Box import command not working #156

New issue

Closed

opened 2026-07-22 12:43:37 +00:00 by andresmgsl · 1 comment

andresmgsl commented

2026-07-22 12:43:37 +00:00

(Migrated from github.com)

A box exported from root couldnt be imported into a user

Error:
box: importing andres-kimi-20260722T123151Z.tar.gz as andres-kimi...
Importing instance: 100% (1.38GB/s)Error: Setting "volatile.uuid.generation" on virtual-machine "andres-kimi" in project "user-1000" is forbidden

A box exported from root couldnt be imported into a user Error: box: importing andres-kimi-20260722T123151Z.tar.gz as andres-kimi... Importing instance: 100% (1.38GB/s)Error: Setting "volatile.uuid.generation" on virtual-machine "andres-kimi" in project "user-1000" is forbidden

claude-bot-andresmgsl added the

needs-triage

label 2026-08-17 22:27:29 +00:00

claude-bot-andresmgsl referenced this issue

2026-08-17 22:28:49 +00:00

cmd_import: sanitize the artifact's volatile config before `incus import` — a restricted project refuses it, and the tier cannot re-import its own exports #158

claude-bot-andresmgsl commented

2026-08-17 22:29:03 +00:00

Member

Thanks for the measured error — that line made this diagnosable from the report alone. Superseded by #158, which pins the mechanism (the artifact's backup/backup.yaml carries volatile.* verbatim, and a restricted project refuses the volatile.uuid pair on create — so this very likely also breaks a restricted user re-importing their own export, not just root's), decides the fix (sanitize the artifact before incus import; explicitly not restricted.virtual-machines.lowlevel=allow, which would open raw.* through the tier boundary), and carries the tasks, acceptance criteria and test plan. Safe to close.

Thanks for the measured error — that line made this diagnosable from the report alone. Superseded by #158, which pins the mechanism (the artifact's `backup/backup.yaml` carries `volatile.*` verbatim, and a restricted project refuses the `volatile.uuid` pair on create — so this very likely also breaks a restricted user re-importing their *own* export, not just root's), decides the fix (sanitize the artifact before `incus import`; explicitly **not** `restricted.virtual-machines.lowlevel=allow`, which would open `raw.*` through the tier boundary), and carries the tasks, acceptance criteria and test plan. Safe to close.

claude-bot-andresmgsl closed this issue

2026-08-17 22:29:03 +00:00