"amd64 lucid VM creation failed" with virtualized LXC build on Ubuntu 12.04.4

I got an error with gitian-builder tor-browser-builder-3.x-5 and tor-browser-bundle tbb-3.5.3-build1 when I tried an LXC build inside KVM. The i386 linux VM image built okay, but then there was a failure in building the amd64 linux image:

lxc-start: failed to spawn 'gitian'
amd64 lucid VM creation failed

(See full log in comment:1.)

I was running inside a KVM-virtualized installation of ubuntu-12.04.4-server-amd64.iso.

$ uname -a
Linux ubuntu 3.11.0-18-generic #32~precise1-Ubuntu SMP Thu Feb 20 17:52:10 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

boklm on IRC reported that they had built using virtualized LXC within the last week. They are using ubuntu-12.04.4-desktop.iso with 3.11.0-15-generic!#25 (closed)~precise1-Ubuntu. Perhaps my use of "server" rather than "desktop" makes the difference; I didn't try the "desktop" ISO. boklm said that they didn't have the Cgroup namespace: required error below.

Some web searching led me to check the output of the lxc-checkconfig command. The line that stands out as erroneous is Cgroup namespace: required. It appears red in the terminal and is the only line that appears red.

$ lxc-checkconfig
Kernel config /proc/config.gz not found, looking in other places...
Found kernel config file /boot/config-3.11.0-18-generic
--- Namespaces ---
Namespaces: enabled
Utsname namespace: enabled
Ipc namespace: enabled
Pid namespace: enabled
User namespace: missing
Network namespace: enabled
Multiple /dev/pts instances: enabled

--- Control groups ---
Cgroup: enabled
Cgroup namespace: required
Cgroup device: enabled
Cgroup sched: enabled
Cgroup cpu account: enabled
Cgroup memory controller: missing
Cgroup cpuset: enabled

--- Misc ---
Veth pair device: enabled
Macvlan: enabled
Vlan: enabled
File capabilities: enabled

Note : Before booting a new kernel, you can check its configuration
usage : CONFIG=/path/to/config /usr/bin/lxc-checkconfig

These links may be relevant:

• Bug #1191600 User namespace is not enabled in raring kernel
• Question #223671 lxc-checkconfig / Cgroup namespace: required
• Example fails on today's Ubuntu 13.04 daily

The lxc-checkconfig output may be a red herring, because after all I was able to make the i386 image. (Then again, boklm didn't have the same lxc-checkconfig error.) I tried commenting out the building of the i386 image so that the amd64 would be built first, and it still failed.

Some time back we had a problem that was resolved by removing linux-generic-lts-saucy (backported kernel from a newer Ubuntu, installed by default in 12.04.4) and replacing it with linux-generic-lts-quantal. I tried that and it didn't work.