LXD ACL Issue: Instance Listed Multiple Times

Nov 21, 2025 by Alex Johnson 46 views

Introduction

In the realm of containerization, LXD stands out as a powerful system container manager, offering a user-friendly experience with robust features. However, like any complex system, LXD can encounter issues that require investigation and resolution. This article delves into a peculiar problem where an instance is listed multiple times in the "used by" list of an Access Control List (ACL) when the instance has multiple ACLs attached. We will explore the steps to reproduce this issue, analyze the underlying causes, and discuss potential solutions.

Understanding LXD and ACLs

Before diving into the specifics of the issue, let's establish a foundational understanding of LXD and ACLs. LXD is a system container manager that allows you to run full operating systems within containers. These containers behave much like virtual machines but offer the resource efficiency and speed of containers. ACLs, on the other hand, are a critical security feature that enables you to control network access to and from your LXD instances. By defining rules within an ACL, you can specify which traffic is allowed or denied, enhancing the security posture of your container environment.

The Issue: Multiple Listings in ACL "Used By" List

The core problem we're addressing is that when an LXD instance has multiple ACLs associated with it, the "used by" list for a given ACL might show the instance listed multiple times. This is not the expected behavior, as an instance should appear only once in the "used by" list of an ACL if it is associated with that ACL. This duplication can lead to confusion and make it harder to manage and audit ACL usage within your LXD environment. The duplication occurs even if the instance is only associated with the ACL once, leading to unnecessary entries and potentially hindering administrative tasks.

Steps to Reproduce the Issue

To better understand and address this issue, it's essential to be able to reproduce it consistently. Here's a step-by-step guide to replicate the problem:

Create a Network: Begin by creating an LXD network. This network will serve as the foundation for connecting your instances. You can use the lxc network create command to create a new network. For instance, you might create a network named ovn-test.
```
lxc network create ovn-test
```
Create an Instance: Next, create an LXD instance and attach it to the network you created in the previous step. The lxc launch command is used to create instances. When creating the instance, you'll need to configure its network interface to connect to the ovn-test network. An instance configuration might include multiple network interfaces, each potentially associated with different networks or ACLs.
```
lxc launch ubuntu:24.04 able-fawn -d network=ovn-test
```
Attach an ACL to the NIC Device: Now, add an ACL to the network interface card (NIC) device of the instance. This is where you define the specific access rules for the instance's network traffic. The lxc config device set command allows you to set configuration options for devices attached to an instance, including ACLs. You can attach an existing ACL or create a new one for this purpose. Ensure that the ACL is correctly configured with the desired ingress and egress rules.
```
lxc config device set able-fawn eth-1 security.acls ADMIN-NET-Server-Access-IN
```
Call the ACL "Used By" List: Finally, call the API to retrieve the "used by" list for the ACL you attached to the instance. You can use the LXD API endpoint for network ACLs to fetch this information. The API call typically involves specifying the ACL name and project. The response will include a list of resources that are using the ACL. This is where the issue manifests, with the instance potentially appearing multiple times in the list. The API call might look like this:
```
https://localhost:8443/1.0/network-acls/ADMIN-NET-Server-Access-IN?project=default&recursion=1
```
Observe the Results: Examine the response from the API call. If the instance appears multiple times in the `