Thread: LHC@home silent task failures: boinc user missing docker and vboxusers group membership

Hi all,
Posting this as a reference for anyone who finds themselves attached to LHC@home, receiving work units, but never actually running either CMS or ATLAS tasks — with no obvious error in the BOINC event log to explain why.
The cause is almost certainly group membership. LHC@home on Linux requires the boinc system user to be a member of two groups that are not added automatically during installation and are not documented clearly in one place.

The Problem
LHC@home runs two entirely separate execution runtimes:

ATLAS tasks — run via Docker containers
CMS tasks — run via VirtualBox VMs (VBoxHeadless)

Each runtime has its own permission requirement. If the boinc system user lacks membership in the appropriate group, tasks for that runtime will silently fail to launch. BOINC receives the work unit, acknowledges it, and then does nothing with it. No computation error is logged. No failure is reported. The task simply sits until it times out and is returned to the server.
From the user's perspective this looks like a task supply problem — "LHC@home just isn't sending me work." It isn't. The work is arriving and being silently dropped.

The Diagnostic
Check what groups the boinc user currently has:
bashid boinc
Then test each runtime directly:
bash# Test Docker access
sudo -u boinc docker version 2>&1

# Test VirtualBox access
sudo -u boinc VBoxManage list vms 2>&1
A permission error on either command confirms the missing group. A clean response (even an empty list for VBoxManage) confirms access is working.

Required Group Memberships
The full set of groups the boinc system user needs for complete LHC@home functionality on a typical Linux installation:
GroupPurposeboincPrimary group — BOINC data directory accessvideoGPU accessrenderAMD/Intel GPU render accessdockerATLAS task container executionvboxusersCMS task VM execution
The docker group is typically added when Docker is installed if you follow the post-installation steps in the official Docker documentation. The vboxusers group is created by the VirtualBox installer. Neither is added to the boinc system user automatically.

The Fix
bashsudo usermod -aG docker,vboxusers boinc
Verify:
bashid boinc
Expected output should include both docker and vboxusers in the groups list.
Important: The group membership change does not take effect for the running boinc daemon until it is restarted. A full stop and start is required:
bash# Stop BOINC completely
sudo pkill boincmgr
sudo pkill boinc

# Verify everything is stopped
pgrep -a boinc

# Restart
sudo boinc --redirectio &
sleep 3
boincmgr &
After restart, re-run the diagnostic commands above to confirm both runtimes are accessible.

A Note on Running BOINC as Root
On some setups BOINC is started via sudo boinc rather than as the boinc system user. In that case the daemon runs as root and group membership is irrelevant — root bypasses group checks entirely. The group membership fix described here applies specifically when BOINC is running as the boinc system user, which is the default when using the systemd service (systemctl start boinc-client).
To confirm which user your boinc daemon is running as:
bashps aux | grep boinc | grep -v grep
The USER column will show either boinc or root.

Current Status
With both groups added and BOINC restarted, both ATLAS Docker tasks and CMS VirtualBox tasks run correctly. CMS tasks in particular went from never appearing to downloading and executing normally once the vboxusers membership was in place.
Tested on:

Kubuntu 24.04 LTS
BOINC 8.2.8
VirtualBox 7.1.16
docker-ce 29.3.0


Full documentation including scripts, systemd units, and troubleshooting history:
github.com/black-vajra/sable-boinc_admin

---