systemd-nspawn in 239 fails to start older machines with user namespaces: Failed to create root cgroup hierarchy: Permission denied #10026
Description
I'm starting CentOS 7.5 machines (with systemd 219) on an Arch Linux host with systemd 239.
No machines can be started since about the update to systemd 239. The problem is with the -U (user namespace) option to systemd-nspawn:
[root@arch ~]# systemctl --version
systemd 239
+PAM -AUDIT -SELINUX -IMA -APPARMOR +SMACK -SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD -IDN2 +IDN +PCRE2 default-hierarchy=hybrid
[root@arch ~]# systemd-nspawn -bUD /home/build/qbuilder/ --network-zone=machines -M qbuilder systemd.legacy_systemd_cgroup_controller=yes
Spawning container builder on /home/build/qbuilder.
Press ^] three times within 1s to kill container.
Selected user namespace base 1649344512 and range 65536.
systemd 219 running in system mode. (+PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 -SECCOMP +BLKID +ELFUTILS +KMOD +IDN)
Detected virtualization systemd-nspawn.
Detected architecture x86-64.
Welcome to CentOS Linux 7 (Core)!
Set hostname to <qbuilder>.
Failed to read AF_UNIX datagram queue length, ignoring: No such file or directory
Failed to create root cgroup hierarchy: Permission denied
Failed to allocate manager object: Permission denied
[!!!!!!] Failed to allocate manager object, freezing.
Bug report #9563 just got closed, but suggested fix of adding systemd.legacy_systemd_cgroup_controller=yes doesn't help.
Note this was working reliably last month. Any work-arounds?