1
Diagnostic step 1
Collect detailed traces across a reproduce cycle: capture 'ip -d link' and 'brctl show' output and 'dmesg -T' immediately before suspend, after resume, and after 'systemctl restart lxd' to correlate events.
FULL AI ANALYSIS
Ubuntu 22.04 host suspend/resume breaks LXD container veth interfaces — containers lose external network
Generated Oct 3, 2026, 12:35:03 AM
Analysis summary
Symptoms show the kernel-level veth bridge attachment is being disrupted by suspend/resume: either the bridge device or physical NIC reconfiguration on resume causes the kernel to drop or reassign indices for veth peers, leaving the container namespace with an orphaned endpoint. LXD recreates veth pairs at container start and registers them with the bridge; restarting LXD re-attaches correctly, so an automated reattachment of existing veths or re-creation after resume is a viable mitigation. Root causes include kernel driver bugs for veth/bridge on suspend, NetworkManager reattaching the physical NIC with new parameters that upset the bridge, or interactions with offload/ethtool features reset on resume.
Possible causes
Kernel bug in veth/bridge handling across suspend/resume causing peer interfaces to be released or indexes to change.
85%LXD bridging code relying on stable kernel state that is invalidated by firmware/driver reset during resume.
70%NetworkManager or a driver reinitialising the physical NIC on resume and flushing bridge port mappings or nftables/iptables rules used by the bridge.
30%Hardware offload (GRO, GSO) or SR-IOV VF reconfiguration on resume that changes how the host presents bridging, confusing veth attachments.
15%Suggested fixes
2
Diagnostic step 2
Test with NetworkManager fully disabled (temporary test) and configure networking using systemd-networkd or a static bridge to determine whether NetworkManager resume hooks are the trigger.
3
Diagnostic step 3
Create a systemd sleep hook: /lib/systemd/system-sleep/lxd-net-repair to run a safe sequence on resume (verify with dry-run): supervisorctl restart lxd or run 'lxc network detach/attach' for affected container ports. Keep script reversible and test on non-production containers first.
4
Diagnostic step 4
Check kernel and LXD release notes for suspend/resume veth/bridge fixes; try a newer mainline kernel in a test environment if feasible.
5
Diagnostic step 5
If logs show kernel errors referencing the veth/bridge drivers or hardware driver resets, escalate to kernel/distribution vendor with collected logs and reproduction steps; consider filing a bug with kernel maintainers if a driver-level defect is suspected.