canonical / canonical/cloud-init
systemd circular dependency caused by cloud-init and firewalld
- Dominant language
- Python
- Stars
- 3.8k
- Forks
- 1.1k
- Avg merge
- 3d 8h
- Merged PRs (30d)
- 22
Description
# Bug report
**systemd circular dependency with cloud-init and firewalld**
Just heads up that if you have cloud-init and firewalld you'd face issue that firewalld won't start after reboot with error` Job firewalld.service/start deleted to break ordering cycle starting with network-pre.target/start`
Systemd detects this circular dependency at boot and breaks the cycle by:
1. Deleting firewalld.service/start job
2. Allowing network-pre.target to complete immediately (no firewalld to wait for)
3. Network starts → cloud-init completes → sysinit completes → basic completes
4. Boot continues, but firewalld never starts
## Steps to reproduce the problem
1. Get instance with Ubuntu 24.04 image that includes cloud-init installed.
2. Install firewalld `"apt install firewalld && systemctl enable --now firewalld`
3. Restart system/server and get firewalld down
## Environment details
- Cloud-init version: /usr/bin/cloud-init 25.2-0ubuntu1~24.04.1
- Operating System Distribution: "24.04.3 LTS (Noble Numbat)" | Linux 6.8.0-85-generic #85-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep 18 15:26:59 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
- Cloud provider, platform or installer type: DigitalOcean
## cloud-init logs
```
Oct 06 10:49:38 whatchamacallit systemd[1]: Detected virtualization kvm.
Oct 06 10:49:38 whatchamacallit systemd[1]: Detected architecture x86-64.
Oct 06 10:49:38 whatchamacallit systemd[1]: Hostname set to .
Oct 06 10:49:38 whatchamacallit systemd[1]: network-pre.target: Found ordering cycle on firewalld.service/start
Oct 06 10:49:38 whatchamacallit systemd[1]: network-pre.target: Found dependency on polkit.service/start
Oct 06 10:49:38 whatchamacallit systemd[1]: network-pre.target: Found dependency on basic.target/start
Oct 06 10:49:38 whatchamacallit systemd[1]: network-pre.target: Found dependency on sockets.target/start
Oct 06 10:49:38 whatchamacallit systemd[1]: network-pre.target: Found dependency on snapd.socket/start
Oct 06 10:49:38 whatchamacallit systemd[1]: network-pre.target: Found dependency on sysinit.target/start
Oct 06 10:49:38 whatchamacallit systemd[1]: network-pre.target: Found dependency on cloud-init.service/start
Oct 06 10:49:38 whatchamacallit systemd[1]: network-pre.target: Found dependency on systemd-networkd-wait-online.service/start
Oct 06 10:49:38 whatchamacallit systemd[1]: network-pre.target: Found dependency on systemd-networkd.service/start
Oct 06 10:49:38 whatchamacallit systemd[1]: network-pre.target: Found dependency on network-pre.target/start
Oct 06 10:49:38 whatchamacallit systemd[1]: network-pre.target: Job firewalld.service/start deleted to break ordering cycle starting with network-pre.target/start
Oct 06 10:49:38 whatchamacallit systemd[1]: Queued start job for default target graphical.target.
```
Dependency chain that creates the loop:
```
sysinit.target
↓ (After=cloud-init.service)
↓ [sysinit waits for cloud-init to complete]
↓
cloud-init.service
↓ (After=systemd-networkd-wait-online.service)
↓ [cloud-init waits for network to be online]
↓
systemd-networkd-wait-online.service
↓ (After=systemd-networkd.service)
↓ [wait-online waits for networkd to start]
↓
systemd-networkd.service
↓ (After=network-pre.target)
↓ [networkd waits for network-pre to complete]
↓
network-pre.target
↓ (After=firewalld.service)
↓ [network-pre waits for firewalld to start]
↓
firewalld.service
↓ (After=polkit.service)
↓ [firewalld waits for polkit to be ready]
↓
polkit.service
↓ (After=basic.target)
↓ [polkit waits for basic to complete]
↓
basic.target
↓ (Requires=sysinit.target)
↓ [basic REQUIRES sysinit to complete first]
↓
sysinit.target => CYCLE!
```
The dependency does not occur if:
- no firewalld but cloud-init installed
- no cloud-init but firewalld installed
Contributor guide
Research direction
Reproduce the reboot failure on the stated Ubuntu 24.04 environment with cloud-init and firewalld installed, then inspect the systemd ordering-cycle messages and the listed dependency chain using systemctl and the boot logs. Done means the dependency cycle no longer causes firewalld.service/start to be deleted and firewalld starts successfully after reboot.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux, python
- Domain
- infrastructure, operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100