From 02390adff8e160b57d3fdad959081b7b511faa1b Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Sun, 7 Jun 2026 13:38:26 -0500
Subject: [PATCH] telegraf: disable PrivateMounts in containers (fix LXC
 226/NAMESPACE)

The packaged telegraf.service sets PrivateMounts=true, which requires a
mount namespace that unprivileged LXC containers cannot create, so the
service failed to start on the LXC resolver with status 226/NAMESPACE.
Drop in PrivateMounts=false, gated to container guests so VM hosts keep
the unit's hardening.
---
 ansible/roles/telegraf/tasks/main.yml | 34 +++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/ansible/roles/telegraf/tasks/main.yml b/ansible/roles/telegraf/tasks/main.yml
index df9d891..6cbcb5a 100644
--- a/ansible/roles/telegraf/tasks/main.yml
+++ b/ansible/roles/telegraf/tasks/main.yml
@@ -45,6 +45,40 @@
     state: enabled
   when: ansible_facts['os_family'] == "RedHat"
 
+# The packaged telegraf.service sets PrivateMounts=true, which needs a mount
+# namespace an unprivileged LXC container can't create (systemd exits
+# 226/NAMESPACE). Disable it only inside containers so VM hosts keep the
+# hardening.
+- name: Detect container runtime
+  ansible.builtin.set_fact:
+    telegraf_in_container: >-
+      {{ ansible_facts['virtualization_role'] == 'guest'
+         and ansible_facts['virtualization_type'] in
+         ['lxc', 'lxc-libvirt', 'systemd-nspawn', 'docker', 'podman', 'openvz'] }}
+
+- name: Create telegraf.service systemd drop-in dir (containers)
+  ansible.builtin.file:
+    path: /etc/systemd/system/telegraf.service.d
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  when: telegraf_in_container | bool
+
+- name: Disable PrivateMounts for telegraf in containers
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/telegraf.service.d/override.conf
+    content: |
+      # Managed by Ansible (roles/telegraf). Unprivileged LXC containers cannot
+      # set up the mount namespace PrivateMounts=true requires (226/NAMESPACE).
+      [Service]
+      PrivateMounts=false
+    owner: root
+    group: root
+    mode: "0644"
+  when: telegraf_in_container | bool
+  notify: Restart telegraf
+
 - name: Enable and start Telegraf
   ansible.builtin.systemd:
     name: telegraf