Tigervnc: Ubuntu kapsule container unrecoverable ERROR state which slowed down other container

From my KDE Linux I wanted to vnc into my old kde neon testing downstairs running Plasma 6.7.0: several weeks ago I had to switch it from Wayland to X11 because of its old nvidia graphics card.
I want a remote connection to it to copy some settings and files: rpd server on X11 is not possible, Nomachine NX I haven’t tried yet.
I chose RealVNC as the free version allows one connection from anywhere in the world to a home computer. With the help of Gemini and lots of time spent I could not make the realvnc connector viewer work in an archlinux kapsule container (that I already use for google-chrome-beta) on KDE Linux: so realvnc does not work on my kapsule incus lxc archlinux container.

I then installed tigervnc viewer 1.16.2 in an ubuntu 24.04 kapsule container (the later ubuntu versions are not incus capable) and on my kde neon tigervnc server (The tigervnc viewer on Flathub is too old).
Getting nvidia drivers working in the ubuntu container failed: there are no nvidia 610 available for ubuntu 24.04. So I ran TigerVNC via software rendering: “TigerVNC is an extremely lightweight 2D frame-buffer client.”
I think the only config needed was
this line on KDE Linux:
incus config device add kaps-ubuntu wayland proxy listen=unix:/run/user/1000/wayland-incus connect=unix:/run/user/1000/wayland-0 bind=container security.uid=1000 security.gid=1000

and then run inside the ubuntu container this command:
LIBGL_ALWAYS_SOFTWARE=1 WAYLAND_DISPLAY=wayland-incus xtigervncviewer

Gemini gave me also an ssh tunnel for it.
And the vnc connection worked ok: the only little annoyance was that I had to do ctrl+alt+Enter a few times after connecting to get the fullscreen resolution correct.
I disconnected and reconnected: it looked fine.

Some days later when I booted my KDE Linux again the ubuntu container was stuck in an ERROR state and could not be saved.
Also the starting of my other container (the archlinux one) was slowed down, then some 15 seconds later it worked. But it was impossible to stop the archlinux container.

Gemini said: “On non-Ubuntu hosts running KDE, an Ubuntu 24.04 image will instantly trigger an Invalid PID -1 crash if the host kernel’s unprivileged user namespace permissions conflict with Ubuntu’s strict defaults.
Force the container to run with absolute privileges and nesting turned on to see if it bypasses the crash
”.
I don’t know if that was the reason for the PID -1 crash.

But incus commands could not change any settings for the broken container.
Gemini tried everything, it managed to stop the archlinux container but the ubuntu one was lost.
So I had to rm -rf the files of the ubuntu container and do an incus command to remove the ubuntu container name from its database.
Then the archlinux container worked fine again.

Now I am going to make a fedora kapsule container and install tigervnc viewer on it and pray that this one will survive a reboot.

The fedora kapsule container with tigervnc viewer on it survives a reboot.

kap create kaps-fedora --image images:fedora/44 --nvidia-drivers --no-mount-home --custom-mounts /home/vat/kapsFedoraShare

The fedora container couldn’t reach a DNS server. Solution was to kill systemd-resolved entirely in the container:

sudo systemctl stop systemd-resolved systemd-resolved-monitor.socket systemd-resolved-varlink.socket
sudo systemctl disable systemd-resolved systemd-resolved-monitor.socket systemd-resolved-varlink.socket
sudo systemctl mask systemd-resolved systemd-resolved-monitor.socket systemd-resolved-varlink.socket

sudo rm -f /etc/resolv.conf
sudo vi /etc/resolv.conf

nameserver 1.1.1.1
nameserver 8.8.8.8

sudo systemctl restart systemd-networkd

sudo dnf makecache

sudo dnf install tigervnc

just running “vncviewer” in the container works.

And both my containers work ok after a cold reboot.