `internal/lxc/config.go` (+8 -1) ➕ `internal/lxc/namespace_cgroup_test.go` (+25 -0) </details> ### 📄 Description Wolf app/compositor sibling containers aborted at cgroup setup (`Force-mounting the unified cgroup hierarchy without cgroup namespace support is currently not supported → Failed to mount /sys/fs/cgroup → ABORTING`), so Moonlight got **Error 2** / a black screen. When a container shares a host namespace (Wolf shares host IPC for shared memory), `rewriteConfig` emits an explicit `lxc.namespace.clone` list — which omitted `cgroup`, leaving the container in the host cgroup namespace. On cgroup v2, `lxc.mount.auto = ...cgroup:rw` then force-mounts the unified hierarchy, which LXC rejects without a private cgroup ns. cgroup namespaces are supported on the host (verified), so add `cgroup` to the clone list. Follows the sibling-mount translation fix (#51) — this is the next abort in the chain. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-15 12:51:40 +00:00

bsakaguchi referenced this issue

2026-10-15 12:51:40 +00:00

[PR #55] [MERGED] fix(mounts): resolve sibling bind sources inside a container's rootfs (#53) #54

bsakaguchi closed this issue

2026-10-15 12:51:40 +00:00

bsakaguchi referenced this issue

2026-10-15 12:51:40 +00:00

[PR #54] [MERGED] fix(mounts): set bind-mount propagation so containers can't break the host (#53) #55