Ubuntu 22.04 host suspend/resume breaks LXD container veth interfaces — containers lose external network

Environment

Ubuntu 22.04 LTS host with LXD 5.12 running unprivileged LXC containers attached to an lxdbr0 bridge; host uses NetworkManager to manage physical NICs; host kernel 5.15.0-56; containers use bridged veth interfaces with predictable naming.

Symptoms

After suspending the host (s2idle) and resuming, containers retain their IPs but cannot reach the internet and cannot be reached from other hosts. 'lxc exec <container> -- ping 8.8.8.8' fails; container internal networking (lo) is fine. Restarting the container's network inside the container does not restore connectivity. Restarting the LXD daemon on the host restores network for all containers briefly, but the issue recurs on subsequent suspend/resume cycles.

Observations

On the host after resume, 'ip link' shows veth interfaces for containers present but the peer end in the container namespace appears down or the veth pairs show mismatched indexes. 'brctl show' / 'ip -d link show lxdbr0' reports the bridge is up and has ports, but traffic counters for container veth peers do not increment. dmesg contains a handful of kernel messages indicating 'veth: release' around suspend and 'device removed' during resume for the bridge. NetworkManager logs show the physical NIC reinitialised on resume and re-applied firewall/iptables rules.

Already attempted

Manually cycled container interface via 'ip link set dev eth0 down/up' inside container (no change). Restarted LXD with 'systemctl restart lxd' — network restored until next suspend. Disabled NetworkManager sleep hooks; tested both with and without NetworkManager managing the physical NIC. Updated LXD to latest stable snap; issue persists. Rebooting host fully clears the problem until next suspend.

Question

What is the most reliable and safe way to diagnose why LXD-created veth pairs become functionally detached after host resume, and how can containers' network be restored automatically without rebooting the host?

Post timeline

COMMUNITY RESPONSES

Verified community troubleshooting

0 replies

No answers yet..

Showing 0 of 0 community responses

AI DIAGNOSTICS

Incident analysis

Updated 1w ago• Trouble ID

Most likely causes

Kernel bug in veth/bridge handling across suspend/resume causing peer interfaces to be released or indexes to change. 85%

LXD bridging code relying on stable kernel state that is invalidated by firmware/driver reset during resume. 70%

NetworkManager or a driver reinitialising the physical NIC on resume and flushing bridge port mappings or nftables/iptables rules used by the bridge. 30%

Summary

Symptoms show the kernel-level veth bridge attachment is being disrupted by suspend/resume: either the bridge device or physical NIC reconfiguration on resume causes the kernel to drop or reassign indices for veth peers, leaving the container namespace with an orphaned endpoint. LXD recreates veth pairs at container start and registers them with the bridge; restarting LXD re-attaches correctly, so an automated reattachment of existing veths or re-creation after resume is a viable mitigation. Root causes include kernel driver bugs for veth/bridge on suspend, NetworkManager reattaching the physical NIC with new parameters that upset the bridge, or interactions with offload/ethtool features reset on resume.

Suggested Fixes

Diagnostic step 1

Collect detailed traces across a reproduce cycle: capture 'ip -d link' and 'brctl show' output and 'dmesg -T' immediately before suspend, after resume, and after 'systemctl restart lxd' to correlate events.

Diagnostic step 2

Test with NetworkManager fully disabled (temporary test) and configure networking using systemd-networkd or a static bridge to determine whether NetworkManager resume hooks are the trigger.

Diagnostic step 3

Create a systemd sleep hook: /lib/systemd/system-sleep/lxd-net-repair to run a safe sequence on resume (verify with dry-run): supervisorctl restart lxd or run 'lxc network detach/attach' for affected container ports. Keep script reversible and test on non-production containers first.