Container restart required on minor LXC upgrade?

[Christoph Lechleitner]

Hi everybody!


Question: Should running LXC containers be restarted after minor upgrades of the LXC packages (say 4.0.2 to 4.0.6)?

My actual problem is distribution specific, hence obviously not the responsibility of the LXC project, but I still would like an upstream opinion on when stopping or restarting containers is required or recommended ;-)

Thanks in advance!


Just in case someone's interested here's what I experienced and found out today:

Preliminary info: We use somewhat clustered setups where each container is visible to multiple hosts, and we manage auto-starts of containers on host reboots by other means.

For almost 2 decades now we use Debian hosts with OpenVZ respectively LXC as main virtualization technology.
Our oldest LXC 4 containers have started as OpenVZ containers and are older than LXC itself ;-)

Recently we switched some hosts to Ubuntu, and I'm starting to regret that, because:
The lxc-utils.postinst script of Ubuntu 20.04 LTS (focal) restarts the systemd unit lxc.service for *every* upgrade of LXC, in this case 4.0.2 to 4.0.6; it would do so for Ubuntu-sepcific micro upgrades too, say from 4.0.6-0ubuntu1 to 4.0.6-0ubuntu2 too.
This stops *all* running LXC containers and then starts only *some* containers, i.e. those that are configured lxc.start.auto=1.
Due to our setup mentioned above we don't use lxc.start.auto, and we have our main VPN server running in an LXC container, so I locked myself out of half the hosts and some customer containers were stopped unexpectedly too ;-(

Our Debian hosts never restarted any containers during or after any minor LXC upgrade.
This is still true for Debian 11 Bullseye which is the first Debian's with LXC 4. Bullseye is currently "testing", but it should be promoted to stable soon-ish and I'm using it on my desktops already.

So, who is right?
Is Ubuntu going too far restarting containers on any minor LXC upgrade?
Is Debian not going far enough by keeping the containers running over minor LXC upgrades?

Looking at my desktop LXC containers that were started before the last lxc upgrade simple are held by an instance of the deleted old lxc-start binary.


Thanks for any info or opinion,


Regards,

Christoph


--

Christoph Lechleitner

Geschäftsführung

------------------------------------------------------------------------
ITEG IT-Engineers GmbH | Salurner Straße 18, A-6020 Innsbruck
FN 365826f | Handelsgericht Innsbruck | Mobiltelefon: +43 676 3674710
Mail: christoph....@iteg.at | Web: http://www.iteg.at/
------------------------------------------------------------------------