Microsoft announced in May that the new version of Windows Subsystem for Linux 2 (WSL 2), will be running on the Linux kernel, itself running alongside the Windows kernel in Windows.
In June, the first version of WSL2 has been made available as long as you update your Windows 10 installation to the Windows Insider program, and select to receive the bleeding edge updates (fast ring).
In this post we are going to see how to get LXD running in WSL2. In a nutshell, LXD does not work out of the box yet, but LXD is versatile enough to actually make it work even when the default Linux kernel in Windows is not fully suitable yet.
Prerequisites
You need to have Windows 10, then join the Windows Insider program (Fast ring).
Then, follow the instructions on installing the components for WSL2 and switching your containers to WSL2 (if you have been using WSL1 already).
Install the Ubuntu container image from the Windows Store.
At the end, when you run wsl
in CMD.exe or in Powershell, you should get a Bash prompt.
The problems
We are listing here the issues that do not let LXD run out of the box. Skip to the next section to get LXD going.
In WSL2, there is a modified Linux 4.19 kernel running in Windows, inside Hyper-V. It looks like this is a cut-down/optimized version of Hyper-V that is good enough for the needs of Linux.
The Linux kernel in WSL2 has a specific configuration, and some of the things that LXD needs, are missing. Specifically, here is the output of lxc-checkconfig
.
ubuntu@DESKTOP-WSL2:~$ lxc-checkconfig --- Namespaces --- Namespaces: enabled Utsname namespace: enabled Ipc namespace: enabled Pid namespace: enabled User namespace: enabled Network namespace: enabled --- Control groups --- Cgroups: enabled --- Control groups --- Cgroups: enabled Cgroup v1 mount points: /sys/fs/cgroup/cpuset /sys/fs/cgroup/cpu /sys/fs/cgroup/cpuacct /sys/fs/cgroup/blkio /sys/fs/cgroup/memory /sys/fs/cgroup/devices /sys/fs/cgroup/freezer /sys/fs/cgroup/net_cls /sys/fs/cgroup/perf_event /sys/fs/cgroup/hugetlb /sys/fs/cgroup/pids /sys/fs/cgroup/rdma Cgroup v2 mount points: Cgroup v1 systemd controller: missing Cgroup v1 clone_children flag: enabled Cgroup device: enabled Cgroup sched: enabled Cgroup cpu account: enabled Cgroup memory controller: enabled Cgroup cpuset: enabled --- Misc --- Veth pair device: enabled, not loaded Macvlan: enabled, not loaded Vlan: missing Bridges: enabled, not loaded Advanced netfilter: enabled, not loaded CONFIG_NF_NAT_IPV4: enabled, not loaded CONFIG_NF_NAT_IPV6: enabled, not loaded CONFIG_IP_NF_TARGET_MASQUERADE: enabled, not loaded CONFIG_IP6_NF_TARGET_MASQUERADE: missing CONFIG_NETFILTER_XT_TARGET_CHECKSUM: missing CONFIG_NETFILTER_XT_MATCH_COMMENT: missing FUSE (for use with lxcfs): enabled, not loaded --- Checkpoint/Restore --- checkpoint restore: enabled CONFIG_FHANDLE: enabled CONFIG_EVENTFD: enabled CONFIG_EPOLL: enabled CONFIG_UNIX_DIAG: enabled CONFIG_INET_DIAG: enabled CONFIG_PACKET_DIAG: enabled CONFIG_NETLINK_DIAG: enabled File capabilities: Note : Before booting a new kernel, you can check its configuration usage : CONFIG=/path/to/config /usr/bin/lxc-checkconfig ubuntu@DESKTOP-WSL2:~$
The systemd-related mount point is OK in the sense that currently systemd does not work anyway in WSL (either WSL1 or WSL2). At some point it will get fixed in WSL2, and there are pending issues on this at Github. Talking about systemd, we cannot use yet the snap package of LXD because snapd depends on systemd. And no snapd, means no snap package of LXD.
The missing netfilter kernel modules mean that we cannot use the managed LXD network interfaces (the one with default name lxdbr0
). If you try to create a managed network interface, you will get the following error.
Error: Failed to create network 'lxdbr0': Failed to run: iptables -w -t filter -I INPUT -i lxdbr0 -p udp --dport 67 -j ACCEPT -m comment --comment generated for LXD network lxdbr0: iptables: No chain/target/match by that name.
For completeness, here is the LXD log. Notably, AppArmor is missing from the Linux kernel and there was no CGroup network class controller.
ubuntu@DESKTOP-WSL2:~$ cat /var/log/lxd/lxd.log t=2019-06-17T10:17:10+0100 lvl=info msg="LXD 3.0.3 is starting in normal mode" path=/var/lib/lxd t=2019-06-17T10:17:10+0100 lvl=info msg="Kernel uid/gid map:" t=2019-06-17T10:17:10+0100 lvl=info msg=" - u 0 0 4294967295" t=2019-06-17T10:17:10+0100 lvl=info msg=" - g 0 0 4294967295" t=2019-06-17T10:17:10+0100 lvl=info msg="Configured LXD uid/gid map:" t=2019-06-17T10:17:10+0100 lvl=info msg=" - u 0 100000 65536" t=2019-06-17T10:17:10+0100 lvl=info msg=" - g 0 100000 65536" t=2019-06-17T10:17:10+0100 lvl=warn msg="AppArmor support has been disabled because of lack of kernel support" t=2019-06-17T10:17:10+0100 lvl=warn msg="Couldn't find the CGroup network class controller, network limits will be ignored." t=2019-06-17T10:17:10+0100 lvl=info msg="Kernel features:" t=2019-06-17T10:17:10+0100 lvl=info msg=" - netnsid-based network retrieval: no" t=2019-06-17T10:17:10+0100 lvl=info msg=" - unprivileged file capabilities: yes" t=2019-06-17T10:17:10+0100 lvl=info msg="Initializing local database" t=2019-06-17T10:17:14+0100 lvl=info msg="Starting /dev/lxd handler:" t=2019-06-17T10:17:14+0100 lvl=info msg=" - binding devlxd socket" socket=/var/lib/lxd/devlxd/sock t=2019-06-17T10:17:14+0100 lvl=info msg="REST API daemon:" t=2019-06-17T10:17:14+0100 lvl=info msg=" - binding Unix socket" socket=/var/lib/lxd/unix.socket t=2019-06-17T10:17:14+0100 lvl=info msg="Initializing global database" t=2019-06-17T10:17:14+0100 lvl=info msg="Initializing storage pools" t=2019-06-17T10:17:14+0100 lvl=info msg="Initializing networks" t=2019-06-17T10:17:14+0100 lvl=info msg="Pruning leftover image files" t=2019-06-17T10:17:14+0100 lvl=info msg="Done pruning leftover image files" t=2019-06-17T10:17:14+0100 lvl=info msg="Loading daemon configuration" t=2019-06-17T10:17:14+0100 lvl=info msg="Pruning expired images" t=2019-06-17T10:17:14+0100 lvl=info msg="Done pruning expired images" t=2019-06-17T10:17:14+0100 lvl=info msg="Expiring log files" t=2019-06-17T10:17:14+0100 lvl=info msg="Done expiring log files" t=2019-06-17T10:17:14+0100 lvl=info msg="Updating images" t=2019-06-17T10:17:14+0100 lvl=info msg="Done updating images" t=2019-06-17T10:17:14+0100 lvl=info msg="Updating instance types" t=2019-06-17T10:17:14+0100 lvl=info msg="Done updating instance types" ubuntu@DESKTOP-WSL2:~$
Having said all that, let’s get LXD working.
Configuring LXD on WSL2
Let’s get a shell into WSL2.
C:\> wsl ubuntu@DESKTOP-WSL2:~$
The apt
package of LXD is already available in the Ubuntu 18.04.2 image, found in the Windows Store. However, the LXD service is not running by default and we will to start it.
ubuntu@DESKTOP-WSL2:~$ sudo service lxd start
Now we can run sudo lxd init
to configure LXD. We accept the defaults (btrfs
storage driver, 50GB default storage). But for networking, we avoid creating the local network bridge, and instead we configure LXD to use an existing bridge. The existing bridge configures macvlan
, which avoids the error, but macvlan
does not work yet anyway in WSL2.
ubuntu@DESKTOP-WSL2:~$ sudo lxd init Would you like to use LXD clustering? (yes/no) [default=no]: Do you want to configure a new storage pool? (yes/no) [default=yes]: Name of the new storage pool [default=default]: Name of the storage backend to use (btrfs, dir, lvm) [default=btrfs]: Create a new BTRFS pool? (yes/no) [default=yes]: Would you like to use an existing block device? (yes/no) [default=no]: Size in GB of the new loop device (1GB minimum) [default=50GB]: Would you like to connect to a MAAS server? (yes/no) [default=no]: Would you like to create a new local network bridge? (yes/no) [default=yes]: no Would you like to configure LXD to use an existing bridge or host interface? (yes/no) [default=no]: yes Name of the existing bridge or host interface: eth0 Would you like LXD to be available over the network? (yes/no) [default=no]: Would you like stale cached images to be updated automatically? (yes/no) [default=yes] Would you like a YAML "lxd init" preseed to be printed? (yes/no) [default=no]: yes config: {} networks: [] storage_pools: - config: size: 50GB description: "" name: default driver: btrfs profiles: - config: {} description: "" devices: eth0: name: eth0 nictype: macvlan parent: eth0 type: nic root: path: / pool: default type: disk name: default cluster: null ubuntu@DESKTOP-WSL2:~$
For some reason, LXD does not manage to mount sys
for the containers, therefore we need to perform this ourselves.
ubuntu@DESKTOP-WSL2:~$ sudo mkdir /usr/lib/x86_64-linux-gnu/lxc/sys ubuntu@DESKTOP-WSL2:~$ sudo mount sysfs -t sysfs /usr/lib/x86_64-linux-gnu/lxc/sys
The containers will not have direct Internet connectivity, therefore we need to use a Web proxy. In our case, it suffices to use privoxy
. Let’s install it. privoxy
uses by default the port 8118, which means that if the containers can somehow get access to port 8118 on the host, they get access to the Internet!
ubuntu@DESKTOP-WSL2:~$ sudo apt update ... ubuntu@DESKTOP-WSL2:~$ sudo apt install -y privoxy
Now, we are good to go! In the following we create a container with a Web server, and view it using Internet Explorer. Yes, IE has two uses, 1. to download Firefox, and 2. to view the Web server in the LXD container as evidence that all these are real.
Setting up a Web server in a LXD container in WSL2
Let’s create our first container, running Ubuntu 18.04.2. It does not get an IP address from the network because macvlan
is not working. The container has no Internet connectivity!
ubuntu@DESKTOP-WSL2:~$ lxc launch ubuntu:18.04 mycontainer Creating mycontainer Starting mycontainer ubuntu@DESKTOP-WSL2:~$ lxc list +-------------+---------+------+------+------------+-----------+ | NAME | STATE | IPV4 | IPV6 | TYPE | SNAPSHOTS | +-------------+---------+------+------+------------+-----------+ | mycontainer | RUNNING | | | PERSISTENT | 0 | +-------------+---------+------+------+------------+-----------+ ubuntu@DESKTOP-WSL2:~$
The container has no Internet connectivity, so we need to give it access to port 8118 on the host. But how can we do that, if the container does not have even network connectivity with the host? We can do this using a LXD proxy device. Run the following on the host. The command creates a proxy device called myproxy8118 that proxies the TCP port 8118 between the host and the container (the binding happens in the container because the port already exists on the host).
ubuntu@DESKTOP-WSL2:~$ lxc config device add mycontainer myproxy8118 proxy listen=tcp:127.0.0.1:8118 connect=tcp:127.0.0.1:8118 bind=container Device myproxy8118 added to mycontainer ubuntu@DESKTOP-WSL2:~$
Now, get a shell in the container and configure the proxy!
ubuntu@DESKTOP-WSL2:~$ lxc exec mycontainer bash
root@mycontainer:~# export http_proxy=http://localhost:8118/
root@mycontainer:~# export https_proxy=http://localhost:8118/
It’s time to install and start nginx
!
root@mycontainer:~# apt update ... root@mycontainer:~# apt install -y nginx ... root@mycontainer:~# service nginx start
nginx
is installed. For a finer touch, let’s edit a bit the default HTML file of the Web server so that it is evident that the Web server runs in the container. Add some text you think suitable, using the command
root@mycontainer:~# nano /var/www/html/index.nginx-debian.html
Up to now, there is a Web server running in the container. This container is not accessible by the host and obviously by Windows either. So, how can we view the website from Windows? By creating an additional proxy device. The command creates a proxy device called myproxy80 that proxies the TCP port 80 between the host and the container (the binding happens on the host because the port already exists in the container).
root@mycontainer:~# logout ubuntu@DESKTOP-WSL2:~$ lxc config device add mycontainer myproxy80 proxy listen=tcp:0.0.0.0:80 connect=tcp:127.0.0.1:80 bind=host
Finally, find the IP address of your WLS2 Ubuntu host (hint: use ifconfig
) and connect to that IP using your Web browser.

Conclusion
We managed to install LXD in WSL2 and got a container to start. Then, we installed a Web server in the container and viewed the page from Windows.
I hope future versions of WSL2 will be more friendly to LXD. In terms of the networking, there is need for more work to make it work out of the box. In terms of storage, btrfs
is supported (over a loop file) and it is fine.
3 comments
1 ping
Hey I ran in to some errors following this post – opened a issue about it here
https://github.com/microsoft/WSL/issues/5234
Author
Thanks for the bug report link.
Ubuntu 16.04 comes with LXD 2.0.x, but you can use LXD 3.0.x from the
backports
repository. Or, you can install the LXD snap package, which gives you the option for LXD 2.0, LXD 3.0 and LXD 4.0.When you upgrade from the DEB package of LXD to the snap package, you run
sudo lxd.migrate
which takes care of migrating your settings (if they exist), and also remove the old packages.Hence, in your case, if you are interested, you can file a bug report on LXD 2.0 at https://github.com/lxc/lxd/issues considering that LXD 2.0 is supported until 2024.
Does this How-To still work in august 2021 ?
[…] Xenitellis explains the way to do this on Ubuntu in this post (scroll down to near the bottom of “Configuring LXD on WSL 2”, and note that the other […]