fix: a container does not run systemd-modules-load #51

Open

marcos-mendez wants to merge 1 commit from fix/modules-load-container into 19.x

marcos-mendez commented

2026-10-10 16:06:50 -03:00

(Migrated from github.com)

Every step 12 lean-core image booted degraded: systemd-modules-load.service failed with Failed to initialize libkmod context: Operation not supported.

Cause

The container core has no kernel and no /lib/modules (handbook decision 0052). kmod ships /etc/modules-load.d/modules.conf, which satisfies a triggering condition of the packaged unit. Its ConditionCapability=CAP_SYS_MODULE passes in the user namespace of the container, as for the units of #34.

Change

conf/turnkey.d/container-units also writes the keel-container.conf drop-in (ConditionVirtualization=!container) for systemd-modules-load.service. In a container the unit stays inactive with the condition unmet. On a VM or bare metal, which the ISO boot layer (plans/keel-boot) boots, it loads modules as before. Nothing is masked.

Tests

tests/container-units.bats: the drop-in is installed, read beside a copy of the packaged unit (tests/fixtures/systemd-modules-load.service, systemd 257.13) by systemd-analyze condition and verify; the boot layer does not touch the unit. 100 percent of the script's lines.
tests/container-units-live.bats (CI job install, booted trixie LXC container): writes a module list into /etc/modules-load.d, applies the script, and checks that systemd skips the unit on the condition and does not mark it failed.

Changelog entry in the unreleased turnkey-core-19.0 (1); COVERAGE.md section.

Every step 12 lean-core image booted `degraded`: `systemd-modules-load.service` failed with `Failed to initialize libkmod context: Operation not supported`. **Cause** The container core has no kernel and no /lib/modules (handbook decision 0052). kmod ships /etc/modules-load.d/modules.conf, which satisfies a triggering condition of the packaged unit. Its `ConditionCapability=CAP_SYS_MODULE` passes in the user namespace of the container, as for the units of #34. **Change** `conf/turnkey.d/container-units` also writes the `keel-container.conf` drop-in (`ConditionVirtualization=!container`) for `systemd-modules-load.service`. In a container the unit stays inactive with the condition unmet. On a VM or bare metal, which the ISO boot layer (plans/keel-boot) boots, it loads modules as before. Nothing is masked. **Tests** - `tests/container-units.bats`: the drop-in is installed, read beside a copy of the packaged unit (`tests/fixtures/systemd-modules-load.service`, systemd 257.13) by `systemd-analyze condition` and `verify`; the boot layer does not touch the unit. 100 percent of the script's lines. - `tests/container-units-live.bats` (CI job install, booted trixie LXC container): writes a module list into /etc/modules-load.d, applies the script, and checks that systemd skips the unit on the condition and does not mark it failed. Changelog entry in the unreleased turnkey-core-19.0 (1); COVERAGE.md section.

This pull request has changes conflicting with the target branch.