UniFi OS - Dream Machines 3.x

[pedropombeiro]

Ubiquiti recently made 3.0.19 available in EA at https://community.ui.com/releases/UniFi-OS-Dream-Machines-3-0-19/aae685bb-4b96-4016-9125-29e57d7f2844

Known aspects of 3.x

• /data is preserved in the upgrade, but udm-boot_1.0.7_all.deb needs to be installed again;
• ssh-proxy is not present in 3.x, but manual install runs correctly;
• This release has a kernel which is compiled without CONFIG_BPF_SYSCALL (tracked in Error when trying to run pihole container on UDM SE #510), meaning podman cannot run on it without a custom kernel;
• The /etc/apt/sources.list is still pointing to stretch. It now points to bullseye.

UPDATE: I've started a discussion at https://github.com/orgs/unifi-utilities/discussions/564 to get some feedback on how the migration to 3.x went for the more adventurous users among us.

[boostchicken]

use udm-boot-2x, it does not use ssh-proxy

[boostchicken]

Did you compain to Ubi regarding apt not pointing at bullseye?

[mabunixda]

Yeah just dropped that info on the UI discussion

[boostchicken]

I havve requested the kernel sources for 3.0.19, lets see how long it takes

[marco3181]

Hello,
For the podman problem, there is this message : #510 (comment)
Seems that we can replace it with systemd-nspawn.

[marco3181]

@mabunixda : after your message on ui forum, rekoil says that his sources are pointing at bullseye. Maybe EA problem

[mabunixda]

I'd prefer a common solution that is backwards compatible about podman/docker 🤔

@marco3181 Yeah donot know ... could be EA stuff yeah

[operinko]

My /etc/apt/sources.list is properly pointing to bullseye (and have been since the start). I updated only a few hours after 3.x landed for UDM Pro in EA.

[spali]

Mine too (updates within minutes after EA announcement:

root@udmp:~# cat /etc/apt/sources.list
deb http://deb.debian.org/debian/ bullseye main contrib non-free
deb http://deb.debian.org/debian/ bullseye-updates main contrib non-free
deb http://deb.debian.org/debian/ bullseye-backports main
deb http://security.debian.org/debian-security bullseye-security main contrib non-free

[mabunixda]

Fixed it on my installation - might also be an old EA update that did not change this definitions...

[boostchicken]

See my update here

So I have not upgraded yet, but on 2.5x is overlayfs working, I expect it will work on 3 as well. So the disk space issue is now fixed @peacey

I am pretty sure I can get podman running on the UDMSE. See BPF is used for security lockdown on syscalls. We are always root anyways so it doesnt matter. I am going to drop seccomp and apparmor from the UDMP-UDMSE build and edit configs accordingly and I think that will get you in business.

Also, they new podman builds come with crun, if you want to use it. It's much better on resources. Uses less memory, and executes faster

Also, netavark is built and in the latest zips as well. This is a replacement for CNI which is now deprecated. It has cool things like macvlan dhcp working, but its not zero effort to migrate your networks, syntax of the files is quite different.

I would move to netavark ASAP. It makes containers much much much faster and much less latent on the network. It is written in Rust instead of Go (much like crun). I also included the dhcp-client-proxy if anyone wants to macvlan dhcp working.

I am not sure when I can move to 3. If someone would volunteer to test my new build for 3 build with the mods above I'll crank it out asap that would be awesome.

](#510 (comment))

[boostchicken]

systemd-nspawn

Yeah that works for the short term, I think I can get podman working see above. It's really just a matter of pulling anything bpf related. Thats all for rootless containers and we don't have to worry about it. Also make sure you do the fix for the disk space when using VFS

[boostchicken]

You know what it just dawned on the current builds should work fine on the latest 3. You just need to edit /usr/share/containers/seccomp.json and disallow any bpf syscalls, BOOM.

Beyound that you can just do this --security-opt=seccomp=unconfined in your podman command and it wont call bpf at all, no security stuff happening.

[boostchicken]

New builds coming out now with a fixxed seccomp.json that removevs bpf from the allows, also fixes some registry issues