Tom Parrott

icon indicating a website link https://www.tomp.uk

icon company @canonical @lxc @beanstalkd icon location UK

Results 1094 comments of Tom Parrott

Provisioning VMs with certain root disk sizes on fresh Noble system results in 'volsize' must be a multiple of volume block size (16K)

Thanks, I used GiB :( The rounding logic is called here for ZFS: https://github.com/canonical/lxd/blob/main/lxd/storage/drivers/driver_zfs_volumes.go#L87 It uses https://github.com/canonical/lxd/blob/main/lxd/storage/drivers/driver_common.go#L554-L566 which rounds to 8192 bytes (https://github.com/canonical/lxd/blob/main/lxd/storage/drivers/utils.go#L25). LVM has its own rounding logic here:...

Provisioning VMs with certain root disk sizes on fresh Noble system results in 'volsize' must be a multiple of volume block size (16K)

It'd be good to get a reproducer so we can check its actually fixed.

Add `security.protection.start` to optionally block instance start up.

Please can you sign the CLA. https://ubuntu.com/legal/contributors/agreement

Add `security.protection.start` to optionally block instance start up.

Hi @arvganesh do you need any help with addressing the pending items on this issue?

Add `security.protection.start` to optionally block instance start up.

Hi @arvganesh are you able to progress this or should we close it? Thanks

Add `security.protection.start` to optionally block instance start up.

Hi @arvganesh im going to close this for now so our open PR list doesn't get too long. When/if you are able to sign the CLA then please free to...

Seccomp: Tighten container capability checks a bit to align with kernel behaviour

Thanks @mihalicyn !

`Error setting CPU affinity for the instance` when creating VMs with less CPU than `$(nproc)`

@mihalicyn please can you investigate. Ta

Better support unprivileged user namespaces being disabled

> userns=0 In this context what is `userns=0` btw?

Better support unprivileged user namespaces being disabled

@alexmurray so are you saying that going forward all calls to `unshare -U` need to be wrapped in their own apparmor profile?