Harp Proxy Fails to Start in Proxmox 9 LXC due to Restricted Syscalls

[drybx]

Hi everybody,

I'm running Nextcloud in a a privileged LXC on Proxmox 9/Debian 13 and am running into issues deploying the HaRp Proxy.

When I run this command:

docker run \
  -e HP_SHARED_KEY="password" \
  -e NC_INSTANCE_URL="http://domain.org" \
  -e HP_EXAPPS_ADDRESS="127.0.0.1:8780" \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v "$(pwd)"/certs:/certs \
  --name appapi-harp \
  -h appapi-harp \
  --restart unless-stopped \
  --network host \
  -d ghcr.io/nextcloud/nextcloud-appapi-harp:release

the container won't start up:

AttributeError: '_UnixSelectorEventLoop' object has no attribute '_ssock'
sys:1: RuntimeWarning: coroutine 'main' was never awaited

Full log here

I already tried adding this to the configuration of my Nextcloud-LXC:

lxc.apparmor.profile: unconfined
features: nesting=1
lxc.cgroup2.devices.allow: a
lxc.cgroup.devices.allow: a
raw.lxc: |
  lxc.seccomp = 0

but that didn't help either.

When I add --security-opt apparmor=unconfined \ to the docker run command, the Harp container starts up without problems. However, then the deployment test from the Nextcloud configuration fails.

ChatGPT tells me: LXC on Proxmox 9 (Debian 13) still restricts certain kernel syscalls (e.g. socketpair()) even in a privileged container with AppArmor and Seccomp disabled. This blocks Python’s asyncio event loop and HAProxy’s CLI socket creation.

Is it possible that HaRP is not compatible with Debian 13 or generally incompatible with LXCs?

Thanks!

[oleksandr-nc]

Hello. Hard to say if it is compataible with LCX or not, it should be compatable with Privileged mode, imho.

Maybe we can focus on failing test deployement when you run it in priviliged mode.

However, then the deployment test from the Nextcloud configuration fails.

Can you share logs/configs?

[kyteinsky]

INFO: Starting Python HaProxy Agent on 127.0.0.1:8200 and 127.0.0.1:9600...
PermissionError: [Errno 13] Permission denied

maybe the apparmor setup needs to allow binding of these ports, but as Alexander said we'd be more interested in the failed test deployment logs.

[drybx]

Thanks for looking into this.

Here is the log output of the test deploy container (nc_app_test-deploy). AppApi container started with --security-opt apparmor=unconfined