I tried many times, on various Ubuntu machines: the dhcpd executable (installed in /usr/sbin/dhcpd via package isc-dhcp-server) inside the LXC container seemingly the only thing it does, when executed from command line, is to exit with exit code 1.

I want to execute the program manually to get interactive error messages and debug problems in the configuration.

For instance, when executing $ dhcpd --version I would expect to have at least version like on host

$ dhcpd --version

Inside the LXC container (but not in VirtualBox) the dhcpd always outputs nothing to stdout, regardless of the command line options.


I have compared the output of running strace dhcpd --version on both LXC container and the host. There is only one difference, at the very end of the output. On LXC guest:

connect(3, {sa_family=AF_UNIX, sun_path="/dev/log"}, 110) = 0
write(2, "isc-dhcpd-", 10)              = -1 EACCES (Permission denied)
write(2, "4.3.5", 5)                    = -1 EACCES (Permission denied)
write(2, "\n", 1)                       = -1 EACCES (Permission denied)
futex(0x7f2637e2882c, FUTEX_WAKE_PRIVATE, 2147483647) = 0
exit_group(0)                           = ?
+++ exited with 0 +++

While on the host analogous part reads:

connect(3, {sa_family=AF_UNIX, sun_path="/dev/log"}, 110) = 0
write(2, "isc-dhcpd-", 10isc-dhcpd-)              = 10
write(2, "4.3.5", 54.3.5)                    = 5
write(2, "\n", 1
)                       = 1
futex(0x7f95cadac82c, FUTEX_WAKE_PRIVATE, 2147483647) = 0
exit_group(0)                           = ?
+++ exited with 0 +++

I filled the issue against LXD about this problem, see https://github.com/lxc/lxd/issues/5378


Try running "strace dhcpd --version" to see if this gives more info.


write(2, "isc-dhcpd-", 10)              = -1 EACCES (Permission denied)

This means that the process can't write to STDERR (file descriptor 2).

Congratulations, you have actually hit Ubuntu bug 1641236 or 1667016 Quoting from lxc issue 2930

You do have a few workarounds available though: Using ssh instead of "lxc exec" should work fine (as ssh will allocate its own pts pair) Using "lxc exec" and then running a "script" session should have the same effect as ssh You can turn off the tcpdump apparmor profile by symlinking the profile to /etc/apparmor.d/disable/ then reload apparmor in the container (or reboot it).

The last workaround seems to be working for both bugs

ln -s /etc/apparmor.d/usr.sbin.dhcpd /etc/apparmor.d/disable/
  • Nice insight. Never used strace before. I found some differences, and I will update the answer – Adam Ryczkowski Dec 21 '18 at 13:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.