Issue generating SystemVM SSH keys when running cloudstack-management in a Docker container

[Fr3dL]

Hello all,

I am trying to run cloudstack-management from a Docker container (ACS 4.18.1 using Ubuntu 22.04 image). Most of it is working as expected, however I cannot start the SystemVMs. I am getting this in the logs of the ACS node:
Failed to scp files to system VM due to, /root/.ssh/id_rsa.cloud (No such file or directory)

I understand that there is a script that can stop the management service to copy the SSH keys if running from a container with no privileges (/usr/share/cloudstack-common/scripts/vm/systemvm/injectkeys.sh):

# if running into Docker as unprivileges, skip ssh verification as iso cannot be mounted due to missing loop device.
if [ -f /.dockerenv ]; then
  if [ -e /dev/loop0 ]; then
    # it's a docker instance with privileges.
    copy_priv_key $newprivkey
  else
......

I would really appreciate if someone had the time to explain the process when deploying a SystemVM in 4.18.1? When and how does it mount the SystemVM on the management server (is it always using /dev/loop0)?
I am also not sure at what point this script is running (like most of the scripts in the /usr/share/cloudstack-common/scripts/vm directory ). Is it every time we deploy a SystemVM, or only when we download the ISO to the secondary storage for the first time?

Any help will be much appreciated.

[weizhouapache]

@Fr3dL
this is used to inject key to systemvm.iso, which has been deprecated since 4.16 (?)

I think it can be simplifed (to copy_priv_key $newprivkey)

[Fr3dL]

Hi Wei, thanks for your reply.

Yes you're right, I forgot it was deprecated so that is not related.

I found the root cause. I was running the cloudstack-management service as root and not with the cloud user, so it couldn't create the management id_rsa.cloud keys in /var/lib/cloudstack/management/.ssh (in Ubuntu). It's working fine now.