From e94f0e47d742f3c8f228bf21907954008ade7ba0 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Tue, 1 Sep 2026 09:39:03 +0200 Subject: image: T9269: skip GRUB updates on container and diskless systems Kernel cmdline and serial console updates rewrite the GRUB configuration on the persistence partition. A container has no GRUB at all, and on a system where the persistence partition is not mounted disk.find_persistence() returns an empty string, so the code reads '//boot/grub/grub.cfg' and dies with FileNotFoundError. Extend is_running_as_container() to also honor /run/.containerenv (Podman) and the container= variable systemd sets for PID 1, and add if_not_container() plus if_persistence() decorators guarding all grub_util entry points. --- python/vyos/system/grub_util.py | 8 ++++++++ python/vyos/system/image.py | 45 ++++++++++++++++++++++++++++++++++++++++- 2 files changed, 52 insertions(+), 1 deletion(-) diff --git a/python/vyos/system/grub_util.py b/python/vyos/system/grub_util.py index edaea8ad3..98d3c1ddc 100644 --- a/python/vyos/system/grub_util.py +++ b/python/vyos/system/grub_util.py @@ -18,6 +18,8 @@ from vyos.system import grub from vyos.system import image from vyos.system import compat +@image.if_not_container +@image.if_persistence @compat.grub_cfg_update def set_serial_console(console_type: str, console_num: str, console_speed: str, root_dir: str = '') -> None: @@ -34,6 +36,8 @@ def set_serial_console(console_type: str, console_num: str, grub.set_serial_console(console_type, console_num, console_speed, root_dir) @image.if_not_live_boot +@image.if_not_container +@image.if_persistence def update_serial_console(console_type: str, console_num: str, console_speed: str, root_dir: str = '') -> None: """Update console_speed if different from current value""" @@ -53,6 +57,8 @@ def update_serial_console(console_type: str, console_num: str, console_speed != console_speed_current: set_serial_console(console_type, console_num, console_speed, root_dir) +@image.if_not_container +@image.if_persistence @compat.grub_cfg_update def set_kernel_cmdline_options(cmdline_options: str, version: str = '', root_dir: str = '') -> None: @@ -66,6 +72,8 @@ def set_kernel_cmdline_options(cmdline_options: str, version: str = '', grub.set_kernel_cmdline_options(cmdline_options, version, root_dir) @image.if_not_live_boot +@image.if_not_container +@image.if_persistence def update_kernel_cmdline_options(cmdline_options: str, root_dir: str = '', version = image.get_running_image()) -> None: diff --git a/python/vyos/system/image.py b/python/vyos/system/image.py index 02f2303b2..0b2eccf6d 100644 --- a/python/vyos/system/image.py +++ b/python/vyos/system/image.py @@ -283,6 +283,49 @@ def if_not_live_boot(func): return wrapper def is_running_as_container() -> bool: - if Path('/.dockerenv').exists(): + """Detect if the system is running inside a container + + Returns: + bool: True if running as container (Docker, Podman, LXC, ...) + """ + # Docker and Podman drop a marker file into the container root + if Path('/.dockerenv').exists() or Path('/run/.containerenv').exists(): return True + # systemd sets container= in the environment of PID 1 for all container + # types it knows about - this is only readable by root + try: + environ = Path('/proc/1/environ').read_bytes().decode(errors='ignore') + if 'container=' in environ: + return True + except (OSError, PermissionError): + pass return False + +def has_persistence() -> bool: + """Detect if a persistence storage partition is mounted + + Returns: + bool: True if the persistence partition is available + """ + return bool(disk.find_persistence()) + +def if_persistence(func): + """Decorator to call function only if persistence storage is available. + Without it there is no writeable GRUB configuration to operate on""" + @wraps(func) + def wrapper(*args, **kwargs): + if has_persistence(): + ret = func(*args, **kwargs) + return ret + return None + return wrapper + +def if_not_container(func): + """Decorator to call function only if not running inside a container""" + @wraps(func) + def wrapper(*args, **kwargs): + if not is_running_as_container(): + ret = func(*args, **kwargs) + return ret + return None + return wrapper -- cgit v1.2.3 From 322db61ed0b8c2fa69a178a4ecc14a8d356cb09c Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Tue, 1 Sep 2026 09:39:44 +0200 Subject: version: T9269: report "container" as system type A container shares the Kernel with its host and inherits its DMI and CPUID data, thus hvinfo reports the hypervisor of the host system - a VyOS container on a KVM host was described as "KVM guest". Check is_running_as_container() first and report "container", otherwise fall back to hvinfo as before. Note that boot_via and the hardware vendor, model, serial and UUID fields are still derived from the host. --- python/vyos/version.py | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/python/vyos/version.py b/python/vyos/version.py index 4288a26ff..f949d588a 100644 --- a/python/vyos/version.py +++ b/python/vyos/version.py @@ -71,18 +71,24 @@ def get_full_version_data(fname=version_file): # vyos.system.grub -> vyos.template -> jinja2, which every consumer of # vyos.version would otherwise pay for on import. from vyos.system.image import is_live_boot + from vyos.system.image import is_running_as_container version_data = get_version_data(fname) # Get system architecture (well, kernel architecture rather) version_data['system_arch'], _ = popen('uname -m', stderr=DEVNULL) - hypervisor,code = popen('hvinfo', stderr=DEVNULL) - if code == 1: - # hvinfo returns 1 if it cannot detect any hypervisor - version_data['system_type'] = 'bare metal' + # A container shares the Kernel with - and inherits the DMI/CPUID data of - + # its host, thus hvinfo would report the hypervisor of the host system + if is_running_as_container(): + version_data['system_type'] = 'container' else: - version_data['system_type'] = f"{hypervisor} guest" + hypervisor,code = popen('hvinfo', stderr=DEVNULL) + if code == 1: + # hvinfo returns 1 if it cannot detect any hypervisor + version_data['system_type'] = 'bare metal' + else: + version_data['system_type'] = f"{hypervisor} guest" # Get boot type, it can be livecd or installed image # In installed images, the squashfs image file is named after its image version, -- cgit v1.2.3 From dd7962cdcfb60ad6e57a5b041d91e0d1707d7e96 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Tue, 1 Sep 2026 08:07:22 +0000 Subject: op-mode: T9269: report Secure Boot as "n/a (container)" A container is not booted by any firmware, so neither the UEFI nor the BIOS wording applies. Worse, is_uefi_system() probes /sys/firmware/efi which a container inherits from its host, thus a container on a UEFI host reported the Secure Boot state of that host. Check is_running_as_container() first and report "n/a (container)", leaving the UEFI and BIOS detection untouched for everything else. --- src/op_mode/version.py | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/src/op_mode/version.py b/src/op_mode/version.py index b93e3081b..d6d8aaca1 100755 --- a/src/op_mode/version.py +++ b/src/op_mode/version.py @@ -26,6 +26,7 @@ import vyos.version import vyos.limericks from vyos.utils.boot import is_uefi_system +from vyos.system.image import is_running_as_container from vyos.utils.system import get_secure_boot_state from jinja2 import Template @@ -61,11 +62,16 @@ Copyright: VyOS maintainers and contributors def _get_raw_data(funny=False): version_data = vyos.version.get_full_version_data() - version_data["secure_boot"] = "n/a (BIOS)" - if is_uefi_system(): - version_data["secure_boot"] = "disabled" - if get_secure_boot_state(): - version_data["secure_boot"] = "enabled" + # A container has no firmware of its own - it is not booted at all, thus + # neither the UEFI nor the BIOS wording applies + if is_running_as_container(): + version_data["secure_boot"] = "n/a (container)" + else: + version_data["secure_boot"] = "n/a (BIOS)" + if is_uefi_system(): + version_data["secure_boot"] = "disabled" + if get_secure_boot_state(): + version_data["secure_boot"] = "enabled" if funny: version_data["limerick"] = vyos.limericks.get_random() -- cgit v1.2.3 From 38fbaed5dec555b83590e2bddc1ad18418a87038 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Tue, 1 Sep 2026 08:08:17 +0000 Subject: version: T9269: report "container image" as boot type A container is never booted on its own - is_live_boot() parses the Kernel cmdline of the host system, which on an installed host contains a BOOT_IMAGE pointing to /boot//vmlinuz. A container was thus reported to be running from an "installed image". Report "container image" for containers and keep the livecd against installed image distinction for everything else. --- python/vyos/version.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/python/vyos/version.py b/python/vyos/version.py index f949d588a..dcaec8817 100644 --- a/python/vyos/version.py +++ b/python/vyos/version.py @@ -90,11 +90,15 @@ def get_full_version_data(fname=version_file): else: version_data['system_type'] = f"{hypervisor} guest" - # Get boot type, it can be livecd or installed image + # Get boot type, it can be a container, livecd or installed image # In installed images, the squashfs image file is named after its image version, # while on livecd it's just "filesystem.squashfs", that's how we tell a livecd boot # from an installed image - if is_live_boot(): + if is_running_as_container(): + # A container is never booted on its own - is_live_boot() would parse the + # Kernel cmdline of the host system + boot_via = "container image" + elif is_live_boot(): boot_via = "livecd" else: boot_via = "installed image" -- cgit v1.2.3 From 5d9481d4f315c5e6296e374904d2f22768b995ec Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Tue, 1 Sep 2026 08:10:36 +0000 Subject: version: T9269: omit hardware details on containers A container has no hardware of its own - vendor, model, serial and UUID are read from /sys/class/dmi/id and thus describe the host system. Listing them below "System type: container" reads as a property of the node. Leave the hardware_* keys unset when running as a container and omit the entire block in both "show version" and the airbag bug report. The latter moves the fields into an optional HARDWARE section, as str.format() has no conditionals. --- python/vyos/airbag.py | 14 +++++++++++--- python/vyos/version.py | 21 ++++++++++++--------- src/op_mode/version.py | 2 ++ 3 files changed, 25 insertions(+), 12 deletions(-) diff --git a/python/vyos/airbag.py b/python/vyos/airbag.py index 69b44dc9d..4e7bdfd06 100644 --- a/python/vyos/airbag.py +++ b/python/vyos/airbag.py @@ -78,8 +78,13 @@ def bug_report(dtype, value, trace): note = 'noteworthy:\n' note += '\n'.join(list(_noteworthy)) + hardware = '' + if 'hardware_vendor' in information: + hardware = HARDWARE.format(**information) + information.update({ 'date': datetime.now().strftime('%Y-%m-%d %H:%M:%S'), + 'hardware': hardware, 'trace': trace, 'instructions': INSTRUCTIONS, 'note': note, @@ -141,14 +146,17 @@ Build commit ID: {build_git} Architecture: {system_arch} Boot via: {boot_via} System type: {system_type} +{hardware} +{trace} +{note} +""" +# Optional section of FAULT - a container has no hardware of its own +HARDWARE = """ Hardware vendor: {hardware_vendor} Hardware model: {hardware_model} Hardware S/N: {hardware_serial} Hardware UUID: {hardware_uuid} - -{trace} -{note} """ INTRO = """\ diff --git a/python/vyos/version.py b/python/vyos/version.py index dcaec8817..50359ddf6 100644 --- a/python/vyos/version.py +++ b/python/vyos/version.py @@ -104,15 +104,18 @@ def get_full_version_data(fname=version_file): boot_via = "installed image" version_data['boot_via'] = boot_via - # Get hardware details from DMI - dmi = '/sys/class/dmi/id' - version_data['hardware_vendor'] = read_file(dmi + '/sys_vendor', 'Unknown') - version_data['hardware_model'] = read_file(dmi +'/product_name','Unknown') - - # These two assume script is run as root, normal users can't access those files - subsystem = '/sys/class/dmi/id/subsystem/id' - version_data['hardware_serial'] = read_file(subsystem + '/product_serial','Unknown') - version_data['hardware_uuid'] = read_file(subsystem + '/product_uuid', 'Unknown') + # Get hardware details from DMI - a container has no hardware of its own and + # would report the DMI data of the host system, thus the keys are left unset + # and consumers are expected to omit them + if not is_running_as_container(): + dmi = '/sys/class/dmi/id' + version_data['hardware_vendor'] = read_file(dmi + '/sys_vendor', 'Unknown') + version_data['hardware_model'] = read_file(dmi +'/product_name','Unknown') + + # These two assume script is run as root, normal users can't access those files + subsystem = '/sys/class/dmi/id/subsystem/id' + version_data['hardware_serial'] = read_file(subsystem + '/product_serial','Unknown') + version_data['hardware_uuid'] = read_file(subsystem + '/product_uuid', 'Unknown') return version_data diff --git a/src/op_mode/version.py b/src/op_mode/version.py index d6d8aaca1..bc74f83fc 100755 --- a/src/op_mode/version.py +++ b/src/op_mode/version.py @@ -48,11 +48,13 @@ Architecture: {{system_arch}} Boot via: {{boot_via}} System type: {{system_type}} Secure Boot: {{secure_boot}} +{%- if hardware_vendor is defined %} Hardware vendor: {{hardware_vendor}} Hardware model: {{hardware_model}} Hardware S/N: {{hardware_serial}} Hardware UUID: {{hardware_uuid}} +{%- endif %} Copyright: VyOS maintainers and contributors {%- if limerick %} -- cgit v1.2.3 From faeace4a37d890e9bfa1bc6b4584d0994853fb37 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Tue, 1 Sep 2026 09:01:37 +0000 Subject: utils: T9269: do not leak sysctl(8) errors to stderr sysctl_write() reports success through its return code, but the underlying sysctl(8) call inherited stderr. net.ipv4.neigh.default.gc_thresh* is not network namespace aware, so a container printed six "cannot stat ... No such file or directory" lines on every boot. Capture the output and keep the return code as the only interface to the caller. --- python/vyos/utils/system.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/python/vyos/utils/system.py b/python/vyos/utils/system.py index fd32a486a..7cc6919a4 100644 --- a/python/vyos/utils/system.py +++ b/python/vyos/utils/system.py @@ -50,8 +50,12 @@ def sysctl_write(name: list[str], value: str | int) -> bool: # do not change anything if a value is already configured if sysctl_read(name) == value: return True - # return False if sysctl call failed - if run(['sysctl', '-wq', f'{key}={value}']).returncode != 0: + # return False if sysctl call failed - stderr is captured as the return + # code is the interface to the caller. A key may legitimately not exist, + # e.g. net.ipv4.neigh.default.gc_thresh* is not network namespace aware + # and thus not available when running inside a container + if run(['sysctl', '-wq', f'{key}={value}'], + capture_output=True).returncode != 0: return False # compare old and new values # sysctl may apply value, but its actual value will be -- cgit v1.2.3 From 2faaa23085bd5beee1ed1b8a63dfa5be84375841 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Tue, 1 Sep 2026 09:01:37 +0000 Subject: system-option: T9269: no Kernel cmdline warning on containers A container shares the Kernel with its host and does not own the Kernel cmdline, so the requested options never compare equal to /proc/cmdline. Every commit thus asked the user to save the configuration and reboot, which would not apply anything at all. Never treat a kexec as required when running as a container. --- src/conf_mode/system_option.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/conf_mode/system_option.py b/src/conf_mode/system_option.py index 190db232d..6e7ced37a 100755 --- a/src/conf_mode/system_option.py +++ b/src/conf_mode/system_option.py @@ -600,6 +600,11 @@ def generate_cmdline_for_kexec(options): def apply(options): kexec_required, cmdline_new = generate_cmdline_for_kexec(options) + # T9269: a container does not own the Kernel cmdline - it belongs to the + # host system, thus neither kexec nor a reboot would apply anything and the + # options always compare as changed + if image.is_running_as_container(): + kexec_required = False if kexec_required: if not boot_configuration_complete() and os.getenv('VYOS_CONFIGD'): cmdl([ -- cgit v1.2.3