stage1-host doesn't run containers: failed to execute "--notify-ready=yes"

[akermu]

Environment

rkt Version: 1.15.0
appc Version: 0.8.7
Go Version: go1.7.1
Go OS/Arch: linux/amd64
Features: -TPM +SDJOURNAL
--
Linux 4.7.4-1-ARCH x86_64
--
NAME="Arch Linux"
ID=arch
PRETTY_NAME="Arch Linux"
ANSI_COLOR="0;36"
HOME_URL="https://www.archlinux.org/"
SUPPORT_URL="https://bbs.archlinux.org/"
BUG_REPORT_URL="https://bugs.archlinux.org/"
--
systemd 231
+PAM -AUDIT -SELINUX -IMA -APPARMOR +SMACK -SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD +IDN

What did you do?

I tried to run the nginx-latest-linux-amd64.aci build with this example.

What did you expect to see?

A running container.

What did you see instead?

image: using image from local store for image name coreos.com/rkt/stage1-host:1.15.0
image: using image from file ./nginx-latest-linux-amd64.aci
image: using image from local store for image name quay.io/coreos/alpine-sh
networking: loading networks from /etc/rkt/net.d
networking: loading network default with type ptp
stage1: warning: no volume specified for mount point "html", implicitly creating an "empty" volume. This volume will be removed when the pod is garbage-collected.
stage1: warning: no volume specified for mount point "html", implicitly creating an "empty" volume. This volume will be removed when the pod is garbage-collected.
stage1: failed to execute "--notify-ready=yes": no such file or directory

[lucab]

Thanks @akermu! As you already noticed, this is due to wrong argument ordering when building the command-line for systemd-nspawn.
As a side note, this only affects stage1-host flavors on those distributions that are shipping with systemd >= v231. A workaround is for users to use the prebuilt stage1s (ie. stage1-coreos) and for downstream distributors to temporarily cherry-pick the patch at #3216.

/cc @onlyjob