From 86e55ff954284c428698bc8963e943f4d3ec08ad Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Mon, 27 Jul 2026 05:13:21 +1000 Subject: [PATCH] docs(pxe-boot): fix NFS path, clarify NFSv3/NFSv4 split, document nesting=1 requirement MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Correct the NFS path from /tank/proxmox/pxe-images to /tank/pxe-boot/images (matches variables.nix's proxmoxPxeImages.subpath) - Clarify that LXC uses NFSv3+nolock while VM uses NFSv4.2+automount - Add explicit note that lxc-pxe-boot needs features: nesting=1,mount=nfs and why: nesting=1 is required by systemd 260+ for userns/credential isolation (AppArmor denies userns_create without it), mount=nfs for NFSv3 access. pct set replaces the whole features string — include both or the container will fail to boot. Co-Authored-By: Claude Sonnet 4.6 --- docs/pxe-boot.md | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/docs/pxe-boot.md b/docs/pxe-boot.md index 5b8cc5f..4bb3347 100644 --- a/docs/pxe-boot.md +++ b/docs/pxe-boot.md @@ -39,13 +39,25 @@ The host creates these directories with systemd tmpfiles: /srv/pxe/tftp ``` -`/srv/pxe/http/images` is a symlink to `/mnt/pxe-images`, which is an NFSv4.2 -mount of `server.sweet.home:/tank/proxmox/pxe-images` +`/srv/pxe/http/images` is a symlink to `/mnt/pxe-images`, which is an NFS +mount of `server.sweet.home:/tank/pxe-boot/images` (`modules/pxe-boot/mount-pxe-images.nix`). Place large images there (ISOs, disk images) rather than on the pxe-boot host's own root disk. For an LXC -pxe-boot container the mount uses `nofail` (eager, non-blocking on server -unavailability); for a Proxmox VM it uses `x-systemd.automount` (lazy, -triggered on first access). +pxe-boot container the mount uses NFSv3+nolock with `nofail` (eager, +non-blocking on server unavailability); for a Proxmox VM it uses NFSv4.2 +with `x-systemd.automount` (lazy, triggered on first access). + +When running as `lxc-pxe-boot`, the Proxmox container must have +`features: nesting=1,mount=nfs` (at minimum) in its Proxmox config. `nesting=1` +is required by systemd 260+ for credential isolation (user namespace creation +and internal move-mounts); without it, AppArmor denies both, and every +systemd service that uses `PrivateUsers`, `PrivateDevices`, or credential +passing fails on boot. `mount=nfs` allows the NFSv3 mount. Both are set +automatically by `scripts/proxmox/create-proxmox-resource.sh` (via +`PROXMOX_DEFAULT_LXC_FEATURES` in `scripts/env.sh` which defaults to +`nesting=1,keyctl=1,mount=nfs;nfs4`). If you ever change these features +manually via `pct set`, be sure to include both — `pct set` replaces the +entire features string, it does not append to it. The HTTP iPXE chain is: @@ -121,7 +133,7 @@ The SystemRescue entry expects the source ISO at: ``` Since `/srv/pxe/http/images` is the NFS-backed symlink, place the ISO on the -NFS share at `server.sweet.home:/tank/proxmox/pxe-images/systemrescue.iso`. +NFS share at `server.sweet.home:/tank/pxe-boot/images/systemrescue.iso`. The `stage-systemrescue.service` oneshot extracts that ISO into: