http://www.linux-vserver.org/api.php?action=feedcontributions&user=AdrianReyer&feedformat=atomLinux-VServer - User contributions [en]2024-03-28T10:07:36ZUser contributionsMediaWiki 1.20.2http://www.linux-vserver.org/Frequently_Asked_QuestionsFrequently Asked Questions2012-10-22T17:30:19Z<p>AdrianReyer: </p>
<hr />
<div><div style="margin: 2em auto 2em auto; padding: 10px; background-color: #F9ECCD; border: 1px solid #004433; text-align: center;"><br />
[[Image:Icon-Caution.png|left]]<br />
We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the [[Wiki Team]] page for instructions how to help or look at the [http://oldwiki.linux-vserver.org old wiki] to find the information not migrated yet.<br />
<br />
'''To ease migration we created a [[List of old Documentation pages]].'''<br />
</div><br />
<br />
CURRENTLY THE CONTENT OF THE OLD WIKI FAQ (AND MORE) IS BEING MIGRATED TO THIS PAGE (TASK: DERJOHN)<br />
<br />
<br />
__TOC__<br />
<br />
== General ==<br />
<br />
{{Question<br />
|Question=What is the status of Linux-VServer?<br />
||Details=Linux-VServer has more than a decade of maturity and is actively developed. Two projects are similar to Linux-VServer, [[http://lxc.sf.net LXC]], and [[http://openvz.org OpenVZ]]. Of the two, OpenVZ is the more mature and offers some similar functionality to Linux-VServer. LXC is solely based on the kernel mechanisms such as cgroups that are present in modern kernels. These kernel mechanisms will continue to be refined and isolation will mature. As that occurs, Linux-VServer will take advantage of those new features separately from LXC and continue to provide the same robust user interface that it does currently. Currently, LXC offers significantly less functionality and isolation than Linux-vserver. LXC will eventually be a robust wrapper around kernel mechanisms but is still under heavy development and not considered ready for production use.<br />
|Signature=beck}}<br />
<br />
<br />
<br />
{{Question<br />
|Question=What is a 'Guest'?<br />
||Details=To talk about stuff, we need some naming. The physical machine is called 'Host' and the 'main' context running the Host Distro is called 'Host Context'. The virtual machine/distro is called 'Guest' and basically is a Distribution (Userspace) running inside a 'Guest Context'.<br />
|Signature=derjohn}}<br />
<br />
<br />
{{Question<br />
|Question=What kind of Operating System (OS) can I run as guest?<br />
||Details= With VServer you can only run Linux guests. The trick is that a guest does not run a kernel on its own (as XEN and UML do), it merely uses a virtualized host kernel-interface. VServer offers so called security contexts which make it possible to separate one guest from each other, i.e. they cannot get data from each other. Imagine it as a chroot environment with much more security and features.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Is this a new project? When was it started?<br />
||Details=The first public occurrence of Linux-VServer was Oct 2001. The initial mail can be found here: http://www.cs.helsinki.fi/linux/linux-kernel/2001-40/1065.html<br />
So you can expect a mature software product which does its magic quite well (And hey, we have a version > 2.0!)<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Which distributions did you test?<br />
||Details=Some. Check out the wiki for ready-made guest images. But you can easily build own guest images, e.g. with Debian's debootstrap. Checkout [[Building Guest Systems]] how to do that.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Is VServer comparable to XEN/UML/QEMU?<br />
||Details=Nope. XEN/UML/QEMU and VServer are just good friends. Because you ask, you probably know what XEN/UML/QEMU are. VServer in contrary to XEN/UML/QEMU does not "emulate" any hardware you run a kernel on. The purpose of Linux VServer is to isolate (groups of) applications. The isolation is done by the kernel (see [[Overview]] for a more detailed comparison). You can run a VServer kernel in a XEN/UML/QEMU guest. This is confirmed to work at least with Linux 2.6/vs2.0.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=With which version should I begin?<br />
||Details=If you are new to VServer I recommend to try the latest stable kernel patch, and the latest util-vserver "alpha" release.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Is VServer secure?<br />
||Details=We hope so. It should be as least as secure as Linux is. We consider it much much more secure though.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Performance?<br />
||Details=For a single guest, we basically have native performance. Some tests showed insignificant overhead (about 1-2%) others ran faster than on an unpatched kernel. This is IMVHO significantly less than other solutions waste, especially if you have more than a single guest (because of the resource sharing).<br />
|Signature=derjohn}}<br />
<br />
<br />
{{Question<br />
|Question=What is the "great flower page"?<br />
||Details=Well, [http://www.nongnu.org/util-vserver/doc/conf/configuration.html this page] contains all configuration options for util-vserver. The name of the page is derived from the stylesheet(s) it contains.<br />
|Signature=derjohn}}<br />
<br />
<br />
<br />
== Resources usage ==<br />
<br />
{{Question<br />
|Question=Resource sharing?<br />
||Details=Yes ....<br />
* memory: Dynamically.<br />
* CPU usage: Dynamically (token bucket)<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Resource limiting?<br />
||Details=You can put limits per guest on different subsystems.<br />
* using ulimits and rlimits (rlimit is a new feature of kernel 2.6/vs2.0.) per guest, to limit the memory consumption, the number of processes or file-handles, ... : see [[Resource Limits]]<br />
* CPU usage : see [[CPU Scheduler]]<br />
* disk space usage : see [[Disk Limits and Quota]]<br />
Note that you can only offer guaranteed resource availability with some ticks at the time.<br />
|Signature=derjohn&xm}}<br />
<br />
{{Question<br />
|Question=How do I limit a guests RAM? I want to prevent OOM situations on the host!<br />
||Details=First you can read [http://linux-vserver.org/Memory+Allocation] and [[Memory Limits]].<br />
If you want a recipe, do this:<br />
# Check the size of memory pages. On x86 and x86_64 is usually 4 KB per page. (on linux "getconf -a|grep PAGE" will give you the information)<br />
# Create /etc/vserver/<guest>/rlimits/<br />
# Check your physical memory size on the host, e.g. with "free -m". maxram = kilobytes/pagesize.<br />
# Limit the guests physical RAM to value smaller then maxram:<pre>echo %%insertYourPagesHereSmallerThanMaxram%% > /etc/vserver/<guest>/rlimits/rss </pre><br />
# Check your swapspace, e.g. with 'swapon -s'. maxswap = swapkilobytes/pagesize.<br />
# Limit the guest's maximum number of as pages to a value smaller than (maxram+maxswap): <pre> echo %%desiredvalue%% > /etc/vserver/<guest>/rlimits/as </pre><br />
# Correctly display the memory information inside the guest:<pre>echo "VIRT_MEM" >> /etc/vservers/<guest>/flags</pre><br />
It should be clear this can still lead to OOM situations. Example: You have two guests and your as limit per guest is greater than 50% of (maxram+maxswap). If both guests request their maximum at the same point in time, there will be not enough mem .....<br />
|Signature=derjohn}}<br />
<br />
<br />
{{Question<br />
|Question=Disk I/O limiting? Is that possible?<br />
||Details=Well, since vs2.1.1 Linux-VServer supports a mechanism called 'I/O scheduling', which appeared in the 2.6 mainline some time ago. The mainline kernel offers several I/O schedulers:<br />
<pre><br />
# cat /sys/block/hdc/queue/scheduler<br />
noop [anticipatory] deadline cfq<br />
</pre><br />
<br />
The default since 2.6.18 in Sept 2006 is CFQ, described below, and prior to that was anticipatory a.k.a. "AS" ([[http://en.wikipedia.org/wiki/CFQ#Kernel_2.6.18_.2820_September_2006.29 Wikipedia]]). When running several guests on a host you probably want the I/O performance shared in a fair way among the different guests. The kernel comes with a "completely fair queueing" scheduler, CFQ, which can do that. (More on schedulers can be found at http://lwn.net/Articles/114770/)<br />
This is how to set the scheduler to "cfq" manually:<br />
<pre><br />
root# echo "cfq" > /sys/block/hdc/queue/scheduler<br />
root# cat /sys/block/hdc/queue/scheduler<br />
noop anticipatory deadline [cfq]<br />
</pre><br />
Keep in mind that you have to do it on all physical discs. So if you run an md-softraid, do it to all physical /dev/hdXYZ discs!<br />
If you run Debian there is a predefined way to set the /sys values at boot-time:<br />
<pre><br />
# apt-get install sysfsutils<br />
[...]<br />
<br />
# grep cfq /etc/sysfs.conf<br />
block/sda/queue/scheduler = cfq<br />
block/sdc/queue/scheduler = cfq<br />
<br />
# /etc/init.d/sysfsutils restart<br />
</pre><br />
<br />
For non-vserver processes and CFQ you can set by which key the kernel decides about the fairness:<br />
<pre><br />
cat /sys/block/hdc/queue/iosched/key_type<br />
pgid [tgid] uid gid<br />
</pre><br />
Hint: The 'key_type'-feature has been removed in the mainline kernel recently. Don't look for it any longer :(<br />
<br />
The default is tgid, which means to share fairly among process groups. Think every guest is treated like a own process group. It's not possible to set a scheduler strategy within a guest. All processes belonging to the same guest are treated like "noop" within the guest. So: If you run apache and some ftp-server within the _same_ guest, there is no fair scheduling between them, but there is fair scheduling between the whole guest and all other guests.<br />
<br />
And: It's possible to tune the scheduler parameters in several ways. Have a look at /sys/block/hdc/queue/....<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Nice disk I/O scheduling, is that possible?<br />
||Details=Well, since linux 2.6.13 processess have another priority next to the cpu nice scheduling hint, it's called io nice.<br />
It's split into three groups, called real-time, best effort and idle. The default is best-effort, but within best-effort, you can have a niceness from 0 to and including 7.<br />
You can set this niceness by the tool ionice, which for debian is either in the package util-linux or schedutils.<br />
To change the io-niceness you need the <tt>CAP_SYS_NICE</tt>, '''and''' need to have the same uid as the processe you want to ionice.<br />
<br />
:'''Note:''' If you want to use any schedulung other than best-effort you will also need the <tt>CAP_SYS_ADMIN</tt>-flag. Be warned that this gives quite some capabilities to the vserver, not just for I/O scheduling!<br />
<br />
If you want to increase the niceness of an I/O hogging process within a vserver you need to do:<br />
<PRE><br />
chcontext --xid sponlp1 sudo -u '#2089' ionice -c2 -n5 -p24409<br />
</PRE><br />
with sudo and ionice installed on the root server to increase the *nice*ness of pid 24409, with uid 2089<br />
|Signature=Groteblup}}<br />
<br />
{{Question<br />
|Question=I want iotop to display all guest processes on host to give me a nice overview of I/O usage.<br />
||Details=You must configure vprocunhide. The name of the init script and the source of vprocunhide-files might vary with your distribution. The example commands work on Debian.<br />
<br />
<PRE><br />
# mkdir /etc/vservers/.defaults/apps/vprocunhide<br />
# cp /usr/lib/util-vserver/defaults/vprocunhide-files /etc/vservers/.defaults/apps/vprocunhide/files<br />
# echo /proc/vmstat >> /etc/vservers/.defaults/apps/vprocunhide/files<br />
# /etc/init.d/vprocunhide start<br />
</PRE><br />
and run iotop:<br />
<PRE><br />
# vcontext --migrate --xid 1 -- iotop<br />
</PRE><br />
|Signature=_are_}}<br />
<br />
== Unification ==<br />
<br />
{{Question<br />
|Question=What is unification (vunify)?<br />
||Details=[[Unification]] is Hard Links on Steroids. Guests can 'share' common files (usually binaries and libraries) in a secure way, by creating hard links with special properties (immutable but unlinkable (removable)). The tool to identify common files and to unify them is called [[vunify]].<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=What is [[vhashify]]?<br />
||Details=The successor of [[vunify]], a tool which does unification based on hash values (which allows to find common files in arbitrary paths.)<br />
It creates hardlinks to files named after a hash of the content of the file. If you have a recent version of the vserver patch (2.2+), with CONFIG_VSERVER_COWBL enabled, you can even modify the hardlinked files inside the vservers and the links will be broken automatically.<br />
There seems to be a catch when a hashified file has multiple hardlinks inside a guest, or when another internal hardlink is added after hashification. Link breaking will remove all the internal hardlinks too, so the guest will end up with different copies of the original file. The correct solution would be to not hashify files that have multiple links prior to hashification, and to break the link to the hashified version when a new internal hardlink is created. Apparently, this is not implemented yet (?).<br />
|Signature=Guy-}}<br />
<br />
{{Question<br />
|Question=How do I manage a multi-guest setup with vhashify?<br />
||Details=For '[[vhashify]]', just do these once:<br />
<pre><br />
mkdir /etc/vservers/.defaults/apps/vunify/hash /vservers/.hash<br />
ln -s /vservers/.hash /etc/vservers/.defaults/apps/vunify/hash/root<br />
</pre><br />
Then, do this one line per vserver:<br />
<pre><br />
mkdir /etc/vservers/<vservername>/apps/vunify # vhashify reuses vunify configuration<br />
</pre><br />
To hashify a running vserver, do (possibly from a cronjob):<br />
<pre><br />
vserver name-of-guest hashify<br />
</pre><br />
<br />
The guest needs to be running because vhashify tries to figure out what files not to hashify by calling the package manager of the guest via <tt>vserver enter</tt>.<br />
<br />
In order for the OS cache to benefit from the hardlinking, you'll have to restart the vservers.<br />
<br />
To clean up hashified files that are no longer referenced by any vserver, do (possibly from a cronjob):<br />
<pre><br />
find /vservers/.hash -type f -links 1 -print0 | xargs -0 rm<br />
</pre><br />
<br />
Until you do this, the files still take up place even though no vservers need them.<br />
|Signature=Guy-}}<br />
<br />
== Filesystem usage ==<br />
<br />
{{Question<br />
|Question=Is there a way to implement "user/group quota" per VServer?<br />
||Details=Yes, but not on a shared partition for now. You need to put the guest on a separate partition, setup a vroot device (to make the quota access secure), copy that into the guest, and adjust the mtab line inside the guest. If 8 vroot device is not enough for you, you can add more with the kernel parameter max_vroot (exemple for built in kernel vroot /vmlinuz-2.6.31.6-vs2.3.0.36.26aq root=/dev/md1 ro max_vroot=20 ). If vroot is a module you'd actually want to put for exemple "options vroot max_vroot=20" in /etc/modprobe.conf and then just do modprobe vroot<br />
|Signature=derjohn,gadnet}}<br />
<br />
{{Question<br />
|Question=What about "Quota" for a context? Howto limit disk usage?<br />
||Details=Context quotas are now called Disk Limits (so that we can tell them apart from the user/group quotas :). They are supported out of the box (with vs2.0+) for all major filesystems (ext2/3, ReiserFS, JFS). You need to tag the FS with XID (see below). Please read [[Disk Limits and Quota]] for more information.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=How do I tag a guest's directory with xid?<br />
||Details=Tagging the guest's files gives you several advantages, e.g. the accounting will work properly.<br />
Filesystem XID tagging only works on supported filesystem. Those are currently: ext2/3, reiserfs/reiser3, xfs and jfs.<br />
To activate the XID tagging you have to mount the filesystem with "-o tag" (former tagxid is outdated since VS2.2). Attention: It's _not_ possible to "-o remount,tag", you have to mount it freshly. The guests will tag their files automatiaclly. If you copy files in from the host, you have to tag them manually like this:<br />
<pre><br />
chxid -c xid -R /var/lib/vservers/<guest><br />
</pre><br />
Note: Context 0 and 1 will see all files, guests will only be able to access untagged files and their own XID. They can see other XID files but no information about the file, e.g. no owner, no group, no permissions.<br />
Note: It is not advised to tag the root filesystem, as [http://www.paul.sladen.org/vserver/archives/200602/0020.html explained by Herbert] : trying to do so will expose you to some troubles !<br />
|Signature=derjohn_and_gonzo_and_are}}<br />
<br />
{{Question<br />
|Question=How can I copy anything from host to guest partition, normally unvisible on host?<br />
||Details=You should just change namespace, e.g.:<br />
<pre><br />
vnamespace --enter <xid> -- /bin/bash<br />
</pre><br />
and then use standard cp or rsync programs.<br />
|Signature=SergiuszPawlowicz}}<br />
<br />
{{Question<br />
|Question=Why is the barrier attribute disappearing on reiserfs filesystem after umount or host reboot?<br />
||Details=The filesystem has to be mounted with explicitly defining the 'attrs' option, i.e. <br />
<pre><br />
mount /dev/reiserfsdev /vservers -oattrs<br />
setattr --barrier /vservers<br />
</pre><br />
to get the barrier survive after umount/reboot.<br />
|Signature=Nikolay Kichukov}}<br />
<br />
== Network ==<br />
<br />
{{Question<br />
|Question=Does it support IPv6?<br />
||Details=Currently it requires an additional patch, but the functionality should be available in 2.3+ soon. [[IPv6]] has more information.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=I can't do all I want with the network interfaces inside the guest?<br />
||Details=For now the networking is 'Host Business' -- the host is a router, and each guest is a server. You can set the capability ICMP_RAW in the context of the guest, or even the capability CAP_NET_RAW (which would even allow to sniff interfaces of other guests!). Likely to change with ngnet.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=How do I add several IPs to a vserver?<br />
||Details=First of all a single guest vserver only supports up to 16 IPs (There is a 64-IP patch available, which is in "derjohn's kernel").<br />
<pre><br />
Update from IRC (2011-08-22):<br />
<mmouse> quick question: what is the maximum count of IPs (v4) I can have in a single guest?<br />
<daniel_hozac> unlimited.<br />
</pre><br />
<br />
Here is a little helper-script that adds a list of IPs defined in a text file, one per line.<br />
<pre><br />
#!/bin/bash<br />
j=1<br />
for i in `cat myiplist`; do<br />
j=$(($j+1))<br />
mkdir $j<br />
echo $i > $j/ip<br />
echo "24" > $j/prefix<br />
done<br />
</pre><br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=How do I assign a new IP address to a running guest?<br />
||Details=This is done from the host server:<br />
* add the ip on the host, for example<br />
<pre><br />
ip addr add 194.169.123.23/24 dev eth0 <br />
</pre><br />
* add the ip to the guest's network context (a guests NID is the same as the XID {context ID})<br />
<pre><br />
naddress --add --nid <nid> --ip 194.169.123.23/24 <br />
</pre><br />
* enter the guest (best via ssh) <br />
* restart the services that need to make use of the new address if required <br />
* update the config in ''/etc/vserver/<servername>/interfaces'' to reflect the changes for the next guest restart (if desired)<br />
|Signature=BenjaminGreen}}<br />
<br />
{{Question<br />
|Question=If my host has only one a single public IP, can I use RFC1918 IP (e.g. 192.168.foo.bar) for the guest vservers?<br />
||Details=Yes, use iptables with SNAT to masquerade it. <br />
<pre><br />
iptables -t nat -I POSTROUTING -s $VSERVER_NETZ ! -d $VSERVER_NETZ -j SNAT --to $EXT_IP<br />
</pre><br />
See: [[HowtoPrivateNetworking]] and <br />
http://www.tgunkel.de/it/software/doc/linux_server.en#h3-VServer_Masquerading_SNAT (THX, [MUPPETS]Gonzo)<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=If I shut down my vserver guest, the whole Internet interface ethX on the host is shut down. What happened?<br />
||Details=When you shut down a guest (''i.e. vserver foo stop''), the IP is brought down on the host also. If this IP happens to be the primary IP of the host, the kernel will not only bring down the primary IP, but also all secondary IP addresses. Similarly, if your guests bring up IPs of more than one subnet, all other IPs from a specific subnet will be shut down if you stop the guest which created the first ("parent") IP.<br />
<br />
You can check this on the host using the command "ip addr show". Example output:<br />
<pre><br />
1: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000<br />
link/ether 00:01:02:03:04:05 brd ff:ff:ff:ff:ff:ff<br />
inet 192.168.249.172/27 brd 192.168.249.191 scope global eth0<br />
inet 192.168.234.194/27 brd 192.168.234.223 scope global eth0<br />
inet 192.168.249.169/27 brd 192.168.249.191 scope global secondary eth0<br />
inet 192.168.234.195/27 brd 192.168.234.223 scope global secondary eth0<br />
</pre><br />
In this example, if you stop the guest which brings down the IP 192.168.249.172, the IP 192.168.249.169 will be brought down as well, because it is a secondary IP of the "parent" 192.168.249.172.<br />
<br />
But in very recent kernels, there is an option ''settable'' which prevents that nasty feature. It's called "alias promotion". You may set it via sysctl by adding ''net.ipv4.conf.all.promote_secondaries=1'' in /etc/sysctl.conf or via sysctl command line.<br />
|Signature=derjohn, Hurga}}<br />
<br />
{{Question<br />
|Question=Can I run an OpenVPN Server in a guest?<br />
||Details=<br />
Yes. To get a OpenVPN Server running in a guest, all networking setup has to be done on the host. This answer describes the common case and shows some pitfalls, for detailled information about OpenVPN, please consult the appropriate documentation on the OpenVPN homepage.<br />
This is the minimal OpenVPN configuration for the Server which will be used to demonstrate how to get it running in a client:<br />
<pre><br />
# Networking setup<br />
server 192.168.16.0 255.255.255.0<br />
dev tun16<br />
ifconfig-noexec<br />
comp-lzo<br />
# Certificates<br />
dh ...<br />
ca ...<br />
cert ...<br />
key ...<br />
# Management<br />
persist-key<br />
keepalive 10 60<br />
verb 4<br />
</pre><br />
First of all you have to prepare the host with a persistent interface in the right mode and with the right settings. This is easily done by using openvpn and the ip and route tools.<br />
<pre><br />
# openvpn --mktun --dev tun16<br />
# ip link set dev tun16 txqueuelen 100<br />
# ifconfig tun16 192.168.16.1 pointopoint 192.168.16.2 mtu 1500<br />
# route add -net 192.168.16.0 netmask 255.255.255.0 gw 192.168.16.2<br />
</pre><br />
If you need different settings, openvpn will tell you the ifconfig and route commands it uses to configure the interface when being started on the host with the original config file, but without ifconfig-noexec.<br />
Additionally, the guest needs /dev/net/tun to make OpenVPN happy. This can be created with MAKEDEV:<br />
<pre><br />
# cd /var/lib/vserver/<myopenvpnserver>/dev/<br />
# ./MAKEDEV tun<br />
(creates the dev/net/tun device accessible by the guest - even a tap interface needs /dev/net/tun !)<br />
</pre><br />
Finally, the guest needs to have the tun device assigned:<br />
<pre><br />
# head /etc/vservers/<myopenvpnserver>/interfaces/1/*<br />
==> /etc/vservers/<myopenvpnserver>/interfaces/1/ip <==<br />
192.168.16.1<br />
<br />
==> /etc/vservers/<myopenvpnserver>/interfaces/1/nodev <==<br />
tun16<br />
<br />
==> /etc/vservers/<myopenvpnserver>/interfaces/1/prefix <==<br />
24<br />
#<br />
</pre><br />
The client's conf may look like that:<br />
<pre><br />
# Basic setup<br />
client<br />
proto tcp-client<br />
dev tun<br />
remote <ipaddress><br />
comp-lzo<br />
verb 4<br />
<br />
# Certificate<br />
ca ...<br />
</pre><br />
<br />
[ Based on derJohn's original answer, all errors mine ] <br />
|Signature=DavidS}}<br />
<br />
{{Question<br />
|Question=Trying to connect to a vserver from the host or another vserver on the same host fails<br />
||Details=strace shows<br />
<pre> <br />
sin_addr=inet_addr("xx.xx.xx.xx")}, yy) = -1 EINVAL (Invalid argument)<br />
</pre><br />
A: The host/guest cannot communicate with another guest on same host.<br />
* check all netmasks on all interfaces (do they overlap) ?<br />
* check policy routing (disable it temporary) ?<br />
* check that lo is up (Networking within a host/guest always uses lo interface)<br />
|Signature=CommonProblems}}<br />
<br />
{{Question<br />
|Question=Can I use iptables ?<br />
||Details=Yes but right now only on the host (rootserver). Please realize that all traffic is local and will not touch the forward chain.<br />
<br>If you really, really, really need iptables on the guest and you are aware about loosing a big part of VServer isolation and security you could add the NET_ADMIN capability. Consider writing wrappers to manage iptables on the host instead.<br />
|Signature=_are_}}<br />
<br />
{{Question<br />
|Question=Is it possible to prevent guest from bringing down primary ip?<br />
||Details=Yes. Remove /etc/vservers/<guest>/interfaces/X/dev, and touch /etc/vservers/<guest>/interfaces/X/nodev<br />
|Signature=Daniel&Serge}}<br />
<br />
{{Question<br />
|Question=Is it possible to provide a different MAC address per vServer?<br />
||Details=Short answer - yes but it's a hassle.<br />
<br />
Real answer from '''_are_''':<br />
<pre><br />
When I once needed 'real' seperate MAC-addresses I used TAP-devices and VDE2 ([http://vde.sourceforge.net/ Virtual Distributed Ethernet]).<br />
Basically vServer is an isolation of existing resources, not a virtualization of 'new' devices.<br />
Without extra fuss you can't add a 'new' network interface to a vServer, no matter if it is eth* or tap*, you always add it to the host and give the vServer access to it.<br />
I got the TAP+VDE2 up and running, but I think it is too much trouble for basically the simple adding of IPs to a vServer unless you really need the MAC address separate.<br />
</pre><br />
<br />
<br />
You can also utilize MACVLAN ability from kernel.<br />
I.e. create ''macvlan0'' interface with:<br />
<pre>ip link add link eth0 address 00:19:d1:29:d2:58 macvlan0 type macvlan</pre><br />
[[http://jim.studt.net/depository/index.php/notes-on-linux-s-macvlan-module Reference]]<br />
|Signature=bobnormal&swenTjuln<br />
}}<br />
<br />
{{Question<br />
|Question=Is it possible to hide packet counters on the host network interface from vServer guests?<br />
||Details=Yes, see [[Networking_vserver_guests|Networking vServer Guests]]<br />
|Signature=bobnormal}}<br />
<br />
{{Question<br />
|Question=Services won't bind to 127.0.0.1 when I configure them to bind to all available IPs / (binding service to * doesn't bind to loopback)?<br />
||Details=You've configured single public IP and have kernel option "Linux VServer -> Automatic Single IP Special Casing" enabled.<br />
It means somehow "optimized" :D<br />
If you don't want this you have 3 possible solutions (quoting Bertl):<br />
* disable the auto single IP in the kernel<br />
* assign more than one IP to the guest<br />
* disable single ip special casing for that guest<br />
<br />
The later is done by : echo "~single_ip" >> /etc/vservers/<VSERVER>/nflags<br />
At runtime to avoid restarting the vserver: nattribute --set --nid <guest> --flag ~single_ip<br />
|Signature=swenTjuln}}<br />
<br />
== Administration tools ==<br />
<br />
{{Question<br />
|Question=Which guest vservers are running?<br />
||Details=Use vserver-stat to find out. Example output:<br />
<pre><br />
CTX PROC VSZ RSS userTIME sysTIME UPTIME NAME<br />
0 77 965.1M 334.6M 14m14s18 2m28s69 1h33m46 root server<br />
49152 7 14M 5.2M 0m00s40 0m00s30 1h30m15 chiffon<br />
</pre><br />
|Signature=derjohn}}<br />
<br />
<br />
{{Question<br />
|Question=Is there a web-based interface for vserver that will allow creation/deletion/configuration etc. of vserver guests?<br />
||Details=<br />
* http://OpenVPS.org which is a set of scripts with a web-interface for webhosters/ISPs<br />
* http://Openvcp.org which is a distributed system (agent!) with a web-interface, with which you can build/remove guests<br />
* http://vsmon.revolutionlinux.com/ is a distributed monitoring-only solution that allows you to search for a particular vserver in your park.<br />
|Signature=derjohn}}<br />
<br />
== Hosting foreign distributions ==<br />
<br />
{{Question<br />
|Question=I run a Debian host and want to build an Ubuntu guest. Howto?<br />
||Details=Simple ;) Assume you want to build a breezy guest on a sid host with IP 192.168.0.2 and hostname vubuntu, then do:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu<br />
</pre><br />
<br />
[UPDATE] Currently there are problems in building breezy under unclear circumstances, which seems to have to do with udev. If the above didnt work, try:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu -- --exclude=udev<br />
</pre><br />
In very recent versions of the utils, the problem should not occur anymore (it has to do with the 'secure-mount' if you look in the MLs)<br />
<br />
Well, sid's debootstrap knows how to bootstrap Ubuntu linux. Make sure to have a current debootstrap package: <br />
<pre><br />
apt-get update<br />
apt-get install debootstrap<br />
</pre><br />
The knowledge how to build ubuntu 'breezy badger' (which you probably want to be your guest at the time of writing) has been added recently.<br />
|Signature=derjohn}}<br />
<br />
<br />
{{Question<br />
|Question=I want to build a Gentoo guest. Howto?<br />
||Details=Even simpler ;) See http://www.gentoo.org/proj/en/vps/vserver-howto.xml#doc_chap3 .<br />
|Signature=gcc}}<br />
<br />
== Application level problems ==<br />
<br />
{{Question<br />
|Question=I did everything right, but the application foo does not start. What's up there?<br />
||Details=Before asking on the IRC channel, please check out the 'problematic programs' page:<br />
[[Problematic Programs]]<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=When I try to ssh to the guest, I log into the host, even if I installed sshd on the guest. What's wrong here?<br />
||Details=Look at /etc/ssh/sshd_config of the host:<br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
#ListenAddress ::<br />
</pre><br />
And now change the setting to <br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
ListenAddress your.hosts.ip.here # not the guests IP! <br />
</pre><br />
Then '/etc/init.d/ssh restart' on the host, after that on the guest (if you did apt-get install ssh on the guest already.)<br />
Do I have to explain more? If the hosts sshd binds all available IP addresses on port 22 (The hosts 'sees' even all addresses of the guests!). So if the guest starts its sshd, it can't bind to port 22 any more. You need to change that setting only on the host. <br />
(BTW: A similar approach has to be done for a lot of daemons, e.g. Apache. If the daemon does not support an explicit bind, you may use the chbind command to 'hide' IP addresses from the daemon before starting.)|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Bind9 does not like to start in my guest.<br />
||Details=Check out the [[Problematic Programs]] page and/or get my [http://linux-vserver.derjohn.de/bind9-packages/bind9-capacheck_9.3.2-2_i386.deb vserver-guest-ready Debian package] for Debian Sid guests and check out the [http://linux-vserver.derjohn.de/bind9-packages/README.txt readme]. (Hint: This is fresh stuff. Please give me feedback)<br />
<br />
[UPDATE] Since VServer Devel 2.1.1-rc18 you do not need to patch the userland tools anymore. The capabilities are masked.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=My mysqld running in a guest behaves strangely and is awfully slow/locks up<br />
||Details=This can be related to /tmp being too small. mysqld stores temporary tables in /tmp and as such, if a lot of queries happen and /tmp runs full this can cause one query to lock up whilst creating the tmp table and all other queries waiting to acquire the lock. There are two possible solutions to that problem: a.) Modify /etc/vservers/vserver-name/fstab and assign more memory to the tmpfs of /tmp and b.) remove the /tmp entry from /etc/vservers/vserver-name/fstab completly. Especially on database servers with a rather high load the second one might be the preferred method.|Signature=sp}}<br />
<br />
{{Question<br />
|Question=Pure-FTP does not run inside a VServer?<br />
||Details=That's because it has capabilities enabled, make sure you rebuild your distro's package passing also the `--without-capabilities` flag to configure.<br />
|Signature=Pedro Algarvio, aka, s0undt3ch}}<br />
<br />
{{Question<br />
|Question=Why do neither sshd nor crond (vixie-cron) work correctly in my CentOS / Fedora guest? I get 'pam_loginuid(crond:session): set_loginuid failed opening loginuid' and similar lines in my logs.<br />
||Details=Took me a while to figure this out, and it turned out to be mentioned in the old wiki. Here is the solution on how to solve a common problem with sshd / crond, somehow related to selinux and auditing:<br />
<br />
pam authentication (also used with openssh) enables "pam_loginuid.so" in the /etc/pam.d/* files. Comment those out as they are not necessary and will not load within a guest anyway. This probably is also necessary on updates later on, if the configs get changed. You therefore may add the following command line to a cronjob file or your software update script:<br />
<pre><br />
/bin/sed --in-place -e "s/^session.*required.*pam_loginuid.so/# session\trequired\tpam_loginuid.so/g" /etc/pam.d/*<br />
</pre><br />
|Signature=patrick}}<br />
<br />
{{Question<br />
|Question=How do i install nagios-plugins on a Gentoo guest?<br />
||Details=Unfortunately, the nagios-plugins ./configure scripts wants to ping 127.0.0.1 which is not available inside a guest. Therefore you have to build nagios-plugins outside the guest.<br />
The easiest way to do this from the host (assuming the guest is running) is:<br />
<pre><br />
vnamespace -e <xid> -- chroot /vservers/<name> emerge nagios-plugins -va<br />
</pre><br />
|Signature=Hollow}}<br />
<br />
{{Question<br />
|Question=Somebody runs ntpd in guest and you can't use ntpdate in host?<br />
||Details=Try to run ntpdate with options -u :<br />
ntpdate -u ntp.domain.xy<br />
or you can use command:<br />
chbind --nid 42 --ip 1.2.3.4 -- ntpdate ntp.domain.xy<br />
where IP will be the IP of host.<br />
|Signature=Punkie/Bertl}}<br />
<br />
<br />
<br />
== Start / Stop a VServer ==<br />
<br />
{{Question<br />
|Question=How do I make a vserver guest start by default?<br />
||Details=At least on Debian, I can tell you how to do it with the new-style config. If your guest is called "derjohn" and you want it to be started somewhere at the of your bootstrap process, then do:<br />
<pre><br />
echo "default" > /etc/vservers/derjohn/apps/init/mark<br />
</pre><br />
If you want to start it earlier, please read the init script "/etc/init.d/util-vserver" to find out how to do it. In most cases you don't need to change this. On Debian the vservers are started at "20", so after most other stuff is up (networking etc.).<br />
<br />
Besides that I created a small helper script for managing the autostart foo: ((vserver-autostart))|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=My host works, but when I start a guest it says that it has a problem with chbind.<br />
||Details=You are probably using util-vserver <= 0.30.209, which does use dynamic network contexts internally (With 0.30.210 this fact changed). So if you compiled your kernel without dynamic contexts, you may start guests, but you can't use the network context.The solution is either to switch to .210 util (or Hollow's toolset) or compile the kernel with dynamic network contexts.<br />
SE Keyword: invalid option `nid' testme.sh<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=What is old-style and new-style config?<br />
||Details=Old-style config refers to a single text-file that contains all the configuration settings. With new-style config the configuration is split into several directories and files. You should probably go for new-style config if you are asking.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=How can I reboot/halt guests?<br />
||Details=It depends. <br />
For legacy Linux-VServer (i.e. 1.2.x), you have to replace /sbin/halt in the guests with vreboot and start rebootmgr in the host. You also need to have a <guest>.conf file in /etc/vservers for each guest. Please have a look at /etc/init.d/rebootmgr.<br />
For Linux-VServer 2.0+, sys_reboot has been virtualized to do the right thing. No changes are needed in guests. Please note that some things depend on the init style used by the guest : read [[util-vserver:InitStyles]]<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=What is the initial PATH?<br />
||Details=By default, vserver uses the 'sysv' startup style, which mimics the init process by running the 3rd runlevel through '/etc/init.d/rc 3' (or '/etc/rc.d/rc 3'). Usually this 'rc' script uses a hard-coded PATH. In the case it doesn't, util-vserver also mimics init's default PATH through /etc/vservers/.defaults/apps/init/environment, or if not present /usr/local/lib/util-vserver/defaults/environment. Beware that all those default PATH usually do not include /usr/local.<br />
|Signature=daniel_hozac&Beuc}}<br />
<br />
{{Question<br />
|Question=When I try to start a guest i get this message "/proc/uptime can not be accessed. Usually, this is caused by procfs-security. Please read the FAQ for more details"?<br />
||Details=After a reboot you need to run the vprocunhide script. If running this script causes many errors to print on the screen, try checking the kernel you have booted with (perhaps it does not have the linux-vserver extensions enabled).<br />
|Signature=mattzerah}}<br />
<br />
{{Question<br />
|Question=When I try to start a guest i get this message "vsched: vc_set_sched(): Function not implemented". <br />
||Details=After an upgrade of the kernel/tools if you used the old scheduler function you must convert them to cgroup cpu limits. If you do not want limits search and remove/rename /etc/vservers/*/sched/ and the guest will start again.<br />
|Signature=aqueos}}<br />
<br />
== Kernel ==<br />
<br />
{{Question<br />
|Question=Is SMP Supported?<br />
||Details=Yes, on all SMP capable kernel architectures.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Do I really need the legacy-interfaces? What are these legacy-interfaces?<br />
||Details=Since Linux-VServer is an ongoing project, new features might replace old ones, some might require a development version. Legacy-interfaces are available for backward compability (which might be removed someday) with Linux-VServer 1.2.x.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=I have a vserver running on a Linux kernel with preemption. Is VServer "preempt" safe?<br />
||Details=There are no known issues about running vserver on a preemption enabled kernel. I would like to add, that the vserver kernelhackers would probably exclude that option in 'make menuconfig' if there would be an incompatibility. Just my $.02 :)<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=32 vs 64 Bit? What should I take?<br />
||Details=If you have the choice make the host a 64 bit one. You can run a guest as 32 bit or as 64 bit on a 64 bit host. To run it as 32 bit, you need to compile the x86_64 (a.k.a. AMD64) with the following options:<br />
<pre><br />
[*] Kernel support for ELF binaries<br />
<M> Kernel support for MISC binaries<br />
[*] IA32 Emulation <---- without that, the entire 32bit API is not present<br />
<M> IA32 a.out support <br />
</pre><br />
You can force the guest to behave like a 32 environment like this:<br />
<pre><br />
echo linux_32bit > /etc/vservers/$NAME/personality<br />
echo i686 > /etc/vservers/$NAME/uts/machine<br />
</pre><br />
(thanks cehteh for the hint!)<br />
<br />
But you can force debootstrap to put 32 bit binaries into the guest by 'export ARCH=i386';<br />
<pre><br />
export ARCH=i386 ; vserver build .... <br />
</pre><br />
<br />
On debian when using the newvserver script "export ARCH=i386" has no effect, just use:<br />
<pre><br />
newvserver --arch i386 ...<br />
</pre><br />
<br />
On debian debootstrap can also be gived the arch option:<br />
<pre><br />
vserver myguest \<br />
build -m debootstrap -n myguest \<br />
--hostname myguest.mydomain.com \<br />
-- -d squeeze -- \<br />
--arch=amd64 (or i386 if you want 32bit)<br />
</pre><br />
<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=What does the guest privacy option do in the kernel settings ?<br />
||Details=<pre><br />
>i was wondering about the real thing that guest privacy does. <br />
#ifdef CONFIG_VSERVER_PRIVACY<br />
#define VS_ADMIN_P (0)<br />
#define VS_WATCH_P (0)<br />
#else<br />
<br />
> > Does it just prevent the spectator context ? <br />
<br />
it prevents the spectator context and the admin <br />
functionality in all cases which are privacy<br />
sensitive, which includes:<br />
<br />
- ptrace<br />
- devmapper<br />
- devpts<br />
- inode tag permissions<br />
- mountinfo<br />
- kill/signal<br />
- netlink dumps<br />
- tun control<br />
- iopriority<br />
<br />
> > What security do it bring to the system ?<br />
<br />
together with the VXF_STATE_ADMIN it can be<br />
used to secure a guest (to some degree) from<br />
unwanted access from the host admin, of course,<br />
as the admin can change the kernel, this is a<br />
voluntary feature which mostly prevents certain<br />
kinds of accidential peeking or guest modification<br />
<br />
</pre><br />
|Signature=ghislain}}<br />
<br />
<br />
== Distribution specific questions ==<br />
<br />
{{Question<br />
|Question=VServer is included in the stable Debian GNU/Linux for years now. What VS version did they include?<br />
||Details=At the time of writing, Debian Squeeze is the stable release of Debian and includes a 2.6.32 based kernel-package called 2.6.32-5-vserver-ARCH. This currently contains VServer 2.3.0.36.29.6 with some additional fixes.<br />
|Signature=scientes}}<br />
<br />
{{Question<br />
|Question=Were can I get newer versions of VServer as ready made packages for Debian?<br />
||Details= There are a number of locations<br />
* http://repo.psand.net/info/ has Debian Lenny and Squeeze packages for 2.6.31 (i368 and amd64), 2.6.33, 2.6.35, 2.6.36 (amd64). It also contains newer util-vserver builds.<br />
* http://linux-vserver.derjohn.de/ - "my kernels are always 'devel' branch" (derjohn). This repo contain kernels up to 2.6.29 for amd64, 2.6.26 for i386.<br />
* http://backports.debian.org/ contains 2.6.32 backports for Lenny at time of writing (11th May 2010)<br />
* http://zbla.net/debian/ Unofficial debian vserver packages '''WARNING : i386 packets are compiled for 64bits !''' apt source line: ''deb http://zbla.net/debian/ ./'' (N/A as of 2011/12/27)<br />
|Signature=Gremble<br />
}}<br />
<br />
<br />
<br />
== Misc ==<br />
<br />
{{Question<br />
|Question=Why isn't there a device /dev/xyz within a guest?<br />
||Details=Device nodes allow userspace to access hardware (or virtual resources). Creating a device node inside the guest's namespace will give access to that device, so for security reasons, the number of 'given' devices is small.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=I want to (re)mount a virtual filesystem (like tmpfs) in a running guest ... but the guest has no rights (capability) to (re)mount?<br />
||Details=I take as example your /tmp partition within the guest is too small, what will be likely the case if you stay with the 16MB default (vserver build mounts /tmp as 16 MB tmpfs!).<br />
<pre><br />
# vnamespace -e XID mount -t tmpfs -o remount,size=256m,mode=1777 none /var/lib/vservers/<guest>/tmp/<br />
</pre><br />
(if there's a problem, try expanding the symlinks in the mount path)<br />
Be warned that the guest will not recognize the change, as the /etc/mtab file is not updated when you mount like this. To permanently change the mount, edit /etc/vserver/<guest>/fstab on the host.<br />
<br />
If you get:<br />
<pre><br />
mount: can't find /var/lib/vservers/<guest>/tmp in /etc/fstab or /etc/mtab<br />
</pre><br />
then try instead:<br />
<pre><br />
vnamespace -e builder chroot /var/lib/vservers/<guest>/ mount -o remount,size=64m,mode=1777 /tmp<br />
</pre><br />
|Signature=derjohn/BenjaminGreen}}<br />
<br />
{{Question<br />
|Question=How do I bind mount a host directory inside a running guest?<br />
||Details=There are two ways to do this: one is to enter the bind mount in the guest fstab and restart the guest.<br />
<br />
To understand the other way, let me explain how mount namespaces work.<br />
<br />
Every guest has two mount namespaces associated with it: one "''management namespace''" and one "''operational namespace''".<br />
<br />
On starting the guest, first the management namespace is created as a copy of the host namespace (which means that everything that was mounted on the host is mounted in the new namespace as well). This has unwelcome side effects: for example, if you had a cdrom mounted while starting the guest, you wouldn't be able to eject it until you stop the guest even if you umount it on the host, because it's still mounted in the guest. Therefore, the namespace is ''cleaned up'': filesystems that are mounted outside the root of the guest get unmounted in the guest namespace.<br />
<br />
Subsequently, the operational namespace of the guest is created as a copy of the management namespace, and the guest's processes are started in it.<br />
<br />
To bind mount a host directory in the guest, you must first make that host directory visible in the management namespace of the guest. This is automatically the case if the directory resides inside a mountpoint that exists in the guest namespace as well; however, if the guest config referenced no part of this mountpoint (or it didn't yet exist when you started the guest), then the cleanup mentioned above removed it from the guest's management namespace and you need to re-add it.<br />
<br />
Let's assume, as an example, that we want a guest to see a subdirectory, called <tt>foo</tt>, of the cdrom we just mounted on the host (e.g. under <tt>/media/cdrom</tt>).<br />
<br />
Let's enter the management namespace of the guest (that's what <tt>-i 0</tt> is for):<br />
<br />
<pre><br />
# vnamespace -i 0 -e <guest-xid> -- /bin/bash<br />
</pre><br />
<br />
Now you have access to all host devices; mount the device that contains your directory wherever you want, but you may prefer to mount it in the same location you used on the host. (Note, though, that it's not even necessary for the device to be mounted in the host namespace at all.)<br />
<br />
It's likely best to use <tt>mount -n</tt> lest your host <tt>/etc/mtab</tt> get polluted with mounts from other namespaces.<br />
<br />
<pre><br />
# mount -n /dev/sr0 /media/cdrom<br />
# exit<br />
</pre><br />
<br />
We're now back in the host namespace. <tt>vmount</tt> can now be used to bind mount <tt>/media/cdrom/foo</tt> inside a running guest (in this example, under <tt>/foo</tt> inside the vserver root):<br />
<br />
<pre><br />
# vmount guestname -- --bind /media/cdrom/foo /mnt/foo<br />
</pre><br />
|Signature=[[User:KornAndras|Guy-]] 01:31, 10 January 2012 (UTC)}}<br />
<br />
{{Question<br />
|Question=How do I mount a device present on the host under a directory in a running guest?<br />
||Details=Use something like:<br />
<pre><br />
vnamespace -e <guestname> mount -n /dev/<device> /vservers/<guest>/place/you/want/to/mount/it<br />
</pre><br />
<br />
This device can be unmounted with:<br />
<br />
<pre><br />
vnamespace -e <guestname> umount -n /vservers/<guest>/place/you/want/to/mount/it<br />
</pre><br />
<br />
|Signature=derjohn/BenjaminGreen}}<br />
<br />
{{Question<br />
|Question=Does anyone know how to increase the size of /tmp within a vserver w/o restarting?<br />
||Details=Use the remount option for mount.<br />
# vnamespace -e XID mount -n -t tmpfs -o remount,size=32m tmpfs /<vdir>/<guest>/tmp<br />
or something like that. The arguments are needed since mount is not going to be using /etc/fstab for the information and the version of /proc/mounts is best understood by<br />
# vnamespace -e XID cat /proc/mounts.<br />
See [[Frequently_Asked_Questions#I want to (re)mount a partition in a running guest ... but the guest has no rights (capability) to (re)mount?]]<br />
|Signature=derjohn/dhozac}}<br />
<br />
<br />
{{Question<br />
|Question=#1 ERROR: capset(): Operation not permitted<br />
||Details=capabilities are not enabled in kernel-setup<br />
please check that CONFIG_SECURITY_CAPABILITIES is loaded or included in the kernel. ( check with "cat /path_to_kernel/.config | grep -i cap ") <br />
(2.6.11.5-vs-1.9.5 + 0.30-205)<br />
|Signature=IrcQuestions}}<br />
<br />
{{Question<br />
|Question=How can I make 'vserver start' mount the root filesystem?<br />
||Details=Mount it via /etc/vservers/vserver-name/fstab, make sure to set the option 'dev' e.g.:<br />
<pre>/dev/drbd0 / xfs rw,dev 0 0</pre><br />
|Signature=AdrianReyer}}<br />
<br />
<br />
{{Question<br />
|Question=I deleted a guest's directory without shutting it down. Now I have a "ghost" running. Is there any possibility to get it out of proc without rebooting?<br />
||Details=<br />
vkill --xid <xid> -s 15; sleep 2; vkill --xid <xid> -s 9<br />
<br />
You will also need to remove guest's ip, for example with:<br />
ip addr del <ip> dev eth0<br />
|Signature=daniel_hozac & gebura }}<br />
<br />
{{Question<br />
|Question=When using nice and su (for example, in the updatedb cron job), I get: su: Permission denied. What does it mean?<br />
||Details=A guest cannot lower its nice value - and that's what 'su' does through pam_limits which sets a nice value of 0. You can see it through strace:<br />
$ strace nice su nobody<br />
[...]<br />
setpriority(PRIO_PROCESS, 0, 0) = -1 EACCES (Permission denied)<br />
You can use 'su nobody -c nice some_cmd' instead.<br />
<br />
The problem is caused by the fact that host system is setting limits for guests (when instructed to do so) and the dropped capability dissallows processess on guest systems to change and increase them later. That means no process on a guest can lower nice value above the limit set by host.<br />
<br />
If the pam_limits module is activated on a guest system it will first try to '''reset nice value to 0''' even if <tt>/etc/security/limits.conf</tt> file is empty or even if there are lower priority limits set in it. The pam_limits module does that since [http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=241663 its developers decided] that it should reset some limits to defaults and start from scratch when applying new restrictions. Unfortunately, already limited guest system won't be able to do it since resetting nice value to 0 means increasing the limit which is forbidden. See [http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=311058 Debian Bug report logs - #311058] for more information about that Debian bug.<br />
<br />
See also [[Frequently_Asked_Questions#Cron is not working on my guest system (which is Debian). How can I fix it?|Cron is not working…]]<br />
<br />
|Signature=daniel_hozac & Beuc & Paweł Wilk}}<br />
<br />
{{Question<br />
|Question=Cron is not working on my guest system (which is Debian). How can I fix it?<br />
||Details=On a guest system the cron daemon may not work properly. When looking into the log file (e.g. <tt>/var/log/syslog</tt>) the following message may appear repeatedly:<br />
CRON[xxxxx]: Permission denied<br />
<br />
Similar thing may happen with the <tt>su</tt> when trying to execute a command as root.<br />
<br />
It's not the problem in Cron but in the pam_limits module on a guest system (see [[Frequently_Asked_Questions#When using nice and su (for example, in the updatedb cron job), I get: su: Permission denied. What does it mean?|FAQ:When using nice and su…]] for more information about the cause).<br />
<br />
There are 4 ways to solve or work-around this problem:<br />
<br />
'''1. Allowing guests to reset resource limits:'''<br />
<br />
It's clean solution but you may expect some guest processes increasing their limits because not everything is controlled by PAM. It also breaks centralized resources limiting approach so a guest can do bad things that may cause other guests and host to be overloaded and unresponsive.<br />
<br />
To apply it you have to add <tt>CAP_SYS_RESOURCE</tt> flag to <tt>/etc/vservers/<server name>/bcapabilities</tt> (2.6 kernels).<br />
<br />
See [[util-vserver:Capabilities_and_Flags|Capabilities and Flags]] for more information.<br />
<br />
'''2. Disabling pam_limits on a guest systems:'''<br />
<br />
This workaround is easy and works fine when your guest systems aren't really multiuser but rather service boxes. It disables setting of the resource limits by PAM so the limits can only be set globally for the whole guest (using rlimits or cgroups on a host) but never increased inside of the guest system.<br />
<br />
To apply it just enter the guest and edit the files listed below, commenting out any line containing <tt>pam_limits</tt>:<br />
<br />
/etc/pam.d/su<br />
/etc/pam.d/sudo<br />
/etc/pam.d/cron<br />
<br />
You can also use this one-liner on a guest:<br />
<br />
<pre><br />
/bin/sed --in-place -e "s/^\s\?session.*pam_limits.so.*/\#\0/g" /etc/pam.d/{su,sudo,cron}<br />
</pre><br />
<br />
'''3. Allowing guest's pam_limits to set limits when possible:'''<br />
<br />
This workaround allows you to have working <tt>pam_limits</tt> inside a guest system and global limits set by a host system. What's the catch? The problematic PAM module won't fully work for the root user on a guest system as expected and there might appear some PAM's warnings in guest's <tt>auth.log</tt>. Since using pam_limits to limit regular user processes is far more frequent than using it to limit root processes, this solution may be a good compromise. It is about setting a proper limits in pam_limits configuration and about setting this PAM module in a way that its function is optional (instead of required). The last change makes PAM to continue with session even if pam_limits encounters some error during setting limits (it usually applies to superuser sessions).<br />
<br />
The not so nice news is that there might be a need of keeping guest's limits configuration up to date according to limits globally set for a guest. The limits set in pam_limits configuration file(s) shouldn't be higher (lower in case of nice value) than global guest's limits.<br />
<br />
To apply it enter the guest and edit the files listed below, replacing occurences of <tt>required</tt> by <tt>optional</tt> in the lines containing <tt>pam_limits</tt>:<br />
<br />
/etc/pam.d/su<br />
/etc/pam.d/sudo<br />
/etc/pam.d/cron<br />
<br />
For example:<br />
<br />
# Sets up user limits, please define limits for cron tasks<br />
# through /etc/security/limits.conf<br />
session optional pam_limits.so<br />
<br />
Then on a guest system create the file <tt>/etc/security/limits.d/01-fixpam.conf</tt> containing:<br />
<br />
<pre><br />
* - priority X # replace X with your guest's nice value <br />
</pre><br />
<br />
You can automate this process to happen automagically for any guest by creating the startup script named <tt>/etc/vservers/.defaults/scripts/post-start.d/01-pamfix</tt>:<br />
<br />
<pre><br />
#!/bin/sh<br />
<br />
# This script tries to fix pam_limits entries<br />
# to make it possible for PAM in a guest system to<br />
# set its own limits.<br />
<br />
PAM_DIR="etc/pam.d"<br />
PAM_SERVICES="su sudo cron"<br />
LIMITS_FILE="etc/security/limits.d/01-pamfix.conf"<br />
<br />
vname="$2"<br />
[ -z "$vname" ] && exit 0<br />
<br />
vcfg=$( /usr/sbin/vserver-info "$vname" CFGDIR )<br />
[ ! -d "$vcfg" ] && exit 0<br />
<br />
for s in $PAM_SERVICES<br />
do<br />
pamfile="${PAM_DIR#\/}/$s"<br />
[ -f "$pamfile" ] && /bin/sed --in-place -e "s/\(^\s\?session.*\)required\(.*pam_limits.so.*\)/\1optional\2/g" "$pamfile"<br />
done<br />
<br />
[ ! -f "${vcfg}/nice" ] && exit 0<br />
nval=$( /usr/bin/head -1 "${vcfg}/nice" )<br />
[ -n "$nval" ] && echo "* - priority $nval # (added by vserver startup script)" > "${LIMITS_FILE#\/}"<br />
<br />
exit 0<br />
</pre><br />
<br />
'''4. Disabling resource limits for a guest:'''<br />
<br />
It easy, clean and… unsafe solution. You just have to not set resource limits (e.g. priority, nice value) for a guest or set the nice value limit to 0 on a host system. Resetting it later by guest's <tt>pam_limits</tt> will not generate an error.<br />
<br />
|Signature=Paweł Wilk}}<br />
<br />
{{Question<br />
|Question=How do I handle NFS mounts within in a guest?<br />
||Details=There are at least four ways.<br />
<br />
In any case, you probably want to force the nfs version to 3 or lower to avoid id mapping issues (one symptom of having an id mapping issue is that <tt>no_root_squash</tt> appears to be ignored). You can check whether the mount uses nfsv4 by looking at <tt>/proc/mounts</tt> inside the guest. You can force the protocol version to 3 by passing the mount options <tt>nfsvers=3,mountvers=3</tt>.<br />
<br />
'''1)''' Mount the NFS share from the host OS and let vserver guest access it as part of it's file system.<br />
<br />
''mount --bind'' may also be beneficial in this scenario.<br />
<br />
'''2)''' Use util-vserver and create a ''fstab.remote'' file in the /etc/vserver/<vserver_name> directory. Populate this with the NFS shares and they will be mounted in the context of the vserver guest.<br />
<br />
See http://www.nongnu.org/util-vserver/doc/conf/configuration.html<br />
<br />
Note that as of 0.30.216-pre3000 and kernel 3.0.4-vs2.3.1-pre10.1, the mount request will appear to originate from the IP of the host, not the guest. It is unclear (to [[User:KornAndras|Guy-]]) whether this is a bug.<br />
<br />
'''3)''' Add capabilities to the vserver guest instance to grant sufficient rights to allow NFS mounts.<br />
<br />
Add the following to /etc/vserver/<vserver_name>/bcapabilities<br />
SYS_ADMIN<br />
Add the following to /etc/vserver/<vserver_name>/ccapabilities<br />
SECURE_MOUNT<br />
BINARY_MOUNT<br />
<br />
See [[Capabilities_and_Flags]] for more information about vserver capabilities.<br />
<br />
If you want the NFS shares to be mounted when the guest starts, add them to /etc/vserver/<vserver_name>/fstab.<br />
<br />
'''4)''' Before starting the guest, make a directory of the host "shared" using <tt>mount --make-shared /path/to/dir</tt>, then set up autofs to mount nfs shares under <tt>/path/to/dir/sharename</tt>.<br />
<br />
rbind mount subdirectories of <tt>/path/to/dir</tt> in the guest from its fstab.<br />
<br />
This setup is good if the nfs shares are not often needed, and especially if they're occasionally needed by more than one guest. (As of September 2011, running autofs inside a vserver guest didn't work for me. --[[User:KornAndras|Guy-]] 01:05, 30 October 2011 (UTC))<br />
<br />
||Signature=martindk}}<br />
<br />
<br />
{{Question<br />
|Question=vserver start/stop/enter fails with something like "vnamespace: execvp("/usr/sbin/vserver"): No such file or directory" ?<br />
||Details=Check whether ''/usr'' is mounted in the namespace you are working with.<br />
<pre>vnamespace -e <guest> cat /proc/mounts</pre><br />
If there is no ''/usr'', you can fix your problem with simply mounting it using the following command:<br />
<pre>vnamespace -e <guest> mount /dev/<device> /usr</pre><br />
<br />
||Signature=sim0n}}<br />
<br />
{{Question<br />
|Question=The command vserver <$server> start gives '/etc/init.d/rc: line 74: /etc/default/rcS: No such file or directory', what do I do? <br />
||Details=The vserver has not been correctly installed, this has several reasons<br />
check your install log and it should tell you something about that your server didn't get installed properly<br />
* use stable distribution of debian as server (debootstrap may be different over the versions)<br />
* deny_mount, deny_caps and deny_pivot should be off if your running grsec.<br />
<br />
||Signature=Dude}}<br />
<br />
<br />
{{Question<br />
|Question=How could I rename a vserver directory?<br />
||Details=Please note : this procedure renames the '''directory''', not the '''hostname''' !<br />
#Stop the vserver in question<br />
#rename the <tt>/vservers/<server name></tt> directory<br />
#rename the <tt>/etc/vservers/<server name></tt> directory<br />
#update link: <tt>/etc/vservers/<server name>/run</tt> → <tt>/var/run/vservers/<server name></tt><br />
#update link: <tt>/etc/vservers/<server name>/vdir</tt> → <tt>/etc/vservers/.defaults/vdirbase/<server name></tt><br />
#update link: <tt>/etc/vservers/<server name>/cache</tt> → <tt>/etc/vservers/.defaults/cachebase/<server name></tt><br />
#update link: <tt>/var/run/vservers.rev/<server XID></tt> → <tt>/etc/vservers/<server name></tt><br />
#Start the vserver in question. It should start properly.<br />
<br />
|Signature=FlorianD (from ''hillct'' page in old wiki)}}<br />
<br />
<br />
{{Question<br />
|Question=what if i see my vserver in vserver-stat but with no name ?<br />
||Details=the link in /var/run/vservers is missing<br />
Just do a : cat /etc/vservers/<guest>/context > /var/run/vservers/<guest><br />
check that the <guest> is the good one by using vuname --get --xid <context> with the context you have in the vserver-stat listing.<br />
|Signature=IrcQuestions}}<br />
<br />
== Upgrade from 2.0 to 2.2 ==<br />
<br />
{{Question<br />
|Question=I now get errors like "ncontext: vc_net_create(): Invalid argument; dynamic contexts disabled." on startup. Vservers are not started<br />
||Details=Dynamic context are disabled by default and are deprecated. For example, tagxid and network checks won't be useable with dynamic ids. Now you should manually assign a explicit context to your vservers, like<br />
echo 101 > /etc/vservers/myvserv/context<br />
ADDENDUM: please consider that valid static contexts are between 2 and 49151 ( daniel_hozac on IRC ) otherwise you will end up with unexplainable error "ncontext: vc_net_migrate(): No such process" when trying to start the vserver.<br />
<br />
|Signature=daniel_hozac&Beuc}}<br />
<br />
<br />
{{Question<br />
|Question=How do I assign a static context to an existing vserver?<br />
||Details=Simple ;) See the answer above. <br />
|Signature=gcc}}<br />
<br />
<br />
{{Question<br />
|Question=Since upgrading to a newer VS version my guest complains about "vsched: non-numeric value specified for '--priority_bias" at start time. What's wrong?<br />
||Details=The scheduler paramters changed.You can use this (ugly) script to convert them or do it by hand:<br />
<pre><br />
# cat /usr/local/sbin/vserver-convert-schedule-to-scheddir<br />
#/bin/sh<br />
mkdir /etc/vservers/$1/sched<br />
sed -e 1p -n /etc/vservers/$1/schedule > /etc/vservers/$1/sched/fill-rate<br />
sed -e 2p -n /etc/vservers/$1/schedule > /etc/vservers/$1/sched/interval<br />
sed -e 3p -n /etc/vservers/$1/schedule > /etc/vservers/$1/sched/tokens<br />
sed -e 4p -n /etc/vservers/$1/schedule > /etc/vservers/$1/sched/tokens-min<br />
sed -e 5p -n /etc/vservers/$1/schedule > /etc/vservers/$1/sched/tokens-max<br />
<br />
mv /etc/vservers/$1/schedule /etc/vservers/$1/schedule.converted.see.scheddir<br />
<br />
# see: http://oldwiki.linux-vserver.org/Scheduler+Parameters<br />
# see: http://www.nongnu.org/util-vserver/doc/conf/configuration.html#sched<br />
</pre><br />
||Signature=derjohn}}<br />
<br />
<br />
{{Question<br />
|Question=Since upgrading to a newer VS version my guest doesn't have the amount of shared memory (SHM / SHMMAX / SHMALL ) as it had in the former version. What changed?<br />
||Details=Every VS version that runs on a kernel >= 2.6.19 offers sysctl values per guest. This has to do with the 'ipc namespace' feature that was added to the mainline kernel in version 2.6.19. Linux-VServer uses that feature to give each guest a separate 'ipc namespace' and thus 'own' sysctl values per guest. Because shmmax is such a sysctl value, you have to set it per guest.<br />
Here is an example how to do so:<br />
<br />
<pre><br />
# mkdir /etc/vservers/<vserver>/sysctl/0 -p<br />
# echo kernel.shmall > /etc/vservers/<vserver>/sysctl/0/setting<br />
# echo 134217728 > /etc/vservers/<vserver>/sysctl/0/value<br />
# mkdir /etc/vservers/<vserver>/sysctl/1 -p<br />
# echo kernel.shmmax > /etc/vservers/<vserver>/sysctl/1/setting<br />
# echo 134217728 > /etc/vservers/<vserver>/sysctl/1/value<br />
</pre><br />
It's also explained on the geat flower page:<br />
# see: http://www.nongnu.org/util-vserver/doc/conf/configuration.html -> Look for "sysctl".<br />
<br />
After changing those values, restart your guest, enter it and check if the values are set:<br />
<pre><br />
# sysctl -a | grep shm<br />
...<br />
kernel.shmall = 134217728<br />
kernel.shmmax = 134217728<br />
</pre><br />
<br />
To change a value for a running guest, on the host use:<br />
<pre><br />
vspace -e CONTEXTID --ipc sysctl -w kernel.shmall=134217728<br />
vspace -e CONTEXTID --ipc sysctl -w kernel.shmmax=134217728<br />
</pre><br />
<br />
||Signature=derjohn<br />
}}<br />
<br />
[[Category:Community]]<br />
[[Category:Categories]]</div>AdrianReyerhttp://www.linux-vserver.org/Frequently_Asked_QuestionsFrequently Asked Questions2011-05-25T08:04:45Z<p>AdrianReyer: </p>
<hr />
<div><div style="margin: 2em auto 2em auto; padding: 10px; background-color: #F9ECCD; border: 1px solid #004433; text-align: center;"><br />
[[Image:Icon-Caution.png|left]]<br />
We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the [[Wiki Team]] page for instructions how to help or look at the [http://oldwiki.linux-vserver.org old wiki] to find the information not migrated yet.<br />
<br />
'''To ease migration we created a [[List of old Documentation pages]].'''<br />
</div><br />
<br />
CURRENTLY THE CONTENT OF THE OLD WIKI FAQ (AND MORE) IS BEING MIGRATED TO THIS PAGE (TASK: DERJOHN)<br />
<br />
<br />
__TOC__<br />
<br />
== General ==<br />
<br />
{{Question<br />
|Question=What is a 'Guest'?<br />
||Details=To talk about stuff, we need some naming. The physical machine is called 'Host' and the 'main' context running the Host Distro is called 'Host Context'. The virtual machine/distro is called 'Guest' and basically is a Distribution (Userspace) running inside a 'Guest Context'.<br />
|Signature=derjohn}}<br />
<br />
<br />
{{Question<br />
|Question=What kind of Operating System (OS) can I run as guest?<br />
||Details= With VServer you can only run Linux guests. The trick is that a guest does not run a kernel on its own (as XEN and UML do), it merely uses a virtualized host kernel-interface. VServer offers so called security contexts which make it possible to separate one guest from each other, i.e. they cannot get data from each other. Imagine it as a chroot environment with much more security and features.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Is this a new project? When was it started?<br />
||Details=The first public occurrence of Linux-VServer was Oct 2001. The initial mail can be found here: http://www.cs.helsinki.fi/linux/linux-kernel/2001-40/1065.html<br />
So you can expect a mature software product which does its magic quite well (And hey, we have a version > 2.0!)<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Which distributions did you test?<br />
||Details=Some. Check out the wiki for ready-made guest images. But you can easily build own guest images, e.g. with Debian's debootstrap. Checkout [[Building Guest Systems]] how to do that.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Is VServer comparable to XEN/UML/QEMU?<br />
||Details=Nope. XEN/UML/QEMU and VServer are just good friends. Because you ask, you probably know what XEN/UML/QEMU are. VServer in contrary to XEN/UML/QEMU does not "emulate" any hardware you run a kernel on. The purpose of Linux VServer is to isolate (groups of) applications. The isolation is done by the kernel (see [[Overview]] for a more detailed comparison). You can run a VServer kernel in a XEN/UML/QEMU guest. This is confirmed to work at least with Linux 2.6/vs2.0.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=With which version should I begin?<br />
||Details=If you are new to VServer I recommend to try the latest stable kernel patch, and the latest util-vserver "alpha" release.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Is VServer secure?<br />
||Details=We hope so. It should be as least as secure as Linux is. We consider it much much more secure though.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Performance?<br />
||Details=For a single guest, we basically have native performance. Some tests showed insignificant overhead (about 1-2%) others ran faster than on an unpatched kernel. This is IMVHO significantly less than other solutions waste, especially if you have more than a single guest (because of the resource sharing).<br />
|Signature=derjohn}}<br />
<br />
<br />
{{Question<br />
|Question=What is the "great flower page"?<br />
||Details=Well, [http://www.nongnu.org/util-vserver/doc/conf/configuration.html this page] contains all configuration options for util-vserver. The name of the page is derived from the stylesheet(s) it contains.<br />
|Signature=derjohn}}<br />
<br />
<br />
<br />
== Resources usage ==<br />
<br />
{{Question<br />
|Question=Resource sharing?<br />
||Details=Yes ....<br />
* memory: Dynamically.<br />
* CPU usage: Dynamically (token bucket)<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Resource limiting?<br />
||Details=You can put limits per guest on different subsystems.<br />
* using ulimits and rlimits (rlimit is a new feature of kernel 2.6/vs2.0.) per guest, to limit the memory consumption, the number of processes or file-handles, ... : see [[Resource Limits]]<br />
* CPU usage : see [[CPU Scheduler]]<br />
* disk space usage : see [[Disk Limits and Quota]]<br />
Note that you can only offer guaranteed resource availability with some ticks at the time.<br />
|Signature=derjohn&xm}}<br />
<br />
{{Question<br />
|Question=How do I limit a guests RAM? I want to prevent OOM situations on the host!<br />
||Details=First you can read [http://linux-vserver.org/Memory+Allocation] and [[Memory Limits]].<br />
If you want a recipe, do this:<br />
# Check the size of memory pages. On x86 and x86_64 is usually 4 KB per page. (on linux "getconf -a|grep PAGE" will give you the information)<br />
# Create /etc/vserver/<guest>/rlimits/<br />
# Check your physical memory size on the host, e.g. with "free -m". maxram = kilobytes/pagesize.<br />
# Limit the guests physical RAM to value smaller then maxram:<pre>echo %%insertYourPagesHereSmallerThanMaxram%% > /etc/vserver/<guest>/rlimits/rss </pre><br />
# Check your swapspace, e.g. with 'swapon -s'. maxswap = swapkilobytes/pagesize.<br />
# Limit the guest's maximum number of as pages to a value smaller than (maxram+maxswap): <pre> echo %%desiredvalue%% > /etc/vserver/<guest>/rlimits/as </pre><br />
# Correctly display the memory information inside the guest:<pre>echo "VIRT_MEM" >> /etc/vservers/<guest>/flags</pre><br />
It should be clear this can still lead to OOM situations. Example: You have two guests and your as limit per guest is greater than 50% of (maxram+maxswap). If both guests request their maximum at the same point in time, there will be not enough mem .....<br />
|Signature=derjohn}}<br />
<br />
<br />
{{Question<br />
|Question=Disk I/O limiting? Is that possible?<br />
||Details=Well, since vs2.1.1 Linux-VServer supports a mechanism called 'I/O scheduling', which appeared in the 2.6 mainline some time ago. The mainline kernel offers several I/O schedulers:<br />
<pre><br />
# cat /sys/block/hdc/queue/scheduler<br />
noop [anticipatory] deadline cfq<br />
</pre><br />
<br />
The default is anticipatory a.k.a. "AS". When running several guests on a host you probably want the I/O performance shared in a fair way among the different guests. The kernel comes with a "completely fair queueing" scheduler, CFQ, which can do that. (More on schedulers can be found at http://lwn.net/Articles/114770/)<br />
This is how to set the scheduler to "cfq" manually:<br />
<pre><br />
root# echo "cfq" > /sys/block/hdc/queue/scheduler<br />
root# cat /sys/block/hdc/queue/scheduler<br />
noop anticipatory deadline [cfq]<br />
</pre><br />
Keep in mind that you have to do it on all physical discs. So if you run an md-softraid, do it to all physical /dev/hdXYZ discs!<br />
If you run Debian there is a predefined way to set the /sys values at boot-time:<br />
<pre><br />
# apt-get install sysfsutils<br />
[...]<br />
<br />
# grep cfq /etc/sysfs.conf<br />
block/sda/queue/scheduler = cfq<br />
block/sdc/queue/scheduler = cfq<br />
<br />
# /etc/init.d/sysfsutils restart<br />
</pre><br />
<br />
For non-vserver processes and CFQ you can set by which key the kernel decides about the fairness:<br />
<pre><br />
cat /sys/block/hdc/queue/iosched/key_type<br />
pgid [tgid] uid gid<br />
</pre><br />
Hint: The 'key_type'-feature has been removed in the mainline kernel recently. Don't look for it any longer :(<br />
<br />
The default is tgid, which means to share fairly among process groups. Think every guest is treated like a own process group. It's not possible to set a scheduler strategy within a guest. All processes belonging to the same guest are treated like "noop" within the guest. So: If you run apache and some ftp-server within the _same_ guest, there is no fair scheduling between them, but there is fair scheduling between the whole guest and all other guests.<br />
<br />
And: It's possible to tune the scheduler parameters in several ways. Have a look at /sys/block/hdc/queue/....<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Nice disk I/O scheduling, is that possible?<br />
||Details=Well, since linux 2.6.13 processess have another priority next to the cpu nice scheduling hint, it's called io nice.<br />
It's split into three groups, called real-time, best effort and idle. The default is best-effort, but within best-effort, you can have a niceness from 0 to and including 7.<br />
You can set this niceness by the tool ionice, which for debian is either in the package util-linux or schedutils.<br />
To change the io-niceness you need the <tt>CAP_SYS_NICE</tt>, '''and''' need to have the same uid as the processe you want to ionice.<br />
<br />
:'''Note:''' If you want to use any schedulung other than best-effort you will also need the <tt>CAP_SYS_ADMIN</tt>-flag. Be warned that this gives quite some capabilities to the vserver, not just for I/O scheduling!<br />
<br />
If you want to increase the niceness of an I/O hogging process within a vserver you need to do:<br />
<PRE><br />
chcontext --xid sponlp1 sudo -u '#2089' ionice -c2 -n5 -p24409<br />
</PRE><br />
with sudo and ionice installed on the root server to increase the *nice*ness of pid 24409, with uid 2089<br />
|Signature=Groteblup}}<br />
<br />
== Unification ==<br />
<br />
{{Question<br />
|Question=What is unification (vunify)?<br />
||Details=Unification is Hard Links on Steroids. Guests can 'share' common files (usually binaries and libraries) in a secure way, by creating hard links with special properties (immutable but unlinkable (removable)). The tool to identify common files and to unify them is called vunify.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=What is vhashify?<br />
||Details=The successor of vunify, a tool which does unification based on hash values (which allows to find common files in arbitrary paths.)<br />
It creates hardlinks to files named after a hash of the content of the file. If you have a recent version of the vserver patch (2.2+), with CONFIG_VSERVER_COWBL enabled, you can even modify the hardlinked files inside the vservers and the links will be broken automatically.<br />
There seems to be a catch when a hashified file has multiple hardlinks inside a guest, or when another internal hardlink is added after hashification. Link breaking will remove all the internal hardlinks too, so the guest will end up with different copies of the original file. The correct solution would be to not hashify files that have multiple links prior to hashification, and to break the link to the hashified version when a new internal hardlink is created. Apparently, this is not implemented yet (?).<br />
|Signature=Guy-}}<br />
<br />
{{Question<br />
|Question=How do I manage a multi-guest setup with vhashify?<br />
||Details=For 'vhashify', just do these once:<br />
<pre><br />
mkdir /etc/vservers/.defaults/apps/vunify/hash /vservers/.hash<br />
ln -s /vservers/.hash /etc/vservers/.defaults/apps/vunify/hash/root<br />
</pre><br />
Then, do this one line per vserver:<br />
<pre><br />
mkdir /etc/vservers/<vservername>/apps/vunify # vhashify reuses vunify configuration<br />
</pre><br />
To hashify a running vserver, do (possibly from a cronjob):<br />
<pre><br />
vserver name-of-guest hashify<br />
</pre><br />
<br />
The guest needs to be running because vhashify tries to figure out what files not to hashify by calling the package manager of the guest via <tt>vserver enter</tt>.<br />
<br />
In order for the OS cache to benefit from the hardlinking, you'll have to restart the vservers.<br />
<br />
To clean up hashified files that are no longer referenced by any vserver, do (possibly from a cronjob):<br />
<pre><br />
find /vservers/.hash -type f -links 1 -print0 | xargs -0 rm<br />
</pre><br />
<br />
Until you do this, the files still take up place even though no vservers need them.<br />
|Signature=Guy-}}<br />
<br />
== Filesystem usage ==<br />
<br />
{{Question<br />
|Question=Is there a way to implement "user/group quota" per VServer?<br />
||Details=Yes, but not on a shared partition for now. You need to put the guest on a separate partition, setup a vroot device (to make the quota access secure), copy that into the guest, and adjust the mtab line inside the guest. If 8 vroot device is not enough for you, you can add more with the kernel parameter max_vroot (exemple for built in kernel vroot /vmlinuz-2.6.31.6-vs2.3.0.36.26aq root=/dev/md1 ro max_vroot=20 ). If vroot is a module you'd actually want to put for exemple "options vroot max_vroot=20" in /etc/modprobe.conf and then just do modprobe vroot<br />
|Signature=derjohn,gadnet}}<br />
<br />
{{Question<br />
|Question=What about "Quota" for a context? Howto limit disk usage?<br />
||Details=Context quotas are now called Disk Limits (so that we can tell them apart from the user/group quotas :). They are supported out of the box (with vs2.0+) for all major filesystems (ext2/3, ReiserFS, JFS). You need to tag the FS with XID (see below). Please read [[Disk Limits and Quota]] for more information.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=How do I tag a guest's directory with xid?<br />
||Details=Tagging the guest's files gives you several advantages, e.g. the accounting will work properly.<br />
Filesystem XID tagging only works on supported filesystem. Those are currently: ext2/3, reiserfs/reiser3, xfs and jfs.<br />
To activate the XID tagging you have to mount the filesystem with "-o tag" (former tagxid is outdated since VS2.2). Attention: It's _not_ possible to "-o remount,tag", you have to mount it freshly. The guests will tag their files automatiaclly. If you copy files in from the host, you have to tag them manually like this:<br />
<pre><br />
chxid -c xid -R /var/lib/vservers/<guest><br />
</pre><br />
Note: Context 0 and 1 will see all files, guests will only be able to access untagged files and their own XID. They can see other XID files but no information about the file, e.g. no owner, no group, no permissions.<br />
Note: It is not advised to tag the root filesystem, as [http://www.paul.sladen.org/vserver/archives/200602/0020.html explained by Herbert] : trying to do so will expose you to some troubles !<br />
|Signature=derjohn_and_gonzo_and_are}}<br />
<br />
{{Question<br />
|Question=How can I copy anything from host to guest partition, normally unvisible on host?<br />
||Details=You should just change namespace, e.g.:<br />
<pre><br />
vnamespace --enter <xid> -- /bin/bash<br />
</pre><br />
and then use standard cp or rsync programs.<br />
|Signature=SergiuszPawlowicz}}<br />
<br />
{{Question<br />
|Question=Why is the barrier attribute disappearing on reiserfs filesystem after umount or host reboot?<br />
||Details=The filesystem has to be mounted with explicitly defining the 'attrs' option, i.e. <br />
<pre><br />
mount /dev/reiserfsdev /vservers -oattrs<br />
setattr --barrier /vservers<br />
</pre><br />
to get the barrier survive after umount/reboot.<br />
|Signature=Nikolay Kichukov}}<br />
<br />
== Network ==<br />
<br />
{{Question<br />
|Question=Does it support IPv6?<br />
||Details=Currently it requires an additional patch, but the functionality should be available in 2.3+ soon. [[IPv6]] has more information.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=I can't do all I want with the network interfaces inside the guest?<br />
||Details=For now the networking is 'Host Business' -- the host is a router, and each guest is a server. You can set the capability ICMP_RAW in the context of the guest, or even the capability CAP_NET_RAW (which would even allow to sniff interfaces of other guests!). Likely to change with ngnet.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=How do I add several IPs to a vserver?<br />
||Details=First of all a single guest vserver only supports up to 16 IPs (There is a 64-IP patch available, which is in "derjohn's kernel").<br />
Here is a little helper-script that adds a list of IPs defined in a text file, one per line.<br />
<pre><br />
#!/bin/bash<br />
j=1<br />
for i in `cat myiplist`; do<br />
j=$(($j+1))<br />
mkdir $j<br />
echo $i > $j/ip<br />
echo "24" > $j/prefix<br />
done<br />
</pre><br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=How do I assign a new IP address to a running guest?<br />
||Details=This is done from the host server:<br />
* add the ip on the host, for example<br />
<pre><br />
ip addr add 194.169.123.23/24 dev eth0 <br />
</pre><br />
* add the ip to the guest's network context (a guests NID is the same as the XID {context ID})<br />
<pre><br />
naddress --add --nid <nid> --ip 194.169.123.23/24 <br />
</pre><br />
* enter the guest (best via ssh) <br />
* restart the services that need to make use of the new address if required <br />
* update the config in ''/etc/vserver/<servername>/interfaces'' to reflect the changes for the next guest restart (if desired)<br />
|Signature=BenjaminGreen}}<br />
<br />
{{Question<br />
|Question=If my host has only one a single public IP, can I use RFC1918 IP (e.g. 192.168.foo.bar) for the guest vservers?<br />
||Details=Yes, use iptables with SNAT to masquerade it. <br />
<pre><br />
iptables -t nat -I POSTROUTING -s $VSERVER_NETZ ! -d $VSERVER_NETZ -j SNAT --to $EXT_IP<br />
</pre><br />
See: [[HowtoPrivateNetworking]] and <br />
http://www.tgunkel.de/it/software/doc/linux_server.en#h3-VServer_Masquerading_SNAT (THX, [MUPPETS]Gonzo)<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=If I shut down my vserver guest, the whole Internet interface ethX on the host is shut down. What happened?<br />
||Details=When you shut down a guest (''i.e. vserver foo stop''), the IP is brought down on the host also. If this IP happens to be the primary IP of the host, the kernel will not only bring down the primary IP, but also all secondary IP addresses. But in very recent kernels, there is an option ''settable'' which prevents that nasty feature. It's called "alias promotion". You may set it via sysctl by adding ''net.ipv4.conf.all.promote_secondaries=1'' in /etc/sysctl.conf or via sysctl command line.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Can I run an OpenVPN Server in a guest?<br />
||Details=<br />
Yes. To get a OpenVPN Server running in a guest, all networking setup has to be done on the host. This answer describes the common case and shows some pitfalls, for detailled information about OpenVPN, please consult the appropriate documentation on the OpenVPN homepage.<br />
This is the minimal OpenVPN configuration for the Server which will be used to demonstrate how to get it running in a client:<br />
<pre><br />
# Networking setup<br />
server 192.168.16.0 255.255.255.0<br />
dev tun16<br />
ifconfig-noexec<br />
comp-lzo<br />
# Certificates<br />
dh ...<br />
ca ...<br />
cert ...<br />
key ...<br />
# Management<br />
persist-key<br />
keepalive 10 60<br />
verb 4<br />
</pre><br />
First of all you have to prepare the host with a persistent interface in the right mode and with the right settings. This is easily done by using openvpn and the ip and route tools.<br />
<pre><br />
# openvpn --mktun --dev tun16<br />
# ip link set dev tun16 txqueuelen 100<br />
# ifconfig tun16 192.168.16.1 pointopoint 192.168.16.2 mtu 1500<br />
# route add -net 192.168.16.0 netmask 255.255.255.0 gw 192.168.16.2<br />
</pre><br />
If you need different settings, openvpn will tell you the ifconfig and route commands it uses to configure the interface when being started on the host with the original config file, but without ifconfig-noexec.<br />
Additionally, the guest needs /dev/net/tun to make OpenVPN happy. This can be created with MAKEDEV:<br />
<pre><br />
# cd /var/lib/vserver/<myopenvpnserver>/dev/<br />
# ./MAKEDEV tun<br />
(creates the dev/net/tun device accessible by the guest - even a tap interface needs /dev/net/tun !)<br />
</pre><br />
Finally, the guest needs to have the tun device assigned:<br />
<pre><br />
# head /etc/vservers/<myopenvpnserver>/interfaces/1/*<br />
==> /etc/vservers/<myopenvpnserver>/interfaces/1/ip <==<br />
192.168.16.1<br />
<br />
==> /etc/vservers/<myopenvpnserver>/interfaces/1/nodev <==<br />
tun16<br />
<br />
==> /etc/vservers/<myopenvpnserver>/interfaces/1/prefix <==<br />
24<br />
#<br />
</pre><br />
The client's conf may look like that:<br />
<pre><br />
# Basic setup<br />
client<br />
proto tcp-client<br />
dev tun<br />
remote <ipaddress><br />
comp-lzo<br />
verb 4<br />
<br />
# Certificate<br />
ca ...<br />
</pre><br />
<br />
[ Based on derJohn's original answer, all errors mine ] <br />
|Signature=DavidS}}<br />
<br />
{{Question<br />
|Question=Trying to connect to a vserver from the host or another vserver on the same host fails<br />
||Details=strace shows<br />
<pre> <br />
sin_addr=inet_addr("xx.xx.xx.xx")}, yy) = -1 EINVAL (Invalid argument)<br />
</pre><br />
A: The host/guest cannot communicate with another guest on same host.<br />
* check all netmasks on all interfaces (do they overlap) ?<br />
* check policy routing (disable it temporary) ?<br />
* check that lo is up (Networking within a host/guest always uses lo interface)<br />
|Signature=CommonProblems}}<br />
<br />
{{Question<br />
|Question=Can I use iptables ?<br />
||Details=Yes but right now only on the host (rootserver). Please realize that all traffic is local and will not touch the forward chain.<br />
<br>If you really, really, really need iptables on the guest and you are aware about loosing a big part of VServer isolation and security you could add the NET_ADMIN capability. Consider writing wrappers to manage iptables on the host instead.<br />
|Signature=_are_}}<br />
<br />
{{Question<br />
|Question=Is it possible to prevent guest from bringing down primary ip?<br />
||Details=Yes. Remove /etc/vservers/<guest>/interfaces/X/dev, and touch /etc/vservers/<guest>/interfaces/X/nodev<br />
|Signature=Daniel&Serge}}<br />
<br />
{{Question<br />
|Question=Is it possible to provide a different MAC address per vServer?<br />
||Details=Short answer - yes but it's a hassle.<br />
<br />
Real answer from '''_are_''':<br />
<pre><br />
When I once needed 'real' seperate MAC-addresses I used TAP-devices and VDE2 ([http://vde.sourceforge.net/ Virtual Distributed Ethernet]).<br />
Basically vServer is an isolation of existing resources, not a virtualization of 'new' devices.<br />
Without extra fuss you can't add a 'new' network interface to a vServer, no matter if it is eth* or tap*, you always add it to the host and give the vServer access to it.<br />
I got the TAP+VDE2 up and running, but I think it is too much trouble for basically the simple adding of IPs to a vServer unless you really need the MAC address separate.<br />
</pre><br />
<br />
<br />
You can also utilize MACVLAN ability from kernel.<br />
I.e. create ''macvlan0'' interface with:<br />
<pre>ip link add link eth0 address 00:19:d1:29:d2:58 macvlan0 type macvlan</pre><br />
[[http://jim.studt.net/depository/index.php/notes-on-linux-s-macvlan-module Reference]]<br />
|Signature=bobnormal&swenTjuln<br />
}}<br />
<br />
{{Question<br />
|Question=Is it possible to hide packet counters on the host network interface from vServer guests?<br />
||Details=Yes, see [[Networking_vserver_guests|Networking vServer Guests]]<br />
|Signature=bobnormal}}<br />
<br />
{{Question<br />
|Question=Services won't bind to 127.0.0.1 when I configure them to bind to all available IPs / (binding service to * doesn't bind to loopback)?<br />
||Details=You've configured single public IP and have kernel option "Linux VServer -> Automatic Single IP Special Casing" enabled.<br />
It means somehow "optimized" :D<br />
If you don't want this you have 3 possible solutions (quoting Bertl):<br />
* disable the auto single IP in the kernel<br />
* assign more than one IP to the guest<br />
* disable single ip special casing for that guest<br />
<br />
The later is done by : echo "~single_ip" >> /etc/vservers/<VSERVER>/nflags<br />
At runtime to avoid restarting the vserver: nattribute --set --nid <guest> --flag ~single_ip<br />
|Signature=swenTjuln}}<br />
<br />
== Administration tools ==<br />
<br />
{{Question<br />
|Question=Which guest vservers are running?<br />
||Details=Use vserver-stat to find out. Example output:<br />
<pre><br />
CTX PROC VSZ RSS userTIME sysTIME UPTIME NAME<br />
0 77 965.1M 334.6M 14m14s18 2m28s69 1h33m46 root server<br />
49152 7 14M 5.2M 0m00s40 0m00s30 1h30m15 chiffon<br />
</pre><br />
|Signature=derjohn}}<br />
<br />
<br />
{{Question<br />
|Question=Is there a web-based interface for vserver that will allow creation/deletion/configuration etc. of vserver guests?<br />
||Details=<br />
* http://OpenVPS.org which is a set of scripts with a web-interface for webhosters/ISPs<br />
* http://Openvcp.org which is a distributed system (agent!) with a web-interface, with which you can build/remove guests<br />
* http://vsmon.revolutionlinux.com/ is a distributed monitoring-only solution that allows you to search for a particular vserver in your park.<br />
|Signature=derjohn}}<br />
<br />
== Hosting foreign distributions ==<br />
<br />
{{Question<br />
|Question=I run a Debian host and want to build an Ubuntu guest. Howto?<br />
||Details=Simple ;) Assume you want to build a breezy guest on a sid host with IP 192.168.0.2 and hostname vubuntu, then do:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu<br />
</pre><br />
<br />
[UPDATE] Currently there are problems in building breezy under unclear circumstances, which seems to have to do with udev. If the above didnt work, try:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu -- --exclude=udev<br />
</pre><br />
In very recent versions of the utils, the problem should not occur anymore (it has to do with the 'secure-mount' if you look in the MLs)<br />
<br />
Well, sid's debootstrap knows how to bootstrap Ubuntu linux. Make sure to have a current debootstrap package: <br />
<pre><br />
apt-get update<br />
apt-get install debootstrap<br />
</pre><br />
The knowledge how to build ubuntu 'breezy badger' (which you probably want to be your guest at the time of writing) has been added recently.<br />
|Signature=derjohn}}<br />
<br />
<br />
{{Question<br />
|Question=I want to build a Gentoo guest. Howto?<br />
||Details=Even simpler ;) See http://www.gentoo.org/proj/en/vps/vserver-howto.xml#doc_chap3 .<br />
|Signature=gcc}}<br />
<br />
== Application level problems ==<br />
<br />
{{Question<br />
|Question=I did everything right, but the application foo does not start. What's up there?<br />
||Details=Before asking on the IRC channel, please check out the 'problematic programs' page:<br />
[[Problematic Programs]]<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=When I try to ssh to the guest, I log into the host, even if I installed sshd on the guest. What's wrong here?<br />
||Details=Look at /etc/ssh/sshd_config of the host:<br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
#ListenAddress ::<br />
</pre><br />
And now change the setting to <br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
ListenAddress your.hosts.ip.here # not the guests IP! <br />
</pre><br />
Then '/etc/init.d/ssh restart' on the host, after that on the guest (if you did apt-get install ssh on the guest already.)<br />
Do I have to explain more? If the hosts sshd binds all available IP addresses on port 22 (The hosts 'sees' even all addresses of the guests!). So if the guest starts its sshd, it can't bind to port 22 any more. You need to change that setting only on the host. <br />
(BTW: A similar approach has to be done for a lot of daemons, e.g. Apache. If the daemon does not support an explicit bind, you may use the chbind command to 'hide' IP addresses from the daemon before starting.)|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Bind9 does not like to start in my guest.<br />
||Details=Check out the [[Problematic Programs]] page and/or get my [http://linux-vserver.derjohn.de/bind9-packages/bind9-capacheck_9.3.2-2_i386.deb vserver-guest-ready Debian package] for Debian Sid guests and check out the [http://linux-vserver.derjohn.de/bind9-packages/README.txt readme]. (Hint: This is fresh stuff. Please give me feedback)<br />
<br />
[UPDATE] Since VServer Devel 2.1.1-rc18 you do not need to patch the userland tools anymore. The capabilities are masked.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=My mysqld running in a guest behaves strangely and is awfully slow/locks up<br />
||Details=This can be related to /tmp being too small. mysqld stores temporary tables in /tmp and as such, if a lot of queries happen and /tmp runs full this can cause one query to lock up whilst creating the tmp table and all other queries waiting to acquire the lock. There are two possible solutions to that problem: a.) Modify /etc/vservers/vserver-name/fstab and assign more memory to the tmpfs of /tmp and b.) remove the /tmp entry from /etc/vservers/vserver-name/fstab completly. Especially on database servers with a rather high load the second one might be the preferred method.|Signature=sp}}<br />
<br />
{{Question<br />
|Question=Pure-FTP does not run inside a VServer?<br />
||Details=That's because it has capabilities enabled, make sure you rebuild your distro's package passing also the `--without-capabilities` flag to configure.<br />
|Signature=Pedro Algarvio, aka, s0undt3ch}}<br />
<br />
{{Question<br />
|Question=Why do neither sshd nor crond (vixie-cron) work correctly in my CentOS / Fedora guest? I get 'pam_loginuid(crond:session): set_loginuid failed opening loginuid' and similar lines in my logs.<br />
||Details=Took me a while to figure this out, and it turned out to be mentioned in the old wiki. Here is the solution on how to solve a common problem with sshd / crond, somehow related to selinux and auditing:<br />
<br />
pam authentication (also used with openssh) enables "pam_loginuid.so" in the /etc/pam.d/* files. Comment those out as they are not necessary and will not load within a guest anyway. This probably is also necessary on updates later on, if the configs get changed. You therefore may add the following command line to a cronjob file or your software update script:<br />
<pre><br />
/bin/sed --in-place -e "s/^session.*required.*pam_loginuid.so/# session\trequired\tpam_loginuid.so/g" /etc/pam.d/*<br />
</pre><br />
|Signature=patrick}}<br />
<br />
{{Question<br />
|Question=How do i install nagios-plugins on a Gentoo guest?<br />
||Details=Unfortunately, the nagios-plugins ./configure scripts wants to ping 127.0.0.1 which is not available inside a guest. Therefore you have to build nagios-plugins outside the guest.<br />
The easiest way to do this from the host (assuming the guest is running) is:<br />
<pre><br />
vnamespace -e <xid> -- chroot /vservers/<name> emerge nagios-plugins -va<br />
</pre><br />
|Signature=Hollow}}<br />
<br />
{{Question<br />
|Question=Somebody runs ntpd in guest and you can't use ntpdate in host?<br />
||Details=Try to run ntpdate with options -u :<br />
ntpdate -u ntp.domain.xy<br />
or you can use command:<br />
chbind --nid 42 --ip 1.2.3.4 -- ntpdate ntp.domain.xy<br />
where IP will be the IP of host.<br />
|Signature=Punkie/Bertl}}<br />
<br />
<br />
<br />
== Start / Stop a VServer ==<br />
<br />
{{Question<br />
|Question=How do I make a vserver guest start by default?<br />
||Details=At least on Debian, I can tell you how to do it with the new-style config. If your guest is called "derjohn" and you want it to be started somewhere at the of your bootstrap process, then do:<br />
<pre><br />
echo "default" > /etc/vservers/derjohn/apps/init/mark<br />
</pre><br />
If you want to start it earlier, please read the init script "/etc/init.d/util-vserver" to find out how to do it. In most cases you don't need to change this. On Debian the vservers are started at "20", so after most other stuff is up (networking etc.).<br />
<br />
Besides that I created a small helper script for managing the autostart foo: ((vserver-autostart))|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=My host works, but when I start a guest it says that it has a problem with chbind.<br />
||Details=You are probably using util-vserver <= 0.30.209, which does use dynamic network contexts internally (With 0.30.210 this fact changed). So if you compiled your kernel without dynamic contexts, you may start guests, but you can't use the network context.The solution is either to switch to .210 util (or Hollow's toolset) or compile the kernel with dynamic network contexts.<br />
SE Keyword: invalid option `nid' testme.sh<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=What is old-style and new-style config?<br />
||Details=Old-style config refers to a single text-file that contains all the configuration settings. With new-style config the configuration is split into several directories and files. You should probably go for new-style config if you are asking.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=How can I reboot/halt guests?<br />
||Details=It depends. <br />
For legacy Linux-VServer (i.e. 1.2.x), you have to replace /sbin/halt in the guests with vreboot and start rebootmgr in the host. You also need to have a <guest>.conf file in /etc/vservers for each guest. Please have a look at /etc/init.d/rebootmgr.<br />
For Linux-VServer 2.0+, sys_reboot has been virtualized to do the right thing. No changes are needed in guests. Please note that some things depend on the init style used by the guest : read [[util-vserver:InitStyles]]<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=What is the initial PATH?<br />
||Details=By default, vserver uses the 'sysv' startup style, which mimics the init process by running the 3rd runlevel through '/etc/init.d/rc 3' (or '/etc/rc.d/rc 3'). Usually this 'rc' script uses a hard-coded PATH. In the case it doesn't, util-vserver also mimics init's default PATH through /etc/vservers/.defaults/apps/init/environment, or if not present /usr/local/lib/util-vserver/defaults/environment. Beware that all those default PATH usually do not include /usr/local.<br />
|Signature=daniel_hozac&Beuc}}<br />
<br />
{{Question<br />
|Question=When I try to start a guest i get this message "/proc/uptime can not be accessed. Usually, this is caused by procfs-security. Please read the FAQ for more details"?<br />
||Details=After a reboot you need to run the vprocunhide script. If running this script causes many errors to print on the screen, try checking the kernel you have booted with (perhaps it does not have the linux-vserver extensions enabled).<br />
|Signature=mattzerah}}<br />
<br />
== Kernel ==<br />
<br />
{{Question<br />
|Question=Is SMP Supported?<br />
||Details=Yes, on all SMP capable kernel architectures.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Do I really need the legacy-interfaces? What are these legacy-interfaces?<br />
||Details=Since Linux-VServer is an ongoing project, new features might replace old ones, some might require a development version. Legacy-interfaces are available for backward compability (which might be removed someday) with Linux-VServer 1.2.x.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=I have a vserver running on a Linux kernel with preemption. Is VServer "preempt" safe?<br />
||Details=There are no known issues about running vserver on a preemption enabled kernel. I would like to add, that the vserver kernelhackers would probably exclude that option in 'make menuconfig' if there would be an incompatibility. Just my $.02 :)<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=32 vs 64 Bit? What should I take?<br />
||Details=If you have the choice make the host a 64 bit one. You can run a guest as 32 bit or as 64 bit on a 64 bit host. To run it as 32 bit, you need to compile the x86_64 (a.k.a. AMD64) with the following options:<br />
<pre><br />
[*] Kernel support for ELF binaries<br />
<M> Kernel support for MISC binaries<br />
[*] IA32 Emulation <---- without that, the entire 32bit API is not present<br />
<M> IA32 a.out support <br />
</pre><br />
You can force the guest to behave like a 32 environment like this:<br />
<pre><br />
echo linux_32bit > /etc/vservers/$NAME/personality<br />
echo i686 > /etc/vservers/$NAME/uts/machine<br />
</pre><br />
(thanks cehteh for the hint!)<br />
<br />
But you can force debootstrap to put 32 bit binaries into the guest by 'export ARCH=i386';<br />
<pre><br />
export ARCH=i386 ; vserver build .... <br />
</pre><br />
<br />
On debian when using the newvserver script "export ARCH=i386" has no effect, just use:<br />
<pre><br />
newvserver --arch i386 ...<br />
</pre><br />
<br />
On debian debootstrap can also be gived the arch option:<br />
<pre><br />
vserver myguest \<br />
build -m debootstrap -n myguest \<br />
--hostname myguest.mydomain.com \<br />
-- -d squeeze -- \<br />
--arch=amd64 (or i386 if you want 32bit)<br />
</pre><br />
<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=What does the guest privacy option do in the kernel settings ?<br />
||Details=<pre><br />
>i was wondering about the real thing that guest privacy does. <br />
#ifdef CONFIG_VSERVER_PRIVACY<br />
#define VS_ADMIN_P (0)<br />
#define VS_WATCH_P (0)<br />
#else<br />
<br />
> > Does it just prevent the spectator context ? <br />
<br />
it prevents the spectator context and the admin <br />
functionality in all cases which are privacy<br />
sensitive, which includes:<br />
<br />
- ptrace<br />
- devmapper<br />
- devpts<br />
- inode tag permissions<br />
- mountinfo<br />
- kill/signal<br />
- netlink dumps<br />
- tun control<br />
- iopriority<br />
<br />
> > What security do it bring to the system ?<br />
<br />
together with the VXF_STATE_ADMIN it can be<br />
used to secure a guest (to some degree) from<br />
unwanted access from the host admin, of course,<br />
as the admin can change the kernel, this is a<br />
voluntary feature which mostly prevents certain<br />
kinds of accidential peeking or guest modification<br />
<br />
</pre><br />
|Signature=ghislain}}<br />
<br />
<br />
== Distribution specific questions ==<br />
<br />
{{Question<br />
|Question=VServer is included in the stable Debian GNU/Linux for years now. What VS version did they include?<br />
||Details=At the time of writing, Debian Squeeze is the stable release of Debian and includes a 2.6.32 based kernel-package called 2.6.32-5-vserver-ARCH. This currently contains VServer 2.3.0.36.29.6 with some additional fixes.<br />
|Signature=scientes}}<br />
<br />
{{Question<br />
|Question=Were can I get newer versions of VServer as ready made packages for Debian?<br />
||Details= There are a number of locations<br />
* http://linux-vserver.derjohn.de/ - "my kernels are always 'devel' branch" (derjohn). This repo contain kernels up to 2.6.29 for amd64, 2.6.26 for i386.<br />
* http://repo.psand.net/info/ has Debian Lenny and Squeeze packages for 2.6.31 (i368 and amd64), 2.6.33, 2.6.35, 2.6.36 (amd64). It also contains newer util-vserver builds.<br />
* http://backports.org/ contains 2.6.32 backports for Lenny at time of writing (11th May 2010)<br />
* http://zbla.net/debian/ Unofficial debian vserver packages '''WARNING : i386 packets are compiled for 64bits !''' apt source line: ''deb http://zbla.net/debian/ ./''<br />
|Signature=Gremble<br />
}}<br />
<br />
<br />
<br />
== Misc ==<br />
<br />
{{Question<br />
|Question=Why isn't there a device /dev/xyz within a guest?<br />
||Details=Device nodes allow userspace to access hardware (or virtual resources). Creating a device node inside the guest's namespace will give access to that device, so for security reasons, the number of 'given' devices is small.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=I want to (re)mount a partition in a running guest ... but the guest has no rights (capability) to (re)mount?<br />
||Details=I'll explain. I take as example your /tmp partition within the guest is too small, what will be likely the case if you stay with the 16MB default (vserver build mounts /tmp as 16 MB tmpfs!).<br />
<pre><br />
# vnamespace -e XID mount -t tmpfs -o remount,size=256m,mode=1777 none /var/lib/vservers/<guest>/tmp/<br />
</pre><br />
(if there's a problem, try expanding the symlinks in the mount path)<br />
Be warned that the guest will not recognize the change, as the /etc/mtab file is not updated when you mount like this. To permanently change the mount, edit /etc/vserver/<guest>/fstab on the host.<br />
<br />
If you get:<br />
<pre><br />
mount: can't find /var/lib/vservers/<guest>/tmp in /etc/fstab or /etc/mtab<br />
</pre><br />
then try instead:<br />
<pre><br />
vnamespace -e builder chroot /var/lib/vservers/<guest>/ mount -o remount,size=64m,mode=1777 /tmp<br />
</pre><br />
<br />
Note that this not work for adding a bindmount (<tt>-o bind</tt>) of a directory outside of a vserver into the vserver. For this, there is no alternative but restarting the vserver.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Does anyone know how to increase the size of /tmp within a vserver w/o restarting?<br />
||Details=Use the remount option for mount.<br />
# vnamespace -e XID mount -n -t tmpfs -o remount,size=32m tmpfs /<vdir>/<guest>/tmp<br />
or something like that. The arguments are needed since mount is not going to be using /etc/fstab for the information and the version of /proc/mounts is best understood by<br />
# vnamespace -e XID cat /proc/mounts.<br />
See [[Frequently_Asked_Questions#I want to (re)mount a partition in a running guest ... but the guest has no rights (capability) to (re)mount?]]<br />
|Signature=derjohn/dhozac}}<br />
<br />
<br />
{{Question<br />
|Question=#1 ERROR: capset(): Operation not permitted<br />
||Details=capabilities are not enabled in kernel-setup<br />
please check that CONFIG_SECURITY_CAPABILITIES is loaded or included in the kernel. ( check with "cat /path_to_kernel/.config | grep -i cap ") <br />
(2.6.11.5-vs-1.9.5 + 0.30-205)<br />
|Signature=IrcQuestions}}<br />
<br />
{{Question<br />
|Question=How can I make 'vserver start' mount the root filesystem?<br />
||Details=Mount it via /etc/vservers/vserver-name/fstab, make sure to set the option 'dev' e.g.:<br />
<pre>/dev/drbd0 / xfs rw,dev 0 0</pre><br />
|Signature=AdrianReyer}}<br />
<br />
<br />
{{Question<br />
|Question=I deleted a guest's directory without shutting it down. Now I have a "ghost" running. Is there any possibility to get it out of proc without rebooting?<br />
||Details=<br />
vkill --xid <xid> -s 15; sleep 2; vkill --xid <xid> -s 9<br />
<br />
You will also need to remove guest's ip, for example with:<br />
ip addr del <ip> dev eth0<br />
|Signature=daniel_hozac & gebura }}<br />
<br />
{{Question<br />
|Question=When using nice and su (for example, in the updatedb cron job), I get: su: Permission denied. What does it mean?<br />
||Details=A guest cannot lower its nice value - and that's what 'su' does through pam_limits which sets a nice value of 0. You can see it through strace:<br />
$ strace nice su nobody<br />
[...]<br />
setpriority(PRIO_PROCESS, 0, 0) = -1 EACCES (Permission denied)<br />
You can use 'su nobody -c nice some_cmd' instead.<br />
(Now there's the question of why a guest process cannot lower its nice value.)<br />
|Signature=daniel_hozac&Beuc}}<br />
<br />
<br />
{{Question<br />
|Question=How do I handle NFS mounts within in a guest?<br />
||Details=There are three ways. <br />
<br />
'''1)''' Mount the NFS share from the host OS and let vserver guest access it as part of it's file system.<br />
<br />
''mount --bind'' may also be beneficial in this scenario.<br />
<br />
'''2)''' Use util-vserver and create a ''fstab.remote'' file in the /etc/vserver/<vserver_name> directory. Populate this with the NFS shares and they will be mounted in the context of the vserver guest.<br />
<br />
See http://www.nongnu.org/util-vserver/doc/conf/configuration.html<br />
<br />
'''3)''' Add capabilities to the vserver guest instance to grant sufficient rights to allow NFS mounts.<br />
<br />
Add the following to /etc/vserver/<vserver_name>/bcapabilities<br />
SYS_ADMIN<br />
Add the following to /etc/vserver/<vserver_name>/ccapabilities<br />
SECURE_MOUNT<br />
BINARY_MOUNT<br />
<br />
See [[Capabilities_and_Flags]] for more information about vserver capabilities.<br />
<br />
If you want the NFS shares to be mounted when the guest starts, add them to /etc/vserver/<vserver_name>/fstab<br />
<br />
||Signature=martindk}}<br />
<br />
<br />
{{Question<br />
|Question=vserver start/stop/enter fails with something like "vnamespace: execvp("/usr/sbin/vserver"): No such file or directory" ?<br />
||Details=Check whether ''/usr'' is mounted in the namespace you are working with.<br />
<pre>vnamespace -e <guest> cat /proc/mounts</pre><br />
If there is no ''/usr'', you can fix your problem with simply mounting it using the following command:<br />
<pre>vnamespace -e <guest> mount /dev/<device> /usr</pre><br />
<br />
||Signature=sim0n}}<br />
<br />
{{Question<br />
|Question=The command vserver <$server> start gives '/etc/init.d/rc: line 74: /etc/default/rcS: No such file or directory', what do I do? <br />
||Details=The vserver has not been correctly installed, this has several reasons<br />
check your install log and it should tell you something about that your server didn't get installed properly<br />
* use stable distribution of debian as server (debootstrap may be different over the versions)<br />
* deny_mount, deny_caps and deny_pivot should be off if your running grsec.<br />
<br />
||Signature=Dude}}<br />
<br />
<br />
{{Question<br />
|Question=How could I rename a vserver directory?<br />
||Details=Please note : this procedure renames the '''directory''', not the '''hostname''' !<br />
#Stop the vserver in question<br />
#rename the <tt>/vservers/<server name></tt> directory<br />
#rename the <tt>/etc/vservers/<server name></tt> directory<br />
#update link: <tt>/etc/vservers/<server name>/run</tt> → <tt>/var/run/vservers/<server name></tt><br />
#update link: <tt>/etc/vservers/<server name>/vdir</tt> → <tt>/etc/vservers/.defaults/vdirbase/<server name></tt><br />
#update link: <tt>/etc/vservers/<server name>/cache</tt> → <tt>/etc/vservers/.defaults/cachebase/<server name></tt><br />
#update link: <tt>/var/run/vservers.rev/<server XID></tt> → <tt>/etc/vservers/<server name></tt><br />
#Start the vserver in question. It should start properly.<br />
<br />
|Signature=FlorianD (from ''hillct'' page in old wiki)}}<br />
<br />
<br />
{{Question<br />
|Question=what if i see my vserver in vserver-stat but with no name ?<br />
||Details=the link in /var/run/vservers is missing<br />
Just do a : cat /etc/vservers/<guest>/context > /var/run/vservers/<guest><br />
check that the <guest> is the good one by using vuname --get --xid <context> with the context you have in the vserver-stat listing.<br />
|Signature=IrcQuestions}}<br />
<br />
== Upgrade from 2.0 to 2.2 ==<br />
<br />
{{Question<br />
|Question=I now get errors like "ncontext: vc_net_create(): Invalid argument; dynamic contexts disabled." on startup. Vservers are not started<br />
||Details=Dynamic context are disabled by default and are deprecated. For example, tagxid and network checks won't be useable with dynamic ids. Now you should manually assign a explicit context to your vservers, like<br />
echo 101 > /etc/vservers/myvserv/context<br />
ADDENDUM: please consider that valid static contexts are between 2 and 49151 ( daniel_hozac on IRC ) otherwise you will end up with unexplainable error "ncontext: vc_net_migrate(): No such process" when trying to start the vserver.<br />
<br />
|Signature=daniel_hozac&Beuc}}<br />
<br />
<br />
{{Question<br />
|Question=How do I assign a static context to an existing vserver?<br />
||Details=Simple ;) See the answer above. <br />
|Signature=gcc}}<br />
<br />
<br />
{{Question<br />
|Question=Since upgrading to a newer VS version my guest complains about "vsched: non-numeric value specified for '--priority_bias" at start time. What's wrong?<br />
||Details=The scheduler paramters changed.You can use this (ugly) script to convert them or do it by hand:<br />
<pre><br />
# cat /usr/local/sbin/vserver-convert-schedule-to-scheddir<br />
#/bin/sh<br />
mkdir /etc/vservers/$1/sched<br />
sed -e 1p -n /etc/vservers/$1/schedule > /etc/vservers/$1/sched/fill-rate<br />
sed -e 2p -n /etc/vservers/$1/schedule > /etc/vservers/$1/sched/interval<br />
sed -e 3p -n /etc/vservers/$1/schedule > /etc/vservers/$1/sched/tokens<br />
sed -e 4p -n /etc/vservers/$1/schedule > /etc/vservers/$1/sched/tokens-min<br />
sed -e 5p -n /etc/vservers/$1/schedule > /etc/vservers/$1/sched/tokens-max<br />
<br />
mv /etc/vservers/$1/schedule /etc/vservers/$1/schedule.converted.see.scheddir<br />
<br />
# see: http://oldwiki.linux-vserver.org/Scheduler+Parameters<br />
# see: http://www.nongnu.org/util-vserver/doc/conf/configuration.html#sched<br />
</pre><br />
||Signature=derjohn}}<br />
<br />
<br />
{{Question<br />
|Question=Since upgrading to a newer VS version my guest doesn't have the amount of shared memory (SHM / SHMMAX / SHMALL ) as it had in the former version. What changed?<br />
||Details=Every VS version that runs on a kernel >= 2.6.19 offers sysctl values per guest. This has to do with the 'ipc namespace' feature that was added to the mainline kernel in version 2.6.19. Linux-VServer uses that feature to give each guest a separate 'ipc namespace' and thus 'own' sysctl values per guest. Because shmmax is such a sysctl value, you have to set it per guest.<br />
Here is an example how to do so:<br />
<br />
<pre><br />
# mkdir /etc/vservers/<vserver>/sysctl/0 -p<br />
# echo kernel.shmall > /etc/vservers/<vserver>/sysctl/0/setting<br />
# echo 134217728 > /etc/vservers/<vserver>/sysctl/0/value<br />
# mkdir /etc/vservers/<vserver>/sysctl/1 -p<br />
# echo kernel.shmmax > /etc/vservers/<vserver>/sysctl/1/setting<br />
# echo 134217728 > /etc/vservers/<vserver>/sysctl/1/value<br />
</pre><br />
It's also explained on the geat flower page:<br />
# see: http://www.nongnu.org/util-vserver/doc/conf/configuration.html -> Look for "sysctl".<br />
<br />
After changing those values, restart your guest, enter it and check if the values are set:<br />
<pre><br />
# sysctl -a | grep shm<br />
...<br />
kernel.shmall = 134217728<br />
kernel.shmmax = 134217728<br />
</pre><br />
<br />
To change a value for a running guest, on the host use:<br />
<pre><br />
vspace -e CONTEXTID --ipc sysctl -w kernel.shmall=134217728<br />
vspace -e CONTEXTID --ipc sysctl -w kernel.shmmax=134217728<br />
</pre><br />
<br />
||Signature=derjohn<br />
}}</div>AdrianReyerhttp://www.linux-vserver.org/util-vserver:Cgroupsutil-vserver:Cgroups2011-05-14T16:59:09Z<p>AdrianReyer: /* Kernel configuration */</p>
<hr />
<div>Bears run away when you yell at them, even <tt>lynx</tt>es.<br />
<br />
== Kernel configuration ==<br />
<br />
When configuring your kernel for cgroups with util-vserver you must make sure <tt>CONFIG_CGROUP_NS</tt> ('''CGroup Namespaces''') is unset with util-vserver version lower than 0.30.216-pre2882.<br />
<br />
'''CGroup Namespaces''' are a different approach to namespaces than that used by Linux vServer, and are not currently supported.<br />
<br />
== Prerequisites ==<br />
<br />
To use <tt>util-vserver</tt>'s Control Groups (<tt>cgroups</tt>) support, you need to have <tt>/dev/cgroup</tt> mounted.<br />
<br />
Recent versions of <tt>util-vserver</tt> sort this out for you by including the appropriate mount command in the <tt>util-vserver</tt> <tt>init</tt> (ie: runlevel) script included in the <tt>util-vserver</tt> distribution, however this apparently only works for the <tt>sysv</tt> <tt>init</tt> script, and not the Debian or Gentoo ones.<br />
<br />
If you were to mount the <tt>cgroup</tt> Control Groups filesystem manually, you would use something like:<br />
: <tt># mkdir /dev/cgroup<br />
: # mount -t cgroup -o ''<subsystems>'' /dev/cgroup</tt><br />
<br />
Where <tt>''<subsystems>''</tt> is something like <tt>cpuset,memory</tt>.<br />
<br />
To avoid the need for manual configuration after reboot, on Gentoo you may wish to add the cgroup mount to <tt>/etc/fstab</tt>. For Debian see the live examples section at the bottom of this page.<br />
<pre><br />
none /dev/cgroup cgroup cpu,cpuset,memory 0 2<br />
</pre><br />
<br />
== Draft - Distributing cpu shares with cgroups ==<br />
<br />
From what i gathered in sched-design-CFS.txt [http://people.redhat.com/mingo/cfs-scheduler/sched-design-CFS.txt]<br />
<br />
This is simply done by adjusting the cpu.shares. Just do:<br />
<br />
echo '512' > /dev/cgroup/<guest name>/cpu.shares<br />
<br />
The share you get is equal to the guest's share divided by the sum of the cpu shares of all the guest. So for exemple :<br />
<br />
<pre><br />
vserver guest 1 => 512 <br />
vserver guest 2 => 512<br />
vserver guest 3 => 2048<br />
vserver guest 4 => 512<br />
</pre><br />
<br />
so you have a total of 3584 cpu shares (2048+512+512+512) , then you get :<br />
<br />
<pre><br />
vserver guest 1 => 512 / 3584 = 14% cpu<br />
vserver guest 2 => 512 / 3584 = 14% cpu<br />
vserver guest 3 => 2048 / 3584 = 57% cpu<br />
vserver guest 4 => 512 / 3584 = 14% cpu<br />
</pre><br />
<br/><br />
<br />
<br />
Note that this is fair scheduling and this will not enfore HARD limit (as far as i know).<br />
<br />
== Making share permanent with util vserver ==<br />
<br />
You must use the "cgroup" directory. You can apply defaults to all vservers or choose different settings for each guest:<br />
<br />
* /etc/vservers/.defaults/cgroup , this directory contains settings applying to all guest when they start<br />
* /etc/vservers/<guestname>/cgroup , this directory contains settings for the guest when it starts.<br />
<br />
<br />
Example :<br />
<br />
<pre><br />
mkdir /etc/vservers/.defaults/cgroup<br />
mkdir /etc/vservers/<guestname>/cgroup<br />
echo '2048' > /etc/vservers/<guestname>/cgroup/cpu.shares<br />
# List of CPUs<br />
echo 1 > /etc/vservers/<guestname>/cgroup/cpuset.cpus<br />
# NUMA nodes<br />
echo 1 > /etc/vservers/<guestname>/cgroup/cpuset.mems<br />
</pre><br />
<br />
Note that /etc/vservers is an example, in my Aqueos install i use /usr/local/etc/vservers but /etc/vservers seems to be the defaults for the classic installs.<br />
<br />
Regards,<br />
Ghislain.<br />
<br />
== cgroup and CFS based CPU hard limiting that replaces sched_hard ==<br />
<br />
===References===<br />
You can find documentation about the CFS hard limiting in <tt>Documentation/scheduler/sched-cfs-hard-limits.txt</tt> inside your kernel source dir.<br />
<br />
===Requirements===<br />
This feature is currently available in <tt>patch-2.6.32.20-vs2.3.0.36.29.6.diff</tt> and is in testing phase as of this patch set so report any bugs to the mailing list.<br />
<br />
To get the hard limit setup on every vServer start you need a recent utils package. It worked for me with: <tt>0.30.216-pre2864</tt>. (Download from [http://people.linux-vserver.org/~dhozac/t/uv-testing/ util-vserver prereleases])<br />
<br />
Before trying to setup limits for one guest you should mount the cgroup filesystem:<br />
<br />
[ -d /dev/cgroup ] || mkdir /dev/cgroup<br />
mount -t cgroup -ocpu none /dev/cgroup<br />
<br />
===Configuration===<br />
Example for an upper bound of 2/5th (or 40%) of the all CPU power that a guest/cgroup can use :<br />
<br />
<pre><br />
# time assigned to guest (in microseconds) 200000 = 0,2 sec <br />
echo 200000 > /etc/vservers/<guestname>/cgroup/cpu.cfs_runtime_us<br />
# in each specified period (in microseconds) 500000 = 0,5 sec <br />
echo 500000 > /etc/vservers/<guestname>/cgroup/cpu.cfs_period_us<br />
</pre><br />
<br />
This limit is an hard limit, see it like an upper wall for the resources used by the cgroup.<br />
<br />
If you set both CPU share AND hard limit the system will do fine but hard limits takes priority over CPU share scheduling, so CPU share will do the job but each cgroup will have an upper bound that it cannot cross even if the CPU share you gave it is higher.<br />
<br />
The hard limit feature adds 2 cgroup files for the CFS group scheduler:<br />
* <tt>cfs_runtime_us</tt>: Hard limit for the group in microseconds.<br />
* <tt>cfs_period_us</tt>: Time period in microseconds within which hard limits is enforced.<br />
<br />
== using cgroup to enforce memory limits ==<br />
<br />
in linux-vserver patch version vs2.3.0.36.29 memory limiting by cgroup is introduced. to use it you need to have the following config lines in your kernel build (aditionally to the others mentioned for cgroup cpu limits):<br />
<br />
* CONFIG_RESOURCE_COUNTERS=y<br />
* CONFIG_CGROUP_MEM_RES_CTLR=y<br />
* CONFIG_CGROUP_MEM_RES_CTLR_SWAP=y<br />
<br />
make sure /dev/cgroup is mounted with -o...,memory to be able to use this feature. The following files let you adjust memory limits of a running vserver (create them in /etc/vservers/-vserver-name-<br />
/cgroup/ to make them permanent):<br />
<br />
* memory.memsw.limit_in_bytes the total memory limit (memory+swap) of your cgroup context<br />
* memory.limit_in_bytes the total memory limit<br />
<br />
values are stored in bytes. When writing to those files you can use suffixes: K,M,G.<br />
<br />
Note: cgroup memory limits are to replace rss.soft and rss.hard some time in the future.<br />
When you wish the guests to see only their limited memory pool, be sure to include VIRT_MEM in your cflags config file.<br />
<br />
'''BUG-ALERT: '''If you're getting into trouble (Unable to handle kernel paging request at [..] + trace from Error in dmesg or /var/messages) please use the following experimental patch provided by Bertl: [http://vserver.13thfloor.at/ExperimentalT/delta-memcg-fix04.diff http://vserver.13thfloor.at/ExperimentalT/delta-memcg-fix04.diff]<br />
<br />
For a deeper understanding check out Documentation/cgroups/memory.txt of your kernel source tree.<br />
<br />
= Real world Examples of Scheduling =<br />
<br />
This section is for working and tested examples you have put in place.<br />
<br />
Please add the following information for each example you put here (use <tt>vserver-info</tt>).<br />
* Base kernel version<br />
* vServer version<br />
* Other kernel patches in use (<tt>grsec</tt>, etc.)<br />
* <tt>util-vserver</tt> release<br />
<br />
== Ben's install on Debian Lenny ==<br />
<br />
I used the kernels from [http://repo.psand.net], described at [http://kernels.bristolwireless.net/]. I've done this on a few versions, works for 2.6.31.7 with patch vs2.3.0.36.27 on amd64, also 2.6.31.11 with patch vs2.3.0.36.28. I used the stock Lenny util-vserver, patched as described below. The kernel config is critically important, with specific cgroup options necessary in order to get cgroups working in this way. Check the configs for the [http://repo.psand.net] kernels to see which ones I used.<br />
<br />
==== Getting Lenny Ready ====<br />
<br />
There's a very old version of util-vserver on Lenny, it needs this patch applying before it will set the cgroups properly, it basically only adds one line:<br />
<br />
--- /usr/lib/util-vserver/vserver.suexec.orig 2008-12-12 22:56:25.000000000 -0600<br />
+++ /usr/lib/util-vserver/vserver.suexec 2009-08-20 02:11:42.000000000 -0500<br />
@@ -22,7 +22,8 @@ test -z "$is_stopped" -o "$OPTION_INSECU<br />
exit 1<br />
}<br />
generateOptions "$VSERVER_DIR"<br />
-addtoCPUSET "$VSERVER_DIR"<br />
+addtoCPUSET "$VSERVER_DIR"<br />
+attachToCgroup "$VSERVER_DIR"<br />
<br />
user=$1<br />
shift<br />
<br />
Next I added a correctly mounted cgroup file system on /dev/cgroup/. <br />
<br />
$ mkdir /dev/cgroup<br />
$ mount -t cgroup vserver /dev/cgroup<br />
<br />
For the util-vserver to do the right thing, this directory needed adding too:<br />
<br />
$ mkdir /etc/vservers/.defaults/cgroup<br />
<br />
==== Sharing out the CPU between guest servers ====<br />
<br />
I have a few test guests hanging around that I play with, call onetime, twotime, threetime, fourtime and fivetime. I order to set the shares for each guest I did this:<br />
<br />
mkdir /etc/vservers/fivetime/cgroup/ /etc/vservers/fourtime/cgroup/ /etc/vservers/threetime/cgroup/ /etc/vservers/twotime/cgroup/ /etc/vservers/twotime/cgroup/<br />
echo "512" > /etc/vservers/fivetime/cgroup/cpu.shares<br />
echo "1024" > /etc/vservers/fourtime/cgroup/cpu.shares<br />
echo "1024" > /etc/vservers/threetime/cgroup/cpu.shares<br />
echo "1536" > /etc/vservers/twotime/cgroup/cpu.shares<br />
echo "1024" > /etc/vservers/onetime/cgroup/cpu.shares<br />
<br />
Then started the guests. When the system was loaded (I used one instance of cpuburn on each server - not advised but a useful test) they each should have got the following percentage of CPU.<br />
<br />
{| class="wikitable"<br />
! Guest Name !! cpu.share given !! percentage of cpu<br />
|-<br />
| fivetime || 512 || 10% <br />
|-<br />
| fourtime || 1024 || 20%<br />
|-<br />
| threetime || 1024 || 20%<br />
|-<br />
| twotime || 1536 || 30%<br />
|-<br />
| onetime || 1024 || 20%<br />
|}<br />
<br />
This didn't quite happen, as each process could migrate to other CPUs. When I fixed every guest to use only one of the available CPUs (see below how I did this) the percentage of processing time alloted to each guest were then pretty much exact! Each process was given exactly it's designated percentage of time according to vtop.<br />
<br />
==== Dishing out different processors sets to different guest servers ====<br />
<br />
The "cpuset" for each guest is the subset of CPUs which it is permitted to use. I found out the number of CPUs available on my system by doing this:<br />
<br />
$ cat /dev/cgroup/cpuset.cpus<br />
<br />
This gave me the result 0-1, meaning that the overall set for my cgroups consists of CPUs 0 and 1 (for a quad core system one would expect the result 0-3, or for quad core with HT, 0-7). I stopped my guests, then for each guest specified a cpuset containing only CPU 0 for each of them:<br />
<br />
$ echo "0" > /etc/vservers/onetime/cgroup/cpuset.cpus<br />
$ echo "0" > /etc/vservers/twotime/cgroup/cpuset.cpus<br />
$ echo "0" > /etc/vservers/threetime/cgroup/cpuset.cpus<br />
$ echo "0" > /etc/vservers/fourtime/cgroup/cpuset.cpus<br />
$ echo "0" > /etc/vservers/fivetime/cgroup/cpuset.cpus<br />
<br />
On restarting the guest, I could see (using vtop) that these guest were only using the CPU 0 (the column "Last used cpu (SMP)" needs to be on in vtop in order to see this). This set up isn't particularly useful, but did allow me to check that the cpu.shares I specified for my guest were working as expected.<br />
<br />
==== Doing this to servers live ====<br />
<br />
The parameters in the last two sections can be set when the servers are running. For example to move the guest "threetime" so that it could use both CPUs I did this:<br />
<br />
$ echo "0-1" > /dev/cgroup/threetime/cpuset.cpus<br />
<br />
The processes running on threetime instantly were allocated cycle on both CPUs. Then:<br />
<br />
$ echo "1" > /dev/cgroup/threetime/cpuset.cpus<br />
<br />
Shifts them all to CPU 1. One can change where cycles are allocated with impunity. The same with CPU shares:<br />
<br />
$ echo "4096" > /dev/cgroup/threetime/cpu.shares<br />
<br />
Gave threetime a much bigger slice of the processors when it was under load.<br />
<br />
'''NOTE''': The range "0-1" is not the only way of specifying a set of CPUs, I could have used "0,1". On bigger systems, with say 8 CPUs one could use "0-2,4,5", which would be the same as "0,1,2,4,5" or "0-2,4-5".<br />
<br />
==== Making sure all of this gets set up after a reboot ====<br />
<br />
This process will make sure /dev/cgroup is present at boot and correctly mounted:<br />
<br />
* patch util-vserver (see above)<br />
* mkdir /etc/vservers/.defaults/cgroup<br />
* mkdir /lib/udev/devices/cgroup (this will mean that the /dev/cgroup is created early in the boot process)<br />
* add the following line to /etc/fstab<br />
vserver /dev/cgroup cgroup cpu,cpuset,memory 0 0<br />
<br />
== Ben's install on Debian Squeeze/Sid ==<br />
<br />
These instructions are for Debian's own packages.<br />
<br />
Squeeze ships with the 2.6.32 kernel. Currently the package linux-image-2.6.32-5-vserver-amd64 works well for cgroup scheduling. The following steps are simplest way to set it up:<br />
<br />
* mkdir /etc/vservers/.defaults/cgroup<br />
* mkdir /lib/udev/devices/cgroup (this will mean that the /dev/cgroup is created early in the boot process)<br />
* add the following line to /etc/fstab<br />
vserver /dev/cgroup cgroup cpuset,cpu,cpuacct,devices,freezer,net_cls 0 0<br />
* reboot the server<br />
<br />
Instructions for setting particular parameters are the same as for Lenny. The reason for specifying the cgroup subsystems is that if the namespace subsystem "ns" is included, Linux-Vserver will not work. The /etc/fstab line above mounts /dev/cgroup with all the available subsystems excluding "ns".<br />
<br />
Note that the "memory" cgroup subsystem is omitted as Squeeze has the legacy memory controls through rlimits compiled in. It is possible to add "memory" to the cgroup fstab line and use the cgroup based memory control. Please add any success with this to this page.</div>AdrianReyerhttp://www.linux-vserver.org/Frequently_Asked_QuestionsFrequently Asked Questions2010-04-19T12:13:36Z<p>AdrianReyer: </p>
<hr />
<div><div style="margin: 2em auto 2em auto; padding: 10px; background-color: #F9ECCD; border: 1px solid #004433; text-align: center;"><br />
[[Image:Icon-Caution.png|left]]<br />
We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the [[Wiki Team]] page for instructions how to help or look at the [http://oldwiki.linux-vserver.org old wiki] to find the information not migrated yet.<br />
<br />
'''To ease migration we created a [[List of old Documentation pages]].'''<br />
</div><br />
<br />
CURRENTLY THE CONTENT OF THE OLD WIKI FAQ (AND MORE) IS BEING MIGRATED TO THIS PAGE (TASK: DERJOHN)<br />
<br />
<br />
__TOC__<br />
<br />
== General ==<br />
<br />
{{Question<br />
|Question=What is a 'Guest'?<br />
||Details=To talk about stuff, we need some naming. The physical machine is called 'Host' and the 'main' context running the Host Distro is called 'Host Context'. The virtual machine/distro is called 'Guest' and basically is a Distribution (Userspace) running inside a 'Guest Context'.<br />
|Signature=derjohn}}<br />
<br />
<br />
{{Question<br />
|Question=What kind of Operating System (OS) can I run as guest?<br />
||Details= With VServer you can only run Linux guests. The trick is that a guest does not run a kernel on its own (as XEN and UML do), it merely uses a virtualized host kernel-interface. VServer offers so called security contexts which make it possible to separate one guest from each other, i.e. they cannot get data from each other. Imagine it as a chroot environment with much more security and features.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Is this a new project? When was it started?<br />
||Details=The first public occurrence of Linux-VServer was Oct 2001. The initial mail can be found here: http://www.cs.helsinki.fi/linux/linux-kernel/2001-40/1065.html<br />
So you can expect a mature software product which does its magic quite well (And hey, we have a version > 2.0!)<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Which distributions did you test?<br />
||Details=Some. Check out the wiki for ready-made guest images. But you can easily build own guest images, e.g. with Debian's debootstrap. Checkout [[Building Guest Systems]] how to do that.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Is VServer comparable to XEN/UML/QEMU?<br />
||Details=Nope. XEN/UML/QEMU and VServer are just good friends. Because you ask, you probably know what XEN/UML/QEMU are. VServer in contrary to XEN/UML/QEMU does not "emulate" any hardware you run a kernel on. The purpose of Linux VServer is to isolate (groups of) applications. The isolation is done by the kernel (see [[Overview]] for a more detailed comparison). You can run a VServer kernel in a XEN/UML/QEMU guest. This is confirmed to work at least with Linux 2.6/vs2.0.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=With which version should I begin?<br />
||Details=If you are new to VServer I recommend to try the latest stable kernel patch, and the latest util-vserver "alpha" release.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Is VServer secure?<br />
||Details=We hope so. It should be as least as secure as Linux is. We consider it much much more secure though.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Performance?<br />
||Details=For a single guest, we basically have native performance. Some tests showed insignificant overhead (about 1-2%) others ran faster than on an unpatched kernel. This is IMVHO significantly less than other solutions waste, especially if you have more than a single guest (because of the resource sharing).<br />
|Signature=derjohn}}<br />
<br />
<br />
{{Question<br />
|Question=What is the "great flower page"?<br />
||Details=Well, [http://www.nongnu.org/util-vserver/doc/conf/configuration.html this page] contains all configuration options for util-vserver. The name of the page is derived from the stylesheet(s) it contains.<br />
|Signature=derjohn}}<br />
<br />
<br />
<br />
== Resources usage ==<br />
<br />
{{Question<br />
|Question=Resource sharing?<br />
||Details=Yes ....<br />
* memory: Dynamically.<br />
* CPU usage: Dynamically (token bucket)<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Resource limiting?<br />
||Details=You can put limits per guest on different subsystems.<br />
* using ulimits and rlimits (rlimit is a new feature of kernel 2.6/vs2.0.) per guest, to limit the memory consumption, the number of processes or file-handles, ... : see [[Resource Limits]]<br />
* CPU usage : see [[CPU Scheduler]]<br />
* disk space usage : see [[Disk Limits and Quota]]<br />
Note that you can only offer guaranteed resource availability with some ticks at the time.<br />
|Signature=derjohn&xm}}<br />
<br />
{{Question<br />
|Question=How do I limit a guests RAM? I want to prevent OOM situations on the host!<br />
||Details=First you can read [http://linux-vserver.org/Memory+Allocation] and [[Memory Limits]].<br />
If you want a recipe, do this:<br />
# Check the size of memory pages. On x86 and x86_64 is usually 4 KB per page.<br />
# Create /etc/vserver/<guest>/rlimits/<br />
# Check your physical memory size on the host, e.g. with "free -m". maxram = kilobytes/pagesize.<br />
# Limit the guests physical RAM to value smaller then maxram:<pre>echo %%insertYourPagesHereSmallerThanMaxram%% > /etc/vserver/<guest>/rlimits/rss </pre><br />
# Check your swapspace, e.g. with 'swapon -s'. maxswap = swapkilobytes/pagesize.<br />
# Limit the guest's maximum number of as pages to a value smaller than (maxram+maxswap): <pre> echo %%desiredvalue%% > /etc/vserver/<guest>/rlimits/as </pre><br />
# Correctly display the memory information inside the guest:<pre>echo "VIRT_MEM" >> /etc/vservers/<guest>/flags</pre><br />
It should be clear this can still lead to OOM situations. Example: You have two guests and your as limit per guest is greater than 50% of (maxram+maxswap). If both guests request their maximum at the same point in time, there will be not enough mem .....<br />
|Signature=derjohn}}<br />
<br />
<br />
{{Question<br />
|Question=Disk I/O limiting? Is that possible?<br />
||Details=Well, since vs2.1.1 Linux-VServer supports a mechanism called 'I/O scheduling', which appeared in the 2.6 mainline some time ago. The mainline kernel offers several I/O schedulers:<br />
<pre><br />
# cat /sys/block/hdc/queue/scheduler<br />
noop [anticipatory] deadline cfq<br />
</pre><br />
<br />
The default is anticipatory a.k.a. "AS". When running several guests on a host you probably want the I/O performance shared in a fair way among the different guests. The kernel comes with a "completely fair queueing" scheduler, CFQ, which can do that. (More on schedulers can be found at http://lwn.net/Articles/114770/)<br />
This is how to set the scheduler to "cfq" manually:<br />
<pre><br />
root# echo "cfq" > /sys/block/hdc/queue/scheduler<br />
root# cat /sys/block/hdc/queue/scheduler<br />
noop anticipatory deadline [cfq]<br />
</pre><br />
Keep in mind that you have to do it on all physical discs. So if you run an md-softraid, do it to all physical /dev/hdXYZ discs!<br />
If you run Debian there is a predefined way to set the /sys values at boot-time:<br />
<pre><br />
# apt-get install sysfsutils<br />
[...]<br />
<br />
# grep cfq /etc/sysfs.conf<br />
block/sda/queue/scheduler = cfq<br />
block/sdc/queue/scheduler = cfq<br />
<br />
# /etc/init.d/sysfsutils restart<br />
</pre><br />
<br />
For non-vserver processes and CFQ you can set by which key the kernel decides about the fairness:<br />
<pre><br />
cat /sys/block/hdc/queue/iosched/key_type<br />
pgid [tgid] uid gid<br />
</pre><br />
Hint: The 'key_type'-feature has been removed in the mainline kernel recently. Don't look for it any longer :(<br />
<br />
The default is tgid, which means to share fairly among process groups. Think every guest is treated like a own process group. It's not possible to set a scheduler strategy within a guest. All processes belonging to the same guest are treated like "noop" within the guest. So: If you run apache and some ftp-server within the _same_ guest, there is no fair scheduling between them, but there is fair scheduling between the whole guest and all other guests.<br />
<br />
And: It's possible to tune the scheduler parameters in several ways. Have a look at /sys/block/hdc/queue/....<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Nice disk I/O scheduling, is that possible?<br />
||Details=Well, since linux 2.6.13 processess have another priority next to the cpu nice scheduling hint, it's called io nice.<br />
It's split into three groups, called real-time, best effort and idle. The default is best-effort, but within best-effort, you can have a niceness from 0 to and including 7.<br />
You can set this niceness by the tool ionice, which for debian is either in the package util-linux or schedutils.<br />
To change the io-niceness you need the <tt>CAP_SYS_NICE</tt>, '''and''' need to have the same uid as the processe you want to ionice.<br />
<br />
:'''Note:''' If you want to use any schedulung other than best-effort you will also need the <tt>CAP_SYS_ADMIN</tt>-flag. Be warned that this gives quite some capabilities to the vserver, not just for I/O scheduling!<br />
<br />
If you want to increase the niceness of an I/O hogging process within a vserver you need to do:<br />
<PRE><br />
chcontext --xid sponlp1 sudo -u '#2089' ionice -c2 -n5 -p24409<br />
</PRE><br />
with sudo and ionice installed on the root server to increase the *nice*ness of pid 24409, with uid 2089<br />
|Signature=Groteblup}}<br />
<br />
== Unification ==<br />
<br />
{{Question<br />
|Question=What is unification (vunify)?<br />
||Details=Unification is Hard Links on Steroids. Guests can 'share' common files (usually binaries and libraries) in a secure way, by creating hard links with special properties (immutable but unlinkable (removable)). The tool to identify common files and to unify them is called vunify.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=What is vhashify?<br />
||Details=The successor of vunify, a tool which does unification based on hash values (which allows to find common files in arbitrary paths.)<br />
It creates hardlinks to files named after a hash of the content of the file. If you have a recent version of the vserver patch (2.2+), with CONFIG_VSERVER_COWBL enabled, you can even modify the hardlinked files inside the vservers and the links will be broken automatically.<br />
There seems to be a catch when a hashified file has multiple hardlinks inside a guest, or when another internal hardlink is added after hashification. Link breaking will remove all the internal hardlinks too, so the guest will end up with different copies of the original file. The correct solution would be to not hashify files that have multiple links prior to hashification, and to break the link to the hashified version when a new internal hardlink is created. Apparently, this is not implemented yet (?).<br />
|Signature=Guy-}}<br />
<br />
{{Question<br />
|Question=How do I manage a multi-guest setup with vhashify?<br />
||Details=For 'vhashify', just do these once:<br />
<pre><br />
mkdir /etc/vservers/.defaults/apps/vunify/hash /vservers/.hash<br />
ln -s /vservers/.hash /etc/vservers/.defaults/apps/vunify/hash/root<br />
</pre><br />
Then, do this one line per vserver:<br />
<pre><br />
mkdir /etc/vservers/<vservername>/apps/vunify # vhashify reuses vunify configuration<br />
</pre><br />
To hashify a running vserver, do (possibly from a cronjob):<br />
<pre><br />
vserver name-of-guest hashify<br />
</pre><br />
<br />
The guest needs to be running because vhashify tries to figure out what files not to hashify by calling the package manager of the guest via <tt>vserver enter</tt>.<br />
<br />
In order for the OS cache to benefit from the hardlinking, you'll have to restart the vservers.<br />
<br />
To clean up hashified files that are no longer referenced by any vserver, do (possibly from a cronjob):<br />
<pre><br />
find /vservers/.hash -type f -links 1 -print0 | xargs -0 rm<br />
</pre><br />
<br />
Until you do this, the files still take up place even though no vservers need them.<br />
|Signature=Guy-}}<br />
<br />
== Filesystem usage ==<br />
<br />
{{Question<br />
|Question=Is there a way to implement "user/group quota" per VServer?<br />
||Details=Yes, but not on a shared partition for now. You need to put the guest on a separate partition, setup a vroot device (to make the quota access secure), copy that into the guest, and adjust the mtab line inside the guest. If 8 vroot device is not enough for you, you can add more with the kernel parameter max_vroot (exemple for built in kernel vroot /vmlinuz-2.6.31.6-vs2.3.0.36.26aq root=/dev/md1 ro max_vroot=20 ). If vroot is a module you'd actually want to put for exemple "options vroot max_vroot=20" in /etc/modprobe.conf and then just do modprobe vroot<br />
|Signature=derjohn,gadnet}}<br />
<br />
{{Question<br />
|Question=What about "Quota" for a context? Howto limit disk usage?<br />
||Details=Context quotas are now called Disk Limits (so that we can tell them apart from the user/group quotas :). They are supported out of the box (with vs2.0+) for all major filesystems (ext2/3, ReiserFS, JFS). You need to tag the FS with XID (see below). Please read [[Disk Limits and Quota]] for more information.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=How do I tag a guest's directory with xid?<br />
||Details=Tagging the guest's files gives you several advantages, e.g. the accounting will work properly.<br />
Filesystem XID tagging only works on supported filesystem. Those are currently: ext2/3, reiserfs/reiser3, xfs and jfs.<br />
To activate the XID tagging you have to mount the filesystem with "-o tag" (former tagxid is outdated since VS2.2). Attention: It's _not_ possible to "-o remount,tag", you have to mount it freshly. The guests will tag their files automatiaclly. If you copy files in from the host, you have to tag them manually like this:<br />
<pre><br />
chxid -c xid -R /var/lib/vservers/<guest><br />
</pre><br />
Note: Context 0 and 1 will see all files, guests will only be able to access untagged files and their own XID. They can see other XID files but no information about the file, e.g. no owner, no group, no permissions.<br />
Note: It is not advised to tag the root filesystem, as [http://www.paul.sladen.org/vserver/archives/200602/0020.html explained by Herbert] : trying to do so will expose you to some troubles !<br />
|Signature=derjohn_and_gonzo_and_are}}<br />
<br />
{{Question<br />
|Question=How can I copy anything from host to guest partition, normally unvisible on host?<br />
||Details=You should just change namespace, e.g.:<br />
<pre><br />
vnamespace --enter <xid> -- /bin/bash<br />
</pre><br />
and then use standard cp or rsync programs.<br />
|Signature=SergiuszPawlowicz}}<br />
<br />
== Network ==<br />
<br />
{{Question<br />
|Question=Does it support IPv6?<br />
||Details=Currently it requires an additional patch, but the functionality should be available in 2.3+ soon. [[IPv6]] has more information.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=I can't do all I want with the network interfaces inside the guest?<br />
||Details=For now the networking is 'Host Business' -- the host is a router, and each guest is a server. You can set the capability ICMP_RAW in the context of the guest, or even the capability CAP_NET_RAW (which would even allow to sniff interfaces of other guests!). Likely to change with ngnet.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=How do I add several IPs to a vserver?<br />
||Details=First of all a single guest vserver only supports up to 16 IPs (There is a 64-IP patch available, which is in "derjohn's kernel").<br />
Here is a little helper-script that adds a list of IPs defined in a text file, one per line.<br />
<pre><br />
#!/bin/bash<br />
j=1<br />
for i in `cat myiplist`; do<br />
j=$(($j+1))<br />
mkdir $j<br />
echo $i > $j/ip<br />
echo "24" > $j/prefix<br />
done<br />
</pre><br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=How do I assign a new IP address to a running guest?<br />
||Details=This is done from the host server:<br />
* add the ip on the host, for example<br />
<pre><br />
ip addr add 194.169.123.23/24 dev eth0 <br />
</pre><br />
* add the ip to the guest's network context (a guests NID is the same as the XID {context ID})<br />
<pre><br />
naddress --add --nid <nid> --ip 194.169.123.23/24 <br />
</pre><br />
* enter the guest (best via ssh) <br />
* restart the services that need to make use of the new address if required <br />
* update the config in ''/etc/vserver/<servername>/interfaces'' to reflect the changes for the next guest restart (if desired)<br />
|Signature=BenjaminGreen}}<br />
<br />
{{Question<br />
|Question=If my host has only one a single public IP, can I use RFC1918 IP (e.g. 192.168.foo.bar) for the guest vservers?<br />
||Details=Yes, use iptables with SNAT to masquerade it. <br />
<pre><br />
iptables -t nat -I POSTROUTING -s $VSERVER_NETZ ! -d $VSERVER_NETZ -j SNAT --to $EXT_IP<br />
</pre><br />
See: [[HowtoPrivateNetworking]] and <br />
http://www.tgunkel.de/it/software/doc/linux_server.en#h3-VServer_Masquerading_SNAT (THX, [MUPPETS]Gonzo)<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=If I shut down my vserver guest, the whole Internet interface ethX on the host is shut down. What happened?<br />
||Details=When you shut down a guest (''i.e. vserver foo stop''), the IP is brought down on the host also. If this IP happens to be the primary IP of the host, the kernel will not only bring down the primary IP, but also all secondary IP addresses. But in very recent kernels, there is an option ''settable'' which prevents that nasty feature. It's called "alias promotion". You may set it via sysctl by adding ''net.ipv4.conf.all.promote_secondaries=1'' in /etc/sysctl.conf or via sysctl command line.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Can I run an OpenVPN Server in a guest?<br />
||Details=<br />
Yes. To get a OpenVPN Server running in a guest, all networking setup has to be done on the host. This answer describes the common case and shows some pitfalls, for detailled information about OpenVPN, please consult the appropriate documentation on the OpenVPN homepage.<br />
This is the minimal OpenVPN configuration for the Server which will be used to demonstrate how to get it running in a client:<br />
<pre><br />
# Networking setup<br />
server 192.168.16.0 255.255.255.0<br />
dev tun16<br />
ifconfig-noexec<br />
comp-lzo<br />
# Certificates<br />
dh ...<br />
ca ...<br />
cert ...<br />
key ...<br />
# Management<br />
persist-key<br />
keepalive 10 60<br />
verb 4<br />
</pre><br />
First of all you have to prepare the host with a persistent interface in the right mode and with the right settings. This is easily done by using openvpn and the ip and route tools.<br />
<pre><br />
# openvpn --mktun --dev tun16<br />
# ip link set dev tun16 txqueuelen 100<br />
# ifconfig tun16 192.168.16.1 pointopoint 192.168.16.2 mtu 1500<br />
# route add -net 192.168.16.0 netmask 255.255.255.0 gw 192.168.16.2<br />
</pre><br />
If you need different settings, openvpn will tell you the ifconfig and route commands it uses to configure the interface when being started on the host with the original config file, but without ifconfig-noexec.<br />
Additionally, the guest needs /dev/net/tun to make OpenVPN happy. This can be created with MAKEDEV:<br />
<pre><br />
# cd /var/lib/vserver/<myopenvpnserver>/dev/<br />
# ./MAKEDEV tun<br />
(creates the dev/net/tun device accessible by the guest - even a tap interface needs /dev/net/tun !)<br />
</pre><br />
Finally, the guest needs to have the tun device assigned:<br />
<pre><br />
# head /etc/vservers/<myopenvpnserver>/interfaces/1/*<br />
==> /etc/vservers/<myopenvpnserver>/interfaces/1/ip <==<br />
192.168.16.1<br />
<br />
==> /etc/vservers/<myopenvpnserver>/interfaces/1/nodev <==<br />
tun16<br />
<br />
==> /etc/vservers/<myopenvpnserver>/interfaces/1/prefix <==<br />
24<br />
#<br />
</pre><br />
The client's conf may look like that:<br />
<pre><br />
# Basic setup<br />
client<br />
proto tcp-client<br />
dev tun<br />
remote <ipaddress><br />
comp-lzo<br />
verb 4<br />
<br />
# Certificate<br />
ca ...<br />
</pre><br />
<br />
[ Based on derJohn's original answer, all errors mine ] <br />
|Signature=DavidS}}<br />
<br />
{{Question<br />
|Question=Trying to connect to a vserver from the host or another vserver on the same host fails<br />
||Details=strace shows<br />
<pre> <br />
sin_addr=inet_addr("xx.xx.xx.xx")}, yy) = -1 EINVAL (Invalid argument)<br />
</pre><br />
A: The host/guest cannot communicate with another guest on same host.<br />
* check all netmasks on all interfaces (do they overlap) ?<br />
* check policy routing (disable it temporary) ?<br />
* check that lo is up (Networking within a host/guest always uses lo interface)<br />
|Signature=CommonProblems}}<br />
<br />
{{Question<br />
|Question=Can I use iptables ?<br />
||Details=Yes but right now only on the host (rootserver). Please realize that all traffic is local and will not touch the forward chain.<br />
<br>If you really, really, really need iptables on the guest and you are aware about loosing a big part of VServer isolation and security you could add the NET_ADMIN capability. Consider writing wrappers to manage iptables on the host instead.<br />
|Signature=_are_}}<br />
<br />
{{Question<br />
|Question=Is it possible to prevent guest from bringing down primary ip?<br />
||Details=Yes. Remove /etc/vservers/<guest>/interfaces/X/dev, and touch /etc/vservers/<guest>/interfaces/X/nodev<br />
|Signature=Daniel&Serge}}<br />
<br />
{{Question<br />
|Question=Is it possible to provide a different MAC address per vServer?<br />
||Details=Short answer - yes but it's a hassle.<br />
<br />
Real answer from '''_are_''':<br />
<pre><br />
When I once needed 'real' seperate MAC-addresses I used TAP-devices and VDE2 ([http://vde.sourceforge.net/ Virtual Distributed Ethernet]).<br />
Basically vServer is an isolation of existing resources, not a virtualization of 'new' devices.<br />
Without extra fuss you can't add a 'new' network interface to a vServer, no matter if it is eth* or tap*, you always add it to the host and give the vServer access to it.<br />
I got the TAP+VDE2 up and running, but I think it is too much trouble for basically the simple adding of IPs to a vServer unless you really need the MAC address separate.<br />
</pre><br />
|Signature=bobnormal}}<br />
<br />
{{Question<br />
|Question=Is it possible to hide packet counters on the host network interface from vServer guests?<br />
||Details=Yes, see [[Networking_vserver_guests|Networking vServer Guests]]<br />
|Signature=bobnormal}}<br />
<br />
<br />
== Administration tools ==<br />
<br />
{{Question<br />
|Question=Which guest vservers are running?<br />
||Details=Use vserver-stat to find out. Example output:<br />
<pre><br />
CTX PROC VSZ RSS userTIME sysTIME UPTIME NAME<br />
0 77 965.1M 334.6M 14m14s18 2m28s69 1h33m46 root server<br />
49152 7 14M 5.2M 0m00s40 0m00s30 1h30m15 chiffon<br />
</pre><br />
|Signature=derjohn}}<br />
<br />
<br />
{{Question<br />
|Question=Is there a web-based interface for vserver that will allow creation/deletion/configuration etc. of vserver guests?<br />
||Details=<br />
* http://OpenVPS.org which is a set of scripts with a web-interface for webhosters/ISPs<br />
* http://Openvcp.org which is a distributed system (agent!) with a web-interface, with which you can build/remove guests<br />
* http://vsmon.revolutionlinux.com/ is a distributed monitoring-only solution that allows you to search for a particular vserver in your park.<br />
|Signature=derjohn}}<br />
<br />
== Hosting foreign distributions ==<br />
<br />
{{Question<br />
|Question=I run a Debian host and want to build an Ubuntu guest. Howto?<br />
||Details=Simple ;) Assume you want to build a breezy guest on a sid host with IP 192.168.0.2 and hostname vubuntu, then do:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu<br />
</pre><br />
<br />
[UPDATE] Currently there are problems in building breezy under unclear circumstances, which seems to have to do with udev. If the above didnt work, try:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu -- --exclude=udev<br />
</pre><br />
In very recent versions of the utils, the problem should not occur anymore (it has to do with the 'secure-mount' if you look in the MLs)<br />
<br />
Well, sid's debootstrap knows how to bootstrap Ubuntu linux. Make sure to have a current debootstrap package: <br />
<pre><br />
apt-get update<br />
apt-get install debootstrap<br />
</pre><br />
The knowledge how to build ubuntu 'breezy badger' (which you probably want to be your guest at the time of writing) has been added recently.<br />
|Signature=derjohn}}<br />
<br />
<br />
{{Question<br />
|Question=I want to build a Gentoo guest. Howto?<br />
||Details=Even simpler ;) See http://www.gentoo.org/proj/en/vps/vserver-howto.xml#doc_chap3 .<br />
|Signature=gcc}}<br />
<br />
== Application level problems ==<br />
<br />
{{Question<br />
|Question=I did everything right, but the application foo does not start. What's up there?<br />
||Details=Before asking on the IRC channel, please check out the 'problematic programs' page:<br />
[[Problematic Programs]]<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=When I try to ssh to the guest, I log into the host, even if I installed sshd on the guest. What's wrong here?<br />
||Details=Look at /etc/ssh/sshd_config of the host:<br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
#ListenAddress ::<br />
</pre><br />
And now change the setting to <br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
ListenAddress your.hosts.ip.here # not the guests IP! <br />
</pre><br />
Then '/etc/init.d/ssh restart' on the host, after that on the guest (if you did apt-get install ssh on the guest already.)<br />
Do I have to explain more? If the hosts sshd binds all available IP addresses on port 22 (The hosts 'sees' even all addresses of the guests!). So if the guest starts its sshd, it can't bind to port 22 any more. You need to change that setting only on the host. <br />
(BTW: A similar approach has to be done for a lot of daemons, e.g. Apache. If the daemon does not support an explicit bind, you may use the chbind command to 'hide' IP addresses from the daemon before starting.)|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Bind9 does not like to start in my guest.<br />
||Details=Check out the [[Problematic Programs]] page and/or get my [http://linux-vserver.derjohn.de/bind9-packages/bind9-capacheck_9.3.2-2_i386.deb vserver-guest-ready Debian package] for Debian Sid guests and check out the [http://linux-vserver.derjohn.de/bind9-packages/README.txt readme]. (Hint: This is fresh stuff. Please give me feedback)<br />
<br />
[UPDATE] Since VServer Devel 2.1.1-rc18 you do not need to patch the userland tools anymore. The capabilities are masked.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=My mysqld running in a guest behaves strangely and is awfully slow/locks up<br />
||Details=This can be related to /tmp being too small. mysqld stores temporary tables in /tmp and as such, if a lot of queries happen and /tmp runs full this can cause one query to lock up whilst creating the tmp table and all other queries waiting to acquire the lock. There are two possible solutions to that problem: a.) Modify /etc/vservers/vserver-name/fstab and assign more memory to the tmpfs of /tmp and b.) remove the /tmp entry from /etc/vservers/vserver-name/fstab completly. Especially on database servers with a rather high load the second one might be the preferred method.|Signature=sp}}<br />
<br />
{{Question<br />
|Question=Pure-FTP does not run inside a VServer?<br />
||Details=That's because it has capabilities enabled, make sure you rebuild your distro's package passing also the `--without-capabilities` flag to configure.<br />
|Signature=Pedro Algarvio, aka, s0undt3ch}}<br />
<br />
{{Question<br />
|Question=Why do neither sshd nor crond (vixie-cron) work correctly in my CentOS / Fedora guest? I get 'pam_loginuid(crond:session): set_loginuid failed opening loginuid' and similar lines in my logs.<br />
||Details=Took me a while to figure this out, and it turned out to be mentioned in the old wiki. Here is the solution on how to solve a common problem with sshd / crond, somehow related to selinux and auditing:<br />
<br />
pam authentication (also used with openssh) enables "pam_loginuid.so" in the /etc/pam.d/* files. Comment those out as they are not necessary and will not load within a guest anyway. This probably is also necessary on updates later on, if the configs get changed. You therefore may add the following command line to a cronjob file or your software update script:<br />
<pre><br />
/bin/sed --in-place -e "s/^session.*required.*pam_loginuid.so/# session\trequired\tpam_loginuid.so/g" /etc/pam.d/*<br />
</pre><br />
|Signature=patrick}}<br />
<br />
{{Question<br />
|Question=How do i install nagios-plugins on a Gentoo guest?<br />
||Details=Unfortunately, the nagios-plugins ./configure scripts wants to ping 127.0.0.1 which is not available inside a guest. Therefore you have to build nagios-plugins outside the guest.<br />
The easiest way to do this from the host (assuming the guest is running) is:<br />
<pre><br />
vnamespace -e <xid> -- chroot /vservers/<name> emerge nagios-plugins -va<br />
</pre><br />
|Signature=Hollow}}<br />
<br />
{{Question<br />
|Question=Somebody runs ntpd in guest and you can't use ntpdate in host?<br />
||Details=Try to run ntpdate with options -u :<br />
ntpdate -u ntp.domain.xy<br />
or you can use command:<br />
chbind --nid 42 --ip 1.2.3.4 -- ntpdate ntp.domain.xy<br />
where IP will be the IP of host.<br />
|Signature=Punkie/Bertl}}<br />
<br />
<br />
<br />
== Start / Stop a VServer ==<br />
<br />
{{Question<br />
|Question=How do I make a vserver guest start by default?<br />
||Details=At least on Debian, I can tell you how to do it with the new-style config. If your guest is called "derjohn" and you want it to be started somewhere at the of your bootstrap process, then do:<br />
<pre><br />
echo "default" > /etc/vservers/derjohn/apps/init/mark<br />
</pre><br />
If you want to start it earlier, please read the init script "/etc/init.d/util-vserver" to find out how to do it. In most cases you don't need to change this. On Debian the vservers are started at "20", so after most other stuff is up (networking etc.).<br />
<br />
Besides that I created a small helper script for managing the autostart foo: ((vserver-autostart))|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=My host works, but when I start a guest it says that it has a problem with chbind.<br />
||Details=You are probably using util-vserver <= 0.30.209, which does use dynamic network contexts internally (With 0.30.210 this fact changed). So if you compiled your kernel without dynamic contexts, you may start guests, but you can't use the network context.The solution is either to switch to .210 util (or Hollow's toolset) or compile the kernel with dynamic network contexts.<br />
SE Keyword: invalid option `nid' testme.sh<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=What is old-style and new-style config?<br />
||Details=Old-style config refers to a single text-file that contains all the configuration settings. With new-style config the configuration is split into several directories and files. You should probably go for new-style config if you are asking.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=How can I reboot/halt guests?<br />
||Details=It depends. <br />
For legacy Linux-VServer (i.e. 1.2.x), you have to replace /sbin/halt in the guests with vreboot and start rebootmgr in the host. You also need to have a <guest>.conf file in /etc/vservers for each guest. Please have a look at /etc/init.d/rebootmgr.<br />
For Linux-VServer 2.0+, sys_reboot has been virtualized to do the right thing. No changes are needed in guests. Please note that some things depend on the init style used by the guest : read [[util-vserver:InitStyles]]<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=What is the initial PATH?<br />
||Details=By default, vserver uses the 'sysv' startup style, which mimics the init process by running the 3rd runlevel through '/etc/init.d/rc 3' (or '/etc/rc.d/rc 3'). Usually this 'rc' script uses a hard-coded PATH. In the case it doesn't, util-vserver also mimics init's default PATH through /etc/vservers/.defaults/apps/init/environment, or if not present /usr/local/lib/util-vserver/defaults/environment. Beware that all those default PATH usually do not include /usr/local.<br />
|Signature=daniel_hozac&Beuc}}<br />
<br />
{{Question<br />
|Question=When I try to start a guest i get this message "/proc/uptime can not be accessed. Usually, this is caused by procfs-security. Please read the FAQ for more details"?<br />
||Details=After a reboot you need to run the vprocunhide script. If running this script causes many errors to print on the screen, try checking the kernel you have booted with (perhaps it does not have the linux-vserver extensions enabled).<br />
|Signature=mattzerah}}<br />
<br />
== Kernel ==<br />
<br />
{{Question<br />
|Question=Is SMP Supported?<br />
||Details=Yes, on all SMP capable kernel architectures.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Do I really need the legacy-interfaces? What are these legacy-interfaces?<br />
||Details=Since Linux-VServer is an ongoing project, new features might replace old ones, some might require a development version. Legacy-interfaces are available for backward compability (which might be removed someday) with Linux-VServer 1.2.x.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=I have a vserver running on a Linux kernel with preemption. Is VServer "preempt" safe?<br />
||Details=There are no known issues about running vserver on a preemption enabled kernel. I would like to add, that the vserver kernelhackers would probably exclude that option in 'make menuconfig' if there would be an incompatibility. Just my $.02 :)<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=32 vs 64 Bit? What should I take?<br />
||Details=If you have the choice make the host a 64 bit one. You can run a guest as 32 bit or as 64 bit on a 64 bit host. To run it as 32 bit, you need to compile the x86_64 (a.k.a. AMD64) with the following options:<br />
<pre><br />
[*] Kernel support for ELF binaries<br />
<M> Kernel support for MISC binaries<br />
[*] IA32 Emulation <---- without that, the entire 32bit API is not present<br />
<M> IA32 a.out support <br />
</pre><br />
You can force the guest to behave like a 32 environment like this:<br />
<pre><br />
echo linux_32bit > /etc/vservers/$NAME/personality<br />
echo i686 > /etc/vservers/$NAME/uts/machine<br />
</pre><br />
(thanks cehteh for the hint!)<br />
<br />
But you can force debootstrap to put 32 bit binaries into the guest by 'export ARCH=i386';<br />
<pre><br />
export ARCH=i386 ; vserver build .... <br />
</pre><br />
<br />
On debian when using the newvserver script "export ARCH=i386" has no effect, just use:<br />
<pre><br />
newvserver --arch i386 ...<br />
</pre><br />
|Signature=derjohn}}<br />
<br />
<br />
== Distribution specific questions ==<br />
<br />
{{Question<br />
|Question=VServer is included in the stable Debian GNU/Linux for years now. What VS version did they include?<br />
||Details=At the time of writing, Debian Lenny is the stable release of Debian and includes a 2.6.26 based kernel-package called 2.6.26-2-vserver-ARCH. This currently contains VServer 2.3.0.35 (according to changelog.Debian.gz in the Debian package).<br />
|Signature=scientes}}<br />
<br />
{{Question<br />
|Question=Were can I get newer versions of VServer as ready made packages for Debian?<br />
||Details=Here you go: http://linux-vserver.derjohn.de/ . There is also some stuff on backports.org, but my kernels are always 'devel' branch.<br />
|Signature=derjohn}}<br />
<br />
<br />
<br />
== Misc ==<br />
<br />
{{Question<br />
|Question=Why isn't there a device /dev/xyz within a guest?<br />
||Details=Device nodes allow userspace to access hardware (or virtual resources). Creating a device node inside the guest's namespace will give access to that device, so for security reasons, the number of 'given' devices is small.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=I want to (re)mount a partition in a running guest ... but the guest has no rights (capability) to (re)mount?<br />
||Details=I'll explain. I take as example your /tmp partition within the guest is too small, what will be likely the case if you stay with the 16MB default (vserver build mounts /tmp as 16 MB tmpfs!).<br />
<pre><br />
# vnamespace -e XID mount -t tmpfs -o remount,size=256m,mode=1777 none /var/lib/vservers/<guest>/tmp/<br />
</pre><br />
(if there's a problem, try expanding the symlinks in the mount path)<br />
Be warned that the guest will not recognize the change, as the /etc/mtab file is not updated when you mount like this. To permanently change the mount, edit /etc/vserver/<guest>/fstab on the host.<br />
<br />
If you get:<br />
<pre><br />
mount: can't find /var/lib/vservers/<guest>/tmp in /etc/fstab or /etc/mtab<br />
</pre><br />
then try instead:<br />
<pre><br />
vnamespace -e builder chroot /var/lib/vservers/<guest>/ mount -o remount,size=64m,mode=1777 /tmp<br />
</pre><br />
<br />
Note that this not work for adding a bindmount (<tt>-o bind</tt>) of a directory outside of a vserver into the vserver. For this, there is no alternative but restarting the vserver.<br />
|Signature=derjohn}}<br />
<br />
{{Question<br />
|Question=Does anyone know how to increase the size of /tmp within a vserver w/o restarting?<br />
||Details=Use the remount option for mount.<br />
# vnamespace -e XID mount -n -t tmpfs -o remount,size=32m tmpfs /<vdir>/<guest>/tmp<br />
or something like that. The arguments are needed since mount is not going to be using /etc/fstab for the information and the version of /proc/mounts is best understood by<br />
# vnamespace -e XID cat /proc/mounts.<br />
See [[Frequently_Asked_Questions#I want to (re)mount a partition in a running guest ... but the guest has no rights (capability) to (re)mount?]]<br />
|Signature=derjohn/dhozac}}<br />
<br />
<br />
{{Question<br />
|Question=#1 ERROR: capset(): Operation not permitted<br />
||Details=capabilities are not enabled in kernel-setup<br />
please check that CONFIG_SECURITY_CAPABILITIES is loaded or included in the kernel. ( check with "cat /path_to_kernel/.config | grep -i cap ") <br />
(2.6.11.5-vs-1.9.5 + 0.30-205)<br />
|Signature=IrcQuestions}}<br />
<br />
{{Question<br />
|Question=How can I make 'vserver start' mount the root filesystem?<br />
||Details=Mount it via /etc/vservers/vserver-name/fstab, make sure to set the option 'dev' e.g.:<br />
<pre>/dev/drbd0 / xfs rw,dev 0 0</pre><br />
|Signature=AdrianReyer}}<br />
<br />
<br />
{{Question<br />
|Question=I deleted a guest's directory without shutting it down. Now I have a "ghost" running. Is there any possibility to get it out of proc without rebooting?<br />
||Details=<br />
vkill --xid <xid> -s 15; sleep 2; vkill --xid <xid> -s 9<br />
<br />
You will also need to remove guest's ip, for example with:<br />
ip addr del <ip> dev eth0<br />
|Signature=daniel_hozac & gebura }}<br />
<br />
{{Question<br />
|Question=When using nice and su (for example, in the updatedb cron job), I get: su: Permission denied. What does it mean?<br />
||Details=A guest cannot lower its nice value - and that's what 'su' does through pam_limits which sets a nice value of 0. You can see it through strace:<br />
$ strace nice su nobody<br />
[...]<br />
setpriority(PRIO_PROCESS, 0, 0) = -1 EACCES (Permission denied)<br />
You can use 'su nobody -c nice some_cmd' instead.<br />
(Now there's the question of why a guest process cannot lower its nice value.)<br />
|Signature=daniel_hozac&Beuc}}<br />
<br />
<br />
{{Question<br />
|Question=How do I handle NFS mounts within in a guest?<br />
||Details=There are three ways. <br />
<br />
'''1)''' Mount the NFS share from the host OS and let vserver guest access it as part of it's file system.<br />
<br />
''mount --bind'' may also be beneficial in this scenario.<br />
<br />
'''2)''' Use util-vserver and create a ''fstab.remote'' file in the /etc/vserver/<vserver_name> directory. Populate this with the NFS shares and they will be mounted in the context of the vserver guest.<br />
<br />
See http://www.nongnu.org/util-vserver/doc/conf/configuration.html<br />
<br />
'''3)''' Add capabilities to the vserver guest instance to grant sufficient rights to allow NFS mounts.<br />
<br />
Add the following to /etc/vserver/<vserver_name>/bcapabilities<br />
SYS_ADMIN<br />
Add the following to /etc/vserver/<vserver_name>/ccapabilities<br />
SECURE_MOUNT<br />
BINARY_MOUNT<br />
<br />
See [[Capabilities_and_Flags]] for more information about vserver capabilities.<br />
<br />
If you want the NFS shares to be mounted when the guest starts, add them to /etc/vserver/<vserver_name>/fstab<br />
<br />
||Signature=martindk}}<br />
<br />
<br />
{{Question<br />
|Question=vserver start/stop/enter fails with something like "vnamespace: execvp("/usr/sbin/vserver"): No such file or directory" ?<br />
||Details=Check whether ''/usr'' is mounted in the namespace you are working with.<br />
<pre>vnamespace -e <guest> cat /proc/mounts</pre><br />
If there is no ''/usr'', you can fix your problem with simply mounting it using the following command:<br />
<pre>vnamespace -e <guest> mount /dev/<device> /usr</pre><br />
<br />
||Signature=sim0n}}<br />
<br />
{{Question<br />
|Question=The command vserver <$server> start gives '/etc/init.d/rc: line 74: /etc/default/rcS: No such file or directory', what do I do? <br />
||Details=The vserver has not been correctly installed, this has several reasons<br />
check your install log and it should tell you something about that your server didn't get installed properly<br />
* use stable distribution of debian as server (debootstrap may be different over the versions)<br />
* deny_mount, deny_caps and deny_pivot should be off if your running grsec.<br />
<br />
||Signature=Dude}}<br />
<br />
<br />
{{Question<br />
|Question=How could I rename a vserver directory?<br />
||Details=Please note : this procedure renames the '''directory''', not the '''hostname''' !<br />
#Stop the vserver in question<br />
#rename the <tt>/vservers/<server name></tt> directory<br />
#rename the <tt>/etc/vservers/<server name></tt> directory<br />
#update link: <tt>/etc/vservers/<server name>/run</tt> → <tt>/var/run/vservers/<server name></tt><br />
#update link: <tt>/etc/vservers/<server name>/vdir</tt> → <tt>/etc/vservers/.defaults/vdirbase/<server name></tt><br />
#update link: <tt>/etc/vservers/<server name>/cache</tt> → <tt>/etc/vservers/.defaults/cachebase/<server name></tt><br />
#update link: <tt>/var/run/vservers.rev/<server XID></tt> → <tt>/etc/vservers/<server name></tt><br />
#Start the vserver in question. It should start properly.<br />
<br />
|Signature=FlorianD (from ''hillct'' page in old wiki)}}<br />
<br />
<br />
{{Question<br />
|Question=what if i see my vserver in vserver-stat but with no name ?<br />
||Details=the link in /var/run/vservers is missing<br />
Just do a : cat /etc/vservers/<guest>/context > /var/run/vservers/<guest><br />
check that the <guest> is the good one by using vuname --get --xid <context> with the context you have in the vserver-stat listing.<br />
|Signature=IrcQuestions}}<br />
<br />
== Upgrade from 2.0 to 2.2 ==<br />
<br />
{{Question<br />
|Question=I now get errors like "ncontext: vc_net_create(): Invalid argument; dynamic contexts disabled." on startup. Vservers are not started<br />
||Details=Dynamic context are disabled by default and are deprecated. For example, tagxid and network checks won't be useable with dynamic ids. Now you should manually assign a explicit context to your vservers, like<br />
echo 101 > /etc/vservers/myvserv/context<br />
ADDENDUM: please consider that valid static contexts are between 2 and 49151 ( daniel_hozac on IRC ) otherwise you will end up with unexplainable error "ncontext: vc_net_migrate(): No such process" when trying to start the vserver.<br />
<br />
|Signature=daniel_hozac&Beuc}}<br />
<br />
<br />
{{Question<br />
|Question=How do I assign a static context to an existing vserver?<br />
||Details=Simple ;) See the answer above. <br />
|Signature=gcc}}<br />
<br />
<br />
{{Question<br />
|Question=Since upgrading to a newer VS version my guest complains about "vsched: non-numeric value specified for '--priority_bias" at start time. What's wrong?<br />
||Details=The scheduler paramters changed.You can use this (ugly) script to convert them or do it by hand:<br />
<pre><br />
# cat /usr/local/sbin/vserver-convert-schedule-to-scheddir<br />
#/bin/sh<br />
mkdir /etc/vservers/$1/sched<br />
sed -e 1p -n /etc/vservers/$1/schedule > /etc/vservers/$1/sched/fill-rate<br />
sed -e 2p -n /etc/vservers/$1/schedule > /etc/vservers/$1/sched/interval<br />
sed -e 3p -n /etc/vservers/$1/schedule > /etc/vservers/$1/sched/tokens<br />
sed -e 4p -n /etc/vservers/$1/schedule > /etc/vservers/$1/sched/tokens-min<br />
sed -e 5p -n /etc/vservers/$1/schedule > /etc/vservers/$1/sched/tokens-max<br />
<br />
mv /etc/vservers/$1/schedule /etc/vservers/$1/schedule.converted.see.scheddir<br />
<br />
# see: http://oldwiki.linux-vserver.org/Scheduler+Parameters<br />
# see: http://www.nongnu.org/util-vserver/doc/conf/configuration.html#sched<br />
</pre><br />
||Signature=derjohn}}<br />
<br />
<br />
{{Question<br />
|Question=Since upgrading to a newer VS version my guest doesn't have the amount of shared memory (SHM / SHMMAX / SHMALL ) as it had in the former version. What changed?<br />
||Details=Every VS version that runs on a kernel >= 2.6.19 offers sysctl values per guest. This has to do with the 'ipc namespace' feature that was added to the mainline kernel in version 2.6.19. Linux-VServer uses that feature to give each guest a separate 'ipc namespace' and thus 'own' sysctl values per guest. Because shmmax is such a sysctl value, you have to set it per guest.<br />
Here is an example how to do so:<br />
<br />
<pre><br />
# mkdir /etc/vservers/<vserver>/sysctl/0 -p<br />
# echo kernel.shmall > /etc/vservers/<vserver>/sysctl/0/setting<br />
# echo 134217728 > /etc/vservers/<vserver>/sysctl/0/value<br />
# mkdir /etc/vservers/<vserver>/sysctl/1 -p<br />
# echo kernel.shmmax > /etc/vservers/<vserver>/sysctl/1/setting<br />
# echo 134217728 > /etc/vservers/<vserver>/sysctl/1/value<br />
</pre><br />
It's also explained on the geat flower page:<br />
# see: http://www.nongnu.org/util-vserver/doc/conf/configuration.html -> Look for "sysctl".<br />
<br />
After changing those values, restart your guest, enter it and check if the values are set:<br />
<pre><br />
# sysctl -a | grep shm<br />
...<br />
kernel.shmall = 134217728<br />
kernel.shmmax = 134217728<br />
</pre><br />
<br />
To change a value for a running guest, on the host use:<br />
<pre><br />
vspace -e CONTEXTID --ipc sysctl -w kernel.shmall=134217728<br />
vspace -e CONTEXTID --ipc sysctl -w kernel.shmmax=134217728<br />
</pre><br />
<br />
||Signature=derjohn<br />
}}</div>AdrianReyerhttp://www.linux-vserver.org/DocumentationDocumentation2010-01-13T23:48:53Z<p>AdrianReyer: /* Guides and Howtos */</p>
<hr />
<div><div style="margin: 2em auto 2em auto; padding: 10px; background-color: #F9ECCD; border: 1px solid #004433; text-align: center;"><br />
[[Image:Icon-Caution.png|left]]<br />
We are currently migrating to MediaWiki from our old system, but not all content has been migrated yet. Take a look at the [[Wiki Team]] page for instructions how to help or look at the [http://oldwiki.linux-vserver.org old wiki] to find the information not migrated yet.<br />
<br />
'''To ease migration we created a [[List of old Documentation pages]].'''<br />
</div><br />
<br />
== Introduction ==<br />
<br />
* [[Overview|Virtualization Overview]]<br />
* [[Usage Scenarios]]<br />
* [[Feature Matrix]]<br />
<br />
== Installation ==<br />
<br />
* [[Installation Considerations]]<br />
* [[Installation on Linux 2.6]]: from source, both the kernel and util-vserver<br />
* [[Installation on ArchLinux]]<br />
* [[Installation on CentOS]]<br />
* [[Installation on Debian]]<br />
* [[Installation on Fedora]]<br />
* [[Installation on Gentoo]]<br />
* [[Installation on Mandrake]]<br />
* [http://pld-linux.org/Vserver Installation on PLD-Linux]<br />
* [[Installation on Redhat]]<br />
* [[Installation on Slackware]]<br />
* [[Installation on SuSE/OpenSUSE]]<br />
* [[Installation on Ubuntu]]<br />
<br />
== Configuration ==<br />
<br />
* [[Util-vserver:Documentation|util-vserver Documentation]]<br />
* [[vcd:Documentation|VServer Control Daemon Documentation]]<br />
* [[Share a directory among multiple guests]]<br />
<br />
== Guides and Howtos ==<br />
<br />
* [[Building Guest Systems]]<br />
* [[util-vserver:Howto virtualize an exisiting Linux server|Howto virtualize an existing Linux server]]<br />
* [[VCMD HowTo]]<br />
* [[Howto make bsd-style init sysv-compatible|Howto make Bsd-style init sysv-compatible (archlinux guest system)]]<br />
* [[Installing 32-bit Fedora on 64-bit Debian]]<br />
* [[Installing Ubuntu on Debian]]<br />
* [[Installing an openSUSE vserver guest]]<br />
* [[Networking vserver guests]]<br />
* [[Howto HostAuth]]<br />
* [[Fuse_GlusterFS| Fuse and GlusterFS]]<br />
* [[yum-patch|How to patch vyum]]<br />
* [[yum-upgrade-3.2.4|Upgrading existing installations to yum-3.2.4]]<br />
* [[Migrating from OpenVZ to Linux-Vserver]]<br />
* [[Getting_high_with_lenny]]<br />
* [[Installing_Ubuntu_8.04_Hardy_as_guest]]<br />
* [[Applying CPU Limits]]<br />
* [[Upgrading from Etch to Lenny]]<br />
* [[Upstart issues]]<br />
* [[Limit Networking on Multihomed hosts]]<br />
<br />
== Lists &amp; Theory ==<br />
<br />
* Basic configuration<br />
** [[Capabilities and Flags]]<br />
** [[CPU Scheduler]]<br />
** [[Disk Limits and Quota]]<br />
** [[Resource Limits]]<br />
*** [[Memory Limits]]<br />
*** [[Network Bandwidth Management]]<br />
** [[Virtual System Information]]<br />
** [[Unification]]<br />
<br />
* Security Considerations<br />
** [[Secure Capabilities]]<br />
** [[Secure chroot Barrier]]<br />
** [[Secure Device Nodes]]<br />
** [[Secure ProcFS Entries]]<br />
<br />
* Performance and Stability<br />
** [[Virtualization Overhead]]<br />
<br />
* Implementation Details<br />
** [[Context Accounting]]<br />
** [[Filesystem Attributes]]<br />
** [[Filesystem Tagging]]<br />
** [[Filesystem Namespaces]]<br />
** [[Kernel Userspace Helper]]<br />
** [[Mainline Kernel Virtualization]]<br />
** [[ProcFS]]<br />
** [[Syscall Command Switch]]<br />
<br />
== External Resources ==<br />
<br />
* [http://vserver.13thfloor.at/Remote-Reset/ Simple Remote reset] (remote reset/power your vserver box)<br />
* [http://vserver.13thfloor.at/Null-Modem/ NullModem cables] [http://www.loop-back.com/null-mod.html II] [http://www.tldp.org/HOWTO/Remote-Serial-Console-HOWTO/serial-pc-terminal.html III] (cable required for serial console)</div>AdrianReyerhttp://www.linux-vserver.org/Limit_Networking_on_Multihomed_hostsLimit Networking on Multihomed hosts2010-01-13T23:42:49Z<p>AdrianReyer: Issues added</p>
<hr />
<div>== Situation ==<br />
You have a multihomed host, e.g. DMZ and LAN or different DMZs and want a single VServer only to be able to send packets over a specific network.<br />
<br />
== Solution ==<br />
I used alternate routing tables:<br />
<br />
Once (tested on Debian):<br />
<pre><br />
echo 100 vservera > /etc/iproute2/rt_tables<br />
echo 101 vserverb > /etc/iproute2/rt_tables<br />
</pre><br />
<br />
After rebooting (write an init script)<br />
<pre><br />
ip route add IP-VServer-A/mask table vservera dev ethA<br />
ip route add default table vservera via Gateway-A<br />
ip route add IP-VServer-B/mask table vserverb dev ethB<br />
ip route add default table vserverb via Gateway-B<br />
<br />
ip rule add from net-VServer-A/mask table 100<br />
ip rule add from net-VServer-B/mask table 101<br />
</pre><br />
<br />
== Issues ==<br />
Traffic between IPs on the same host won't go the routes outside the host, you need to set up iptables here.</div>AdrianReyerhttp://www.linux-vserver.org/Limit_Networking_on_Multihomed_hostsLimit Networking on Multihomed hosts2010-01-13T23:01:47Z<p>AdrianReyer: /* Situation */</p>
<hr />
<div>== Situation ==<br />
You have a multihomed host, e.g. DMZ and LAN or different DMZs and want a single VServer only to be able to send packets over a specific network.<br />
<br />
== Solution ==<br />
I used alternate routing tables:<br />
<br />
Once (tested on Debian):<br />
<pre><br />
echo 100 vservera > /etc/iproute2/rt_tables<br />
echo 101 vserverb > /etc/iproute2/rt_tables<br />
</pre><br />
<br />
After rebooting (write an init script)<br />
<pre><br />
ip route add IP-VServer-A/mask table vservera dev ethA<br />
ip route add default table vservera via Gateway-A<br />
ip route add IP-VServer-B/mask table vserverb dev ethB<br />
ip route add default table vserverb via Gateway-B<br />
<br />
ip rule add from net-VServer-A/mask table 100<br />
ip rule add from net-VServer-B/mask table 101<br />
</pre></div>AdrianReyerhttp://www.linux-vserver.org/Limit_Networking_on_Multihomed_hostsLimit Networking on Multihomed hosts2010-01-13T22:56:39Z<p>AdrianReyer: Created page with '== Situation == You have a multihomed host, e.g. DMZ and LAN or different DMZs and want a single VServer only to e able to send packets over a specific network. == Solution == I …'</p>
<hr />
<div>== Situation ==<br />
You have a multihomed host, e.g. DMZ and LAN or different DMZs and want a single VServer only to e able to send packets over a specific network.<br />
== Solution ==<br />
I used alternate routing tables:<br />
<br />
Once (tested on Debian):<br />
<pre><br />
echo 100 vservera > /etc/iproute2/rt_tables<br />
echo 101 vserverb > /etc/iproute2/rt_tables<br />
</pre><br />
<br />
After rebooting (write an init script)<br />
<pre><br />
ip route add IP-VServer-A/mask table vservera dev ethA<br />
ip route add default table vservera via Gateway-A<br />
ip route add IP-VServer-B/mask table vserverb dev ethB<br />
ip route add default table vserverb via Gateway-B<br />
<br />
ip rule add from net-VServer-A/mask table 100<br />
ip rule add from net-VServer-B/mask table 101<br />
</pre></div>AdrianReyerhttp://www.linux-vserver.org/Installation_on_DebianInstallation on Debian2009-04-19T19:56:46Z<p>AdrianReyer: added references to lenny</p>
<hr />
<div>This guide is written against Debian Etch (4.0) and works on Lenny (5.0) as well. Both releases include kernel '''linux-image-vserver-686''', so no manual patching is needed. Hence, Installation on Debian Etch/Lenny is pretty easy and straightforward.<br />
<br />
If you need to compile your own kernel, you need to apply the vserver-version.patch. [http://www.kwu.hu/blog.php Details at 2007/Apr/25]<br />
<br />
<br />
== Packages installation ==<br />
The packages required by Linux-VServer are:<br />
* '''linux-image-vserver-686''' - This is the current kernel, use '''linux-image-vserver-amd64''' on 64-bit systems, you can still create 32-bit guests<br />
* '''util-vserver''' - These are the utilities used to administer the guests<br />
* '''ssh''' - This is probably already installed, but just in case it isn't<br />
<br />
All the packages you need can be obtained via<br />
<pre>aptitude install linux-image-vserver-686 util-vserver ssh</pre><br />
so run this as ''root'' and reboot.<br />
To check out wherever everything went fine you may run<br />
<pre>uname -r</pre><br />
and check that kernel version contains '''vserver''', e.g. '''2.6.18-4-vserver-686'''. That's it.<br />
<br />
Now that the host system is ready, you can proceed with [[Building Guest Systems|building guests]].<br />
<br />
== Versions ==<br />
Debian already contains vservers kernels, so no manual patching and compiling is needed. <br />
{|class="wikitablenowrap"<br />
!Debian release <br />
!Kernel version<br />
!VServer version<br />
|-<br />
| Etch<br />
| 2.6.18+6<br />
| 2.0.2.2-rc9<br />
|-<br />
| Lenny<br />
| 2.6.26+17<br />
| 2.3.0.35<br />
|-<br />
|}<br />
<br />
== References ==<br />
* Linux-VServer HOWTO by Daniel15: http://howtoforge.com/linux_vserver_debian_etch</div>AdrianReyerhttp://www.linux-vserver.org/Installation_on_DebianInstallation on Debian2009-04-19T19:54:10Z<p>AdrianReyer: /* Packages installation */</p>
<hr />
<div>This guide is written against Debian Etch (4.0). This release includes kernel '''linux-image-vserver-686''', so no manual patching is needed. Hence, Installation on Debian Etch is pretty easy and straightforward.<br />
<br />
If you need to compile your own kernel, you need to apply the vserver-version.patch. [http://www.kwu.hu/blog.php Details at 2007/Apr/25]<br />
<br />
<br />
== Packages installation ==<br />
The packages required by Linux-VServer are:<br />
* '''linux-image-vserver-686''' - This is the current kernel, use '''linux-image-vserver-amd64''' on 64-bit systems, you can still create 32-bit guests<br />
* '''util-vserver''' - These are the utilities used to administer the guests<br />
* '''ssh''' - This is probably already installed, but just in case it isn't<br />
<br />
All the packages you need can be obtained via<br />
<pre>aptitude install linux-image-vserver-686 util-vserver ssh</pre><br />
so run this as ''root'' and reboot.<br />
To check out wherever everything went fine you may run<br />
<pre>uname -r</pre><br />
and check that kernel version contains '''vserver''', e.g. '''2.6.18-4-vserver-686'''. That's it.<br />
<br />
Now that the host system is ready, you can proceed with [[Building Guest Systems|building guests]].<br />
<br />
== Versions ==<br />
Debian already contains vservers kernels, so no manual patching and compiling is needed. <br />
{|class="wikitablenowrap"<br />
!Debian release <br />
!Kernel version<br />
!VServer version<br />
|-<br />
| Etch<br />
| 2.6.18+6<br />
| 2.0.2.2-rc9<br />
|-<br />
| Lenny<br />
| 2.6.26+17<br />
| 2.3.0.35<br />
|-<br />
|}<br />
<br />
== References ==<br />
* Linux-VServer HOWTO by Daniel15: http://howtoforge.com/linux_vserver_debian_etch</div>AdrianReyerhttp://www.linux-vserver.org/Problematic_ProgramsProblematic Programs2009-03-22T15:33:36Z<p>AdrianReyer: </p>
<hr />
<div>Some programs do things that might work on a normal host but not inside a V-Server. This is often not a fault of V-Server itself, the programs are doing automagic things which fail and no proper error handling is done. Also sometimes the actions need special rights which are not permitted by default in V-Servers. Allowing CAPs is often not necessary since those special CAPs are only required once (e.g. when the program initializes the directories/settings/whatever).<br />
<br />
<br />
=== OpenGroupware Apache Module ===<br />
If your V-Server doesn't have access to localhost, then the connection to the OpenGroupware server will fail with a "Internal Server Error". The apache module for OpenGroupware called mod_ngobjweb uses a hardcoded "127.0.0.1" IP address in the source (handler.c line 339), this line you need to change to the IP address that should be used (the IP of the V-Server that runs the OpenGroupware? server)<br />
<br />
=== Hylafax (with CAPI) ===<br />
If you want to run hylafax in a V-Server, you will get a CAP and device problem which can be easily solved. First you need your capi20 devices in your V-Server, which can't be created by ./MAKEDEV (requires special CAPs) so copy the devices into the V-Server, like this (command run on the host):<pre>cp -aR /dev/capi* /vservers/your_vserver/dev</pre><br />
<br />
Now hylafax can access your CAPI ISDN card but will exit after a few seconds, the problem is it tries to create a /dev/null nod in the hylafax chroot. This fails because of missing CAPs, so lets help hylafax again with copying the nod into the hylafax chroot in the V-Server. Like this (command run on the host):<pre>cp -aR /dev/null /vservers/your_vserver/var/spool/hylafax/dev</pre> <br />
Allright, now hylafax should have CAPI access and run properly.<br />
<br />
=== Links inside screen inside a V-Server ===<br />
Don't know why, but links crashes systematically being inside a screen session inside a V-Server started outside a V-Server. (please elaborate!) <br />
<br />
=== screen inside a VServer ===<br />
<br />
<pre>[root@ge root]# vserver zoe enter<br />
<br />
zoe:/# screen<br />
Cannot open your terminal '/dev/pts/5' - please check.<br />
<br />
zoe:/# strace screen <br />
...<br />
stat64("/dev/pts/5", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 5), ...}) = 0<br />
open("/dev/pts/5", O_RDWR|O_NONBLOCK) = -1 EACCES (Permission denied)</pre><br />
<br />
is neither a bug nor an issue with screen, it just shows that a vserver context is not allowed to mess with host terminals. either use ssh/telnet to reach the 'guest' or start the screen session before you do the 'enter' (i.e. on the host)<br />
<br />
util-vserver 0.30.211+ includes a workaround for the issue (vlogin), which allocates a tty inside the guest.<br />
<br />
=== OpenLDAP Startup ===<br />
slapd needs name resolution available in order to start up, otherwise it appears to hang. Make sure you have working DNS (or whatever) available to your vserver before starting one with slapd. This behavior is confirmed in my setup, no confirmation from others yet. My Setup: vservers all bind to an interface on a DMZ-like network segment, BIND runs on a vserver. slapd would hang at startup if the BIND vserver had not been started first. <br />
<br />
=== rndc ===<br />
Bind's rndc has a hardcoded 127.0.0.1 somewhere so any command to rndc will fail with connection refused. You should have a reachable localhost address defined in /etc/hosts and then you can use <pre>rndc -s localhost</pre> command. You can make a rndc.conf and set the default-server option, like that the '-s localhost' isn't necessary.<br />
<hr><br />
Please see the section [http://linux-vserver.org/Problematic_Programs#AMD_64_Etch_Vserver_Guest_WORKING.21.21.21_:o.29_21Oct2008 below] to get rndc working without switches.<br />
:-Paul Allen<br />
<hr><br />
<br />
=== Asterisk ===<br />
Since some version of Asterisk (at least since 1.0.2), it will not run anymore. On start it fails with: "Unable to set high priority". <br />
This can be solved by allowing CAP_SYS_NICE for that V-Server. You can also not run Asterisk with the realtime priority - Just pass the '-p' command line argument to disable the read-time priority. Good doc on setting up Asterisk devices in the vserver: http://www.telephreak.org/papers/vpa/ (additional documentation for Asterisk 1.4 installation available here: https://customer.lylix.net/knowledgebase.php?action=displayarticle&catid=2&id=27)<br />
<br />
=== Open/FreeSwan ===<br />
No patch needed, openswan gives out some errors about writing to /proc, but those can be ignored.<br />
<br />
=== Samba ===<br />
Oplocks don't work as smbd insists on receiving break requests from 127.0.0.1<br />
Just patch source/smbd/oplock.c (commenting paranoid code)<br />
<pre><br />
+++ oplock.c.orig 2005-02-14 14:27:51.000000000 +0200<br />
--- oplock.c 2005-02-02 12:27:50.000000000 +0200<br />
@@ -181,14 +181,12 @@<br />
return False;<br />
}<br />
<br />
+#if 0<br />
/* Validate message from address (must be localhost). */<br />
if(from.sin_addr.s_addr != htonl(INADDR_LOOPBACK)) {<br />
DEBUG(0,("receive_local_message: invalid 'from' address \<br />
(was %lx should be 127.0.0.1)\n", (long)from.sin_addr.s_addr));<br />
return False;<br />
}<br />
+#endif<br />
<br />
/* Setup the message header */<br />
SIVAL(buffer,OPBRK_CMD_LEN_OFFSET,msg_len);<br />
</pre><br />
or if you don't want to patch the samba source code you can disable oplock in Samba and it will work too!<br />
<br />
Just put the following in your smb.conf:<br />
<pre><br />
kernel oplocks = no<br />
oplocks = no<br />
</pre><br />
Note: The Vserver using Samba should also listen on the broadcast address. Thereby you will not be able to have two samba servers in the same net (on the same broadcast).<br />
<br />
To assign the broadcast address to a vserver guest you need to create a new directory inside the /etc/vservers/<guest name>/interfaces/ directory. The directory is a number not used by this vserver guest. Inside the directory should be normal information and a file called nodev (see util-vserver for information). The contents of the dev file can be identical between directories.<br />
<br />
==== Samba from Debian 3.1 ====<br />
<br />
The samba deb in sarge (3.1) provided file sharing. The only oddity observed is that the vserver guest running samba did not appear in a windows box's 'My Network Places'<br />
<br />
Use a WINS server. The SMB browsing protocol relies heavily on broadcasts on the local net, which are problematic with vservers. WINS resolution on the other hand is unicast and works flawlessly under vserver.<br />
<br />
==== Samba printer and file server with cups ====<br />
Samba runs correctly in a Mandriva (Mdk) 10.1 Vserver, (Apart from the above oplock problem ?).First, edit your ''/etc/sysconfig/network'' file, and set ''networking'' to ''yes'' (This will solve problems for other services !):<br />
<pre><br />
# cat /etc/sysconfig/network<br />
NETWORKING=yes<br />
</pre><br />
Some more tweaking is needeed in ''/etc/smb.conf''<br />
<pre><br />
# cat /etc/smb.conf<br />
...<br />
# YOUR VSERVER IP/MASK HERE<br />
interfaces = xxx.xxx.xxx.xxx/mask<br />
...<br />
</pre><br />
<br />
But if you're using Samba + Cups to provide printing for Windows clients, AND if you want to use the ''Point and Print'' feature, there is more: In the ''[printers]'' section of your ''smb.conf'', you should have the ''use client drivers'' directive set to ''no'', or the driver upload procedure will fail !<br />
<pre><br />
# cat /etc/smb.conf<br />
...<br />
use client driver = no<br />
...<br />
</pre><br />
So, here is a full ''smb.conf'' file: <br />
<pre><br />
# cat /etc/samba/smb.conf | awk '!/^$/ && !/^\s*(#|;)/ {print $0}'<br />
[global]<br />
workgroup = MYDOMAIN<br />
netbios name = MYHOSTNAME<br />
server string = MYCOMMENT (Samba %v)<br />
printcap name = cups<br />
load printers = yes<br />
printing = cups<br />
printer admin = @adm<br />
log file = /var/log/samba/log.%m<br />
max log size = 50<br />
map to guest = bad user<br />
security = domain<br />
password server = *<br />
encrypt passwords = yes<br />
smb passwd file = /etc/samba/smbpasswd<br />
username map = /etc/samba/smbusers<br />
idmap uid = 10000-20000<br />
idmap gid = 10000-20000<br />
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192<br />
interfaces = 127. MYVSERVERIP/MYVSERVERMASK<br />
wins server = MYWINSIP<br />
dns proxy = no<br />
# for french users:<br />
dos charset = 850<br />
unix charset = ISO8859-1<br />
[homes]<br />
comment = Home Directories<br />
browseable = no<br />
writable = no<br />
[printers]<br />
comment = All Printers<br />
path = /var/spool/samba<br />
browseable = no<br />
guest ok = no<br />
writable = no<br />
printable = yes<br />
create mode = 0700<br />
print command = lpr-cups -P %p -o raw %s -r # using client side printer drivers.<br />
use client driver = no<br />
[print$]<br />
path = /var/lib/samba/printers<br />
browseable = yes<br />
write list = @adm root<br />
guest ok = yes<br />
inherit permissions = yes<br />
</pre><br />
...And a working smbusers:<br />
<pre><br />
# Unix_name = SMB_name1 SMB_name2 ...<br />
root = administrator MYDOMAIN\administrator<br />
nobody = guest pcguest smbguest<br />
</pre><br />
<br />
=== Cups print server ===<br />
Symptoms: The Cups init script exits with:<br />
<pre><br />
Starting CUPS printing system: cupsd: Child exited with status 98!<br />
</pre> <br />
And the logs (''/var/log/cups/error_log'') show:<br />
<pre> <br />
E [date:hour...] StartListening: Unable to bind socket for address 0.0.0.0:631 - Address already in use.<br />
</pre> <br />
...Or something like this. <br />
<br />
With a correct "cupsd.conf file" (Tested version 1.1.21-0.rc1.7mdk, on Mandrake 10.1 - Now Mandriva), it works; All we need is to remove references to ''127.0.0.1'' or ''localhost'' from the file, as well as correctly unsetting the ''Listen'' directive:<br />
<pre> <br />
LogLevel info<br />
TempDir /var/spool/cups/tmp<br />
# No 'Listen' directive !<br />
Port 631<br />
BrowseAddress @LOCAL<br />
BrowseDeny All<br />
BrowseAllow @LOCAL<br />
BrowseOrder deny,allow<br />
<Location /><br />
Order Deny,Allow<br />
Deny From All<br />
Allow From @LOCAL<br />
</Location><br />
<Location /admin><br />
AuthType Basic<br />
AuthClass System<br />
Order Deny,Allow<br />
Deny From All<br />
Allow From YOUR_NETWORK_ADDRESS/YOUR_NETMASK # Example: 172.16.0.0/24<br />
# Or<br />
Allow From @LOCAL<br />
</Location><br />
</pre> <br />
Then you'll need to modify the ''/etc/init.d/cups'' script, to comment any section referring to ''127.0.0.1'' lookup and configuration. This section exists at least on Mandrake 10.1, and is pretty long (Lines 35 to 55 and/or 79), and additionnaly four "''else...if''" lines must be commented far below (Lines 161 to 164) ! <br />
<br />
Remember to stop any Cupsd running in the host server, or to start it via a wrapper ''/etc/init.d/v_cups'' script: <br />
<pre> <br />
#!/bin/sh<br />
# chkconfig: 2345 15 60<br />
# description: Wrapper to start cups bound to a single IP<br />
USR_LIB_VSERVER=/usr/lib/util-vserver<br />
exec $USR_LIB_VSERVER/vsysvwrapper cups $*<br />
</pre> <br />
Do not forget to give a password to the root user, if you want to be able to manage your printers from the web interface (http://yourcupsvserver:631)!<br />
<pre> <br />
# passwd root<br />
...<br />
</pre> <br />
If you use Mandriva 10.1 (And maybe some other distros), you&#8217;ll need to add the printers drivers for Cups, and reload it:<br />
<pre> <br />
# urpmi --root /vservers/yourcupsvserver/ cups-drivers<br />
# /etc/init.d/cups reload<br />
</pre> <br />
&#8230;It added 67 Mb of packages for me. <br />
<br />
Then use ''/etc/init.d/v_cups (re)start'' to launch Cups on the host server. <br />
You will now be able to make Cupsd start in the vserver , but more tweaking on the ACLs may be necessary to avoid authentification problems...<br />
<br />
=== Bind9 on Debian GNU/Linux Woody (3.0), Sarge (3.1), Etch (4.0) ===<br />
named provided by the bind9 binary packages fails to start because it is compiled with CAPs option. <br />
<br />
The debian way is to build** your own package without CAPs:<br />
<pre><br />
su -<br />
cd /usr/src<br />
apt-get build-dep bind9<br />
apt-get source bind9<br />
cd bind9-x.x.x<br />
vi debian/rules<br />
</pre> <br />
Insert the following line after "./configure --prefix=/usr \":<br />
<pre><br />
--disable-linux-caps \ <br />
</pre> <br />
On a NPTL-enabled system you alse have to replace <br />
<pre> <br />
--enable-threads \<br />
</pre> <br />
with<br />
<pre> <br />
--disable-threads \<br />
</pre> <br />
or bind might refuse to run with an other user than root. <br />
<br />
Save the file and go ahead with compiling/installing: <br />
<pre> <br />
dpkg-buildpackage<br />
dpkg -i ../bind9-x.x.x.deb<br />
echo "bind9 hold" | dpkg --set-selections<br />
</pre> <br />
or you may be better off to set the selections for all the packages that were generated by dpkg-buildpackage:<br />
<pre><br />
echo -e "bind9-doc hold\nbind9-host hold\nbind9utils hold\ndnsutils hold\nlibbind9-40 hold\nlibbind-dev hold\nlibdns43 hold\nlibisc44 hold\nlibisccc40 hold\nlibisccfg40 hold\nliblwres40 hold\nlwresd hold" | dpkg --set-selections<br />
</pre><br />
The last line is to set the package "on hold", so it is not touched by the update process. you have to take care of security holes by yourself now! <br />
<br />
The Xs in "bind9-x.x.x" denote the version number of bind9. Alternatively you can allow the CAP_SYS_RESOURCE for that V-Server. The best way would be to fix bind, which is somehow broken when it comes to capabilities. Daniel Hokka Zakrisson repaired it. His patch is to be found here:<br />
<br />
[http://daniel.hozac.com/stuff/bind-9.3.2-caps-when-available.patch bind-9.3.2-caps-when-available.patch]<br />
<br />
So, if you recompile, it would be the cleanest way to apply that patch. Thanks Daniel! It would be also nice, if someone submits that patch to the bind people or maybe to your distribution's package maintainers in the first step.<br />
<br />
Get my [http://linux-vserver.derjohn.de/bind9-packages/bind9-capacheck_9.3.2-2_i386.deb vserver-guest-ready Debian bind9 package] for Debian Sid guests. Feedback welcome: aj@net-lab.net<br />
<br />
<br />
<br />
<hr><br />
====AMD 64 Etch Vserver Guest WORKING!!! :o) 21Oct2008'''====<br />
<br />
Before I begin with all the grueling steps, if you want to be lazy, I wrote a Perl script to do all of this for you, and you can get it [http://compampus.com/bind9-vserver-installer.pl here].<br />
:*Note:<br />
::If you plan to use the script, you need to ensure you have Perl5, as well as have your locale set properly.<br />
::(On a brand-new Etch guest, I had to do those before my script would work)<br />
:I noticed after much googling that all links I found to any of the pre-compiled Bind9 (in the above bind9-capacheck directories) are DEAD. However, after many times of running into a brick wall, I caught something that isn't mentioned here...<br />
Following the above steps to build Bind9 from source acquired with apt-get, if you look closely, on about line 499 or so after you execute the dpkg-buildpackage command, you'll see this:<br />
<pre><br />
dpkg-source: building bind9 using existing bind9_9.3.4.orig.tar.gz<br />
dpkg-source: building bind9 in bind9_9.3.4-2etch3.diff.gz<br />
dpkg-source: building bind9 in bind9_9.3.4-2etch3.dsc<br />
</pre><br />
:...which is basically ignoring the debian/rules modifications you just made...<br />
So, following you will find the steps I took to make Bind9 AND rndc run flawlessly on my vserver guest. Everything denoted with // in front is a comment:<br />
<pre><br />
su -<br />
cd /usr/src<br />
mkdir bind9-build<br />
cd !$<br />
apt-get build-dep bind9<br />
apt-get source bind9<br />
mkdir unused<br />
mv bind9_* !$ //note the ones you don't need all have the underscore _<br />
cd bind9-x.x.x //whatever your version # is<br />
nano debian/rules<br />
beneath this line: ./configure --prefix=/usr \<br />
-add --disable-linux-caps \<br />
-change --enable-threads \ to: --disable-threads \<br />
dpkg-buildpackage<br />
cd ../<br />
dpkg -i *deb //This will install all the debs that were created, but the actual bind9 deb will fail because of dependencies<br />
//At this point, you can just run it again, or 'apt-get install -f' might fix it, but I'm unsure on that<br />
dpkg -i *deb<br />
echo "bind9 hold" | dpkg --set-selections<br />
</pre><br />
:Here you will still see it fail to start, and even though it says that, it isn't named that failed, but only rndc.<br />
:So actually, you can stop here, but rndc will fail every time, and bind won't restart with the /etc/init.d/bind9 restart call<br />
:In fact, everytime you want to reload, you'll need to manually kill the named process ID and then issue:<br />
:/etc/init.d/bind9 start<br />
:But if you're a perfectionist like me, and you want a completely error-free starting Bind9 with working rndc, keep reading...<br />
<pre><br />
ps aux|grep named<br />
</pre><br />
:That will show an output something like:<br />
<pre>bind 9376 0.0 0.3 20844 3228 ? Ss 15:52 0:00 /usr/sbin/named -u bind</pre><br />
:Assuming the above was your actual output, your next command would be:<br />
<pre><br />
kill 9376 //Kill the process ID<br />
</pre><br />
:Now here's where the trickery comes in...<br />
:For some reason, if you have the EXACT same key definitions in all the correct places, but the conf files aren't using the actual key file, rndc WILL fail...<br />
:Let me say that again... rndc WILL fail... I only know because it took me 3 days to find out why it was failing...<br />
:So first:<br />
<pre><br />
rndc-confgen -s your.eth0.ip.address -k your-custom-keyname<br />
</pre><br />
:Assuming my eth0 IP is 11.22.33.44 and I used a keyname of my-vps-key, the following would be my output:<br />
<pre><br />
vps:~# rndc-confgen -s 11.22.33.44 -k my-vps-key<br />
# Start of rndc.conf<br />
key "my-vps-key" {<br />
algorithm hmac-md5;<br />
secret "D4fZPZPFpG037a/NHLedgg==";<br />
};<br />
<br />
options {<br />
default-key "my-vps-key";<br />
default-server 11.22.33.44;<br />
default-port 953;<br />
};<br />
# End of rndc.conf<br />
<br />
# Use with the following in named.conf, adjusting the allow list as needed:<br />
# key "my-vps-key" {<br />
# algorithm hmac-md5;<br />
# secret "D4fZPZPFpG037a/NHLedgg==";<br />
# };<br />
#<br />
# controls {<br />
# inet 11.22.33.44 port 953<br />
# allow { 11.22.33.44; } keys { "my-vps-key"; };<br />
# };<br />
# End of named.conf<br />
</pre><br />
:Now, this information is VERY important, and misleading at the same time...<br />
:Don't simply plop the 'named.conf' data into named.conf and the 'rndc.conf' data into rndc.conf... It will NOT work.<br />
:The 'key' portion is all you need for your keyfile, and your keyfile MUST be named the same as the name you put into rndc-confgen<br />
:There are several ways to do this, but the simplest is to highlight the key section, right click, click 'copy' and then:<br />
<pre><br />
nano /etc/bind/my-vps-key //Don't forget, name must match the rdnc-confgen output!<br />
</pre><br />
:Inside nano, hit shift+insert on your keyboard, and it *should* paste everything properly. Hit ctrl+x to exit nano (press y at the prompt to save).<br />
:Once complete, you can verify your key file with:<br />
<pre><br />
cat /etc/bind/my-vps-key<br />
</pre><br />
:...and the output should read something like:<br />
<pre><br />
vps:~# cat /etc/bind/my-vps-key<br />
key "my-vps-key" {<br />
algorithm hmac-md5;<br />
secret "D4fZPZPFpG037a/NHLedgg==";<br />
};<br />
<br />
</pre><br />
:Now, do the same thing for the 'options' section of the rndc-confgen output, except you'll be adding that to the rndc.conf file, along with an include statement for the key file you just made.<br />
:NOTE: Delete all lines in rndc.conf first so that it contains only what you paste. (ctrl+k will cut lines... cut all of them before pasting)<br />
:After pasting, your ENTIRE rndc.conf file should look thusly:<br />
<pre><br />
include "/etc/bind/my-vps-key";<br />
<br />
options {<br />
default-key "my-vps-key";<br />
default-server 11.22.33.44;<br />
default-port 953;<br />
};<br />
</pre><br />
:Finally, you need to do the same process, but with the 'controls' section of the rndc-confgen output, and that goes in /etc/named.conf. Again, you will need to add the include statement for the key you created.<br />
:Also, while you're editing named.conf, you might as well go ahead and edit the IP addresses. The only one that really seems to matter is the 'localhost' zone<br />
:When finished, your named.conf should look something like this (only showing the relevant portions)<br />
:;Be sure to remove the comment tags (#) from the beginning of the lines!!!<br />
<pre><br />
<snip><br />
// If you are just adding zones, please do that in /etc/bind/named.conf.local<br />
<br />
include "/etc/bind/named.conf.options";<br />
include "/etc/bind/my-vps-key";<br />
<br />
controls {<br />
inet 11.22.33.44 port 953<br />
allow { 11.22.33.44; } keys { "my-vps-key"; };<br />
};<br />
<br />
zone "." {<br />
type hint;<br />
file "/etc/bind/db.root";<br />
};<br />
<br />
// be authoritative for the localhost forward and reverse zones, and for<br />
// broadcast zones as per RFC 1912<br />
<br />
zone "11.22.33.44" {<br />
type master;<br />
file "/etc/bind/db.local";<br />
};<br />
<br />
zone "127.in-addr.arpa" {<br />
<snip><br />
</pre><br />
:I'm unsure if this next step is necessary, but I did it anyway...<br />
:Edit /etc/bind/db.local and modify all instances of 'localhost' and '127.0.0.1' with your IP address.<br />
:When complete, it should look something like this:<br />
<pre><br />
vps:~# cat /etc/bind/db.local<br />
;<br />
; BIND data file for local loopback interface<br />
;<br />
$TTL 604800<br />
@ IN SOA 11.22.33.44. root.11.22.33.44. (<br />
1 ; Serial<br />
604800 ; Refresh<br />
86400 ; Retry<br />
2419200 ; Expire<br />
604800 ) ; Negative Cache TTL<br />
;<br />
@ IN NS 11.22.33.44.<br />
@ IN A 11.22.33.44<br />
</pre><br />
:All that's left is to start your new error-free Bind9 (we hope...)<br />
<pre><br />
/etc/init.d/bind9 start<br />
</pre><br />
<br /><br />
If you find anything in this tutorial OR in the Perl script that's incorrect, or that would make it better, please let me know: [mailto:paul@grandesigns.net?Subject=VServer_Bind9_Tutorial paul@grandesigns.net]<br />
<br><hr><br />
=====Update (11/04/08)...=====<br />
After an apt-get dist-upgrade, bind9 failed to start. After poking around, I found out that somehow /etc/default/bind had the -u switch set to run Bind9 as the user 'named'. Weird, because with Bind9, there is no user 'named'. I set it back to: -u bind<br />
and everything fired right up.<br />
Also, my particular vserver doesn't log to dmesg, so if you want intuitive debug level info that isn't being printed in /var/log/syslog, then you can run named like this:<br />
<pre><br />
named -g -d 10<br />
</pre><br />
That tells named to start with the debug level globally set to 10.<br />
<br><br><br />
I also tinkered a little more and found that you can remove all of the db. files in /etc/bind and in /etc/bind/named.conf except for db.local and db.root. In other words, you don't need to configure or keep db.0, db.127, db.255, db.empty, nor do you need them referenced in named.conf.<br />
<br><br><br />
<hr><br />
<br />
''Problems getting this to work in an x86_64 vserver. Any hints? From what I can tell from stracing, turning off threads doesn't fix everything related to it. It also caused a juicy Ksymoops.''<br />
<br />
''- Apparently this does work when running bind as user root. I Installed a bare Debian Etch vserver without granting any special capabilities on my x86_64 system, apt-get install bind9, kill any started named-processes and edit /etc/default/bind, changing the user (-u) from bind to root. Bind starts now starts when using /etc/init.d/bind9 start and resolving seems to work. Mind you, the usual warnings and rants about running stuff as root still applies! - 2007-08-06 MGS''<br />
<br />
=== Zimbra Mail ===<br />
Zimbra is many applications (including Postfix and MySQL? and OpenLDAP? and more) which try to take over the interfaces, and depend a lot on binding from 127.0.0.1 - it is not hard to change, but there is a couple of tricks - it is documented here - http://wiki.zimbra.com/index.php?title=Install_VServer<br />
<br />
=== xine ===<br />
won't start with no error message.<br />
<br />
"xine --verbose" shows this.<br />
<pre> <br />
ERROR: Could not determine network interfaces, you must use a interfaces config line<br />
</pre> <br />
This happens if you have the xineplug_inp_smb.so plugin. Delete it and everything is fine.<br />
<br />
=== 127.0.0.1 issues ===<br />
I had problems with an application that wanted me to access it on 127.0.0.1 and AS 127.0.0.1 to be able to do its configuration. A simple tweak solved the problem. I renamed the default interface directory "0" in /etc/vservers/server/interfaces to "1" and created interface 0 as :<br />
<pre> <br />
dev lo <br />
ip 127.0.0.1 <br />
mask 255.0.0.0 <br />
name lo <br />
</pre> <br />
now interface "1" is the default created interface by the vserver build script with a local adress like 192.168.1.2 and interface "0" is the loopback. I can now telnet on 127.0.0.1 and it sees that im connecting to 127.0.0.1 from 127.0.0.1<br />
<br />
Compiling nagios-1.4 within a vserver requires this, otherwise it hangs during the configure with "checking for ICMP ping syntax..."<br />
<div style="color: red;"><br />
note: nagios is broken, because it uses a hardcoded 127.0.0.1, and this change (which is not needed with newer kernels providing lback remapping) will affect guest security and should not be used lightly (Bertl)<br />
</div><br />
<br />
=== Hula-project ===<br />
Does not want to start. TODO: add more information.<br />
<br />
=== Postfix ===<br />
<br />
==== Postfix 2.1.5 (Debian Sarge) ====<br />
On a vserver with two interfaces (lo and eth0), and a postfix 2.1.5 listening on lo, postfix can't send emails : "Invalid argument"... Setting smtp_bind_address (http://www.postfix.org/postconf.5.html#smtp_bind_address) to the external address solves the issue. <br />
<br />
==== Postfix on Debian Etch (for local only mail) ====<br />
<br />
See [[Postfix local only problem]]<br />
<br />
==== Postfix Policy Daemon ====<br />
Running a Debian 3.1 Sarge with Backports I have several issues with the postfix-policyd because it wants to set the rlimits.<br />
<br />
Log returns: <br />
<pre> <br />
cannot set rlimit: Operation not permitted<br />
</pre> <br />
Strace tells us:<br />
<pre> <br />
setrlimit(RLIMIT_NOFILE, {rlim_cur=4097, rlim_max=4097}) = -1 EPERM (Operation not permitted)<br />
</pre> <br />
Output on the Host<br />
<pre> <br />
# ulimit -Ha<br />
...<br />
-n: file descriptors 1024<br />
...<br />
</pre><br />
Thats too little...<br />
<br />
Solution:<br />
<br />
The App has again a build in need to use CAP_SYS_RESOURCE (which is bad (tm)) so in the guest do:<br />
<pre><br />
# ulimit -HS -n 8192<br />
# ulimit -Ha<br />
.. shows us now the correct 8192 instead of 1024.<br />
<br />
# vserver $yourVserverName restart<br />
# vserver $yourVserverName enter<br />
<br />
$yourVserverName # ulimit -Ha<br />
...<br />
-n: file descriptors 8192<br />
...<br />
</pre><br />
Everything should be fine now !<br />
<br />
<br />
<br />
=== DB2 ===<br />
DB2 needs at least the following capabilities:<br />
CAP_NET_RAW<br />
CAP_NET_ADMIN<br />
CAP_SYS_ADMIN<br />
CAP_IPC_LOCK<br />
CAP_IPC_OWNER<br />
<div style="color: red;"><br />
WARNING: this configuration reduces security<br />
</div><br />
<br />
=== ejabberd ===<br />
ejabberd does not work properly in a Linux-VServer guest under Debian Etch. The server eventually stops accepting connections. Also, it's not possible to control ejabberd with ejabberdctl.<br />
<br />
Newer versions of ejabberd (2.0.x) don't seem to have this problem. On Debian Etch a newer version can be installed from etch-backports ([http://backports.org/dokuwiki/doku.php?id=instructions backports.org]).<br />
<br />
The Jabber server from the jabber package also works.<br />
<br />
=== VMware Server ===<br />
VMware Server needs the following capabilities to run correctly:<br />
CAP_MKNOD<br />
CAP_SYS_MODULE<br />
CAP_SYS_ADMIN<br />
CAP_SYS_NICE<br />
CAP_NET_RAW<br />
CAP_NET_ADMIN<br />
CAP_IPC_OWNER<br />
<div style="color: red;"><br />
WARNING: this configuration reduces security<br />
</div><br />
<br />
=== ntpd ===<br />
The ntpd daemon needs to set the hardware time and can't do that from inside a vserver by default.<br />
Allow CAP_SYS_TIME and ntpd will be happy.<br />
<br />
=== FAI server / fai-setup ===<br />
FAI Server / fai-setup<br />
fai-setup wants to create some devices and needs to mount proc.<br />
<br />
bcapabilities: <br />
MKNOD<br />
ccapabilities: <br />
SECURE_MOUNT<br />
SECURE_REMOUNT<br />
BINARY_MOUNT<br />
<div style="color: red;"><br />
WARNING: this configuration reduces security big time<br />
</div><br />
Only do it if you just want your FAIserver in a seperate tree from main server.</div>AdrianReyerhttp://www.linux-vserver.org/Frequently_Asked_QuestionsFrequently Asked Questions2006-09-27T21:08:46Z<p>AdrianReyer: </p>
<hr />
<div><div style="margin: 2em auto 2em auto; padding: 10px; background-color: #F9ECCD; border: 1px solid #004433; text-align: center;"><br />
[[Image:Icon-Caution.png|left]]<br />
We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the [[Wiki Team]] page for instructions how to help or look at the [http://oldwiki.linux-vserver.org old wiki] to find the information not migrated yet.<br />
<br />
'''To ease migration we created a [[List of old Documentation pages]].'''<br />
</div><br />
<br />
CURRENTLY THE CONTENT OF THE OLD WIKI FAQ (AND MORE) IS BEING MIGRATED TO THIS PAGE (TASK: DERJOHN)<br />
<br />
<br />
__TOC__<br />
<br />
{{Question|Question=What is a 'Guest'?||Details=To talk about stuff, we need some naming. The physical machine is called 'Host' and the 'main' context running the Host Distro is called 'Host Context'. The virtual machine/distro is called 'Guest' and basically is a Distribution (Userspace) running inside a 'Guest Context'.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=What kind of Operating System (OS) can I run as guest?||Details=<br />
A: With VServer you can only run Linux guests. The trick is that a guest does not run a kernel on its own (as XEN and UML do), it merely uses a virtualized host kernel-interface. VServer offers so called security contexts which make it possible to seperate one guest from each other, i.e. they cannot get data from each other. Imagine it as a chroot environment with much more security and features.|Signature=derjohn}}<br />
<br />
{{Question|Question=Which distributions did you test?||Details=<br />
A: Some. Check out the wiki for ready-made guest images. But you can easily build own guest images, e.g. with Debian's debootstrap. Checkout ((step-by-step Guide 2.6)) how to do that.|Signature=derjohn}}<br />
<br />
{{Question|Question=Is VServer comparable to XEN/UML/QEMU?||Details=<br />
A: Nope. XEN/UML/QEMU and VServer are just good friends. Because you ask, you probably know what XEN/UML/QEMU are. VServer in contrary to XEN/UML/QEMU not "emulate" any hardware you run a kernel on. You can run a VServer kernel in a XEN/UML/QEMU guest. This is confirmed to work at least with Linux 2.6/vs2.0.|Signature=derjohn}}<br />
<br />
{{Question|Question=Is VServer secure?||Details=<br />
A: We hope so. It should be as least as secure as Linux is. We consider it much much more secure though.|Signature=derjohn}}<br />
<br />
{{Question|Question=Performance?||Details=<br />
A: For a single guest, we basically have native performance. Some tests showed insignificant overhead (about 1-2%) others ran faster than on an unpatched kernel. This is IMVHO significantly less than other solutions waste, especially if you have more than a single guest (because of the resource sharing).|Signature=derjohn}}<br />
<br />
{{Question|Question=Is SMP Supported?||Details=<br />
A: Yes, on all SMP capable kernel architectures.|Signature=derjohn}}<br />
<br />
{{Question|Question=Resource sharing?||Details=<br />
A: Yes ....<br />
* memory: Dynamically.<br />
* CPU usage: Dynamically (token bucket)|Signature=derjohn}}<br />
<br />
{{Question|Question=Resource limiting?||Details=<br />
A: Yes, you can set maximum limits per guest, but you can only offer guaranteed resource availability with some ticks at the time. There is the possibility to ulimit and to rlimit. Rlimit is a new feature of kernel 2.6/vs2.0.|Signature=derjohn}}<br />
<br />
{{Question|Question=Disk I/O limiting? Is that possible?||Details=<br />
A: Well, since vs2.1.1 linux-vserver supports a mechanism called 'I/O scheduling', which appeared in the 2.6 mainline some time ago. The mainline kernel offers several I/O schedulers:<br />
<br />
<pre><br />
# cat /sys/block/hdc/queue/scheduler<br />
noop [anticipatory] deadline cfq<br />
</pre><br />
<br />
The default is anticipatory a.k.a. "AS". When running several guests on a host you probably want the I/O performance shared in a fair way among the different guests. The kernel comes with a "completely fair queueing" scheduler, CFQ, which can do that. (More on schedulers can be found at http://lwn.net/Articles/114770/)<br />
<br />
This is how to set the scheduler to "cfq" manually:<br />
<pre><br />
root# echo "cfq" > /sys/block/hdc/queue/scheduler<br />
root# cat /sys/block/hdc/queue/scheduler<br />
noop anticipatory deadline [cfq]<br />
</pre><br />
<br />
Keep in mind that you have to do it on all physical discs. So if you run an md-softraid, do it to all physical /dev/hdXYZ discs!<br />
<br />
If you run Debian there is a predefined way to set the /sys values at boot-time:<br />
<br />
<pre><br />
# apt-get install sysfsutils<br />
[...]<br />
<br />
# cat /etc/sysfs.conf | grep cfq<br />
block/sda/queue/scheduler = cfq<br />
block/sdc/queue/scheduler = cfq<br />
<br />
# /etc/init.d/sysfsutils restart<br />
</pre><br />
<br />
For non-vserver processes and CFQ you can set by which key the kernel decides about the fairness:<br />
<br />
<pre><br />
cat /sys/block/hdc/queue/iosched/key_type<br />
pgid [tgid] uid gid<br />
</pre><br />
Hint: The 'key_type'-feature has been removed in the mainline kernel recently. Don't look for it any longer :(<br />
<br />
The default is tgid, which means to share fairly among process groups. Think every guest is treated like a own process group. It's not possible to set a scheduler strategy within a guest. All processes belonging to the same guest are treated like "noop" within the guest. So: If you run apache and some ftp-server within the _same_ guest, there is no fair scheduling between them, but there is fair scheduling between the whole guest and all other guests.<br />
<br />
And: It's possible to tune the scheduler parameters in several ways. Have a look at /sys/block/hdc/queue/....<br />
<br />
You need a very recent Version of VS devel, e.g. the 2.1.1-rc18 can do it. Some older version have that feature too, then it got lost and was reinvented. So: Go and get a rc18 - only in 'devel', not stable!|Signature=derjohn}}<br />
<br />
{{Question|Question=Why isn't there a device /dev/bla? within a guest||Details=<br />
A: Device nodes allow Userspace to access hardware (or virtual resources). Creating a device node inside the guest's namespace will give access to that device, so for security reasons, the number of 'given' devices is small.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is Unification (vunify)?||Details=<br />
A: Unification is Hard Links on Steroids. Guests can 'share' common files (usually binaries and libraries) in a secure way, by creating hard links with special properties (immutable but unlinkable (removable)). The tool to identify common files and to unify them is called vunify.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is vhashify?||Details=<br />
A: The successor of vunify, a tool which does unification based on hash values (which allows to find common files in arbitrary paths.)|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I manage a multi-guest setup with vhashify?||Details=<br />
A: For 'vhashify', just do these once:<br />
<br />
<pre><br />
mkdir /etc/vservers/.defaults/apps/vunify/hash /vservers/.hash<br />
ln -0s /vservers/.hash /etc/vservers/.defaults/apps/vunify/hash/root<br />
</pre><br />
<br />
Then, do this one line per vserver:<br />
<br />
<pre><br />
mkdir /etc/vservers/<vservername>/apps/vunify # vhashify reuses vunify configuration<br />
</pre><br />
<br />
<br />
The command 'ln' creates a link between two files. "ln -s" creates a symbolic link -- two files are linked by name. "ln -0s" uses a Vserver extention to create a unified link.|Signature=derjohn}}<br />
<br />
{{Question|Question=With which VS version should I begin?||Details=<br />
A: If you are new to VServer I recommend to try 2.0.+. Take "alpha utils" Version 0.30.210. In Debian Sid there appeared well running version of it recently. (It's a .210 at the time of writing).|Signature=derjohn}}<br />
<br />
{{Question|Question=is there a way to implement "user/group quota" per VServer?||Details=<br />
A: Yes, but not on a shared partition for now. You need to put the guest on a separate partition, setup a vroot device (to make the quota access secure), copy that into the guest, and adjust the mtab line inside the guest.|Signature=derjohn}}<br />
<br />
{{Question|Question=what about "Quota" for a context?||Details=<br />
A: Context quotas are now called Disk Limits (so that we can tell them apart from the user/group quotas :). They are supported out of the box (with vs2.0) for all major filesystems (Ext2/3, ReiserFS, XFS, JFS)|Signature=derjohn}}<br />
<br />
{{Question|Question=Does it support IPv6?||Details=<br />
A: Currently not. Some developer has to move his ... to reimplement this functionality from the V4 code (I read that on the ML ;)). Will probably be superseded by the ngnet (next generation networking) soon. There is a Wiki page regarding this: http://linux-vserver.org/IPv6|Signature=derjohn}}<br />
<br />
{{Question|Question=I can't do all I want with the network interfaces inside the guest?||Details=<br />
A: For now the networking is 'Host Business' -- the host is a router, and each guest is a server. You can set the capability ICMP_RAW in the context of the guest, or even the capability CAP_NET_RAW (which would even allow to sniff interfaces of other guests!). Likely to change with ngnet. |Signature=derjohn}}<br />
<br />
{{Question|Question=Is there a web-based interface for vserver that will allow creation/deletion/configuration etc. of vserver guests?||Details=<br />
A. [Update] Errrh, there is http://OpenVPS.org which is a set of scripts with a web-interface for webhosters/ISPs. <br />
A. [Update] Errrh, there is http://Openvcp.org which is a distributed system (agent!) with a web-interface, with which you can build/remove guests! cool stuff! beta, try out!|Signature=derjohn}}<br />
<br />
{{Question|Question=What is old-style and new-style config?||Details=<br />
A. Old-style config refers to a single text-file that contains all the configuration settings. With new-style config the configuration is split into several directories and files. You should probably go for new-style config if you are asking.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is the "great flower page"?||Details=<br />
A. Well, this page contains all configation options for vserver in version > 1.9 (I think .. I joined Linux-VServer in version 2, so I don't know for sure). The name of the page is derivived from the stylesheet(s) it contains: It displays background pictures of a very great flower, so regard it as highly optimized. It was designed by a non-designer, who asks us to create a better one. I played with the thought of creating a complete new theme for that page - but actually we all got used to the name "great flower page", so we stick to it. If you are unable to read it clearly, feel invited to join the IRC channel #vserver, we may tell you how to ;)|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I add several IPs to a vserver? ||Details=<br />
A: First of all a single guest vserver only supports up to 16 IPs (There is a 64-IP patch available, which is in "derjohn's kernel", you need extra util-vserver anyway).<br />
Here is a little helper-script that adds a list of IPs defined in a text file, one per line.<br />
<pre><br />
#!/bin/bash<br />
j=1<br />
for i in `cat myiplist`; do<br />
j=$(($j+1))<br />
mkdir $j<br />
echo $i > $j/ip<br />
echo $i > $j/ip-old<br />
echo "24" > $j/prefix<br />
done<br />
</pre>|Signature=derjohn}}<br />
<br />
{{Question|Question=If my host has only one a single public IP, can I use RFC1918 IP (e.g. 192.168.foo.bar) for the guest vservers?||Details=<br />
A: Yes, use iptables with SNAT to masquerade it. <br />
<pre><br />
iptables -t nat -I POSTROUTING -s $VSERVER_NETZ ! -d $VSERVER_NETZ -j SNAT --to $EXT_IP<br />
</pre><br />
See: HowtoPrivateNetworking and <br />
http://www.tgunkel.de/it/software/doc/linux_server#h3-Vserver_Masquerading_SNAT (THX, [MUPPETS]Gonzo)|Signature=derjohn}}<br />
<br />
{{Question|Question=If I shut down my vserver guest, the whole Internet interface ethX on the host is shut down. What happened? ||Details=<br />
A: When you shut down a guest (''i.e. vserver foo stop''), the IP is brought down on the host also. If this IP happens to be the primary IP of the host, the kernel will not only bring down the primary IP, but also all secondary IP addresses. But in very recent kernels, there is an option ''settable'' which prevents that nasty feature. It's called "alias promotion". You may set it via sysctl by adding ''net.ipv4.conf.all.promote_secondaries=1'' in /etc/sysctl.conf or via sysctl command line.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=On Debian Sarge (stable) only util-vserver is 0.30-204 available, which has been reported to be buggy (I didnt check the version for longer time) How do I compile a local version of alpha util-vserver .210 on Debian?||Details=<br />
A:<br />
<pre><br />
apt-get build-dep util-vserver<br />
<br />
./configure --prefix=/usr/local/ --enable-release \<br />
--mandir=/usr/local/share/man \<br />
--infodir=/usr/local/share/info \<br />
--sysconfdir=/etc --enable-dietlibc \<br />
--localstatedir=/var \<br />
--with-vrootdir=/var/lib/vservers<br />
<br />
make<br />
<br />
make install-distribution<br />
(Which does a make install + setting a symlink ln -s /usr/local/lib/util-vserver/vshelper /sbin/vshelper )<br />
<br />
</pre><br />
<br />
To test which version you are running:<br />
<pre><br />
# which vserver<br />
/usr/local/sbin/vserver<br />
<br />
</pre><br />
<br />
This should point to ..local...<br />
<br />
If you dont want to build it yourself: On www.backports.org there are backported (for sarge) linux-images (2.6.16) with vserver-patch enabled and a updated util-vserver package as well.<br />
|Signature=derjohn}}<br />
<br />
{{Question|Question=I use derjohn's kernel or a differnet kernel with a more-than-16-IPs-per-guest-patch and can't use more than 16 IPs. Why?||Details=<br />
A: You need to patch util-vserver, too. So you obviously need to recompile util-vserver (see above). In the util-vserver directory there are header files in the ./kernel/ directory. Patch like this:<br />
<br />
<pre><br />
kernel/network.h:#define NB_IPV4ROOT 64<br />
</pre><br />
<br />
BTW: The initial patches can be found here: http://vserver.13thfloor.at/Experimental/VARIOUS/util-vserver-0.30.196-net64.diff.bz2 and http://vserver.13thfloor.at/Experimental/VARIOUS/delta-2.6.9-vs1.9.3-net64.diff<br />
|Signature=unknown}}<br />
<br />
{{Question|Question=I run a Debian host and want to build an Ubuntu guest. Howto?||Details=<br />
A: Simple ;) Assume you want to build a breezy guest on a sid host with IP 192.168.0.2 and hostname vubuntu, then do:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu<br />
</pre><br />
<br />
[UPDATE] Currently there are problems in building breezy under unclear circumstances, which seems to have to do with udev. If the above didnt work, try:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu -- --exclude=udev<br />
</pre><br />
In very recent versions of the utils, the problem should not occur anymore (it has to do with the 'secure-mount' if you look in the MLs)<br />
<br />
Well, sid's debootstrap knows how to bootstrap Ubuntu linux. Make sure to have a current debootstrap package: <br />
<pre><br />
apt-get update<br />
apt-get install debootstrap<br />
</pre><br />
The knowledge how to build ubuntu 'breezy badger' (which you probably want to be your guest at the time of writing) has been added recently.|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I make a vserver guest start by default?||Details=<br />
A: At least on Debian, I can tell you how to do it with the new-style config. If your guest is called "derjohn" and you want it to be started somewhere at the of your bootstrap process, then do:<br />
<pre><br />
echo "default" > /etc/vservers/derjohn/apps/init/mark<br />
</pre><br />
If you want to start it earlier, please read the init script "/etc/init.d/vserver-default" to find out how to do it. In most cases you don't need to change this. On Debian the vservers are started at "90", so after most other stuff is up (networking etc.).<br />
<br />
Besides that I created a small helper script for managing the autostart foo: ((vserver-autostart))|Signature=derjohn}}<br />
<br />
{{Question|Question=My host works, but when I start a guest it says that it has a problem with chbind.||Details=<br />
A: You are probably using util-vserver <= 0.30.209, which does use dynamic network contexts internally (With 0.30.210 this fact changed). So if you compiled your kernel without dynamic contexts, you may start guests, but you can't use the network context.The solution is either to switch to .210 util (or Hollow's toolset) or compile the kernel with dynamic network contexts.<br />
SE Keyword: invalid option `nid' testme.sh|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=When I try to ssh to the guest, I log into the host, even if I installed sshd on the guest. What's wrong here?||Details=<br />
A: Look at /etc/ssh/sshd_config of the host:<br />
<br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
#ListenAddress ::<br />
</pre><br />
<br />
And now change the setting to <br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
ListenAddress your.hosts.ip.here # not the guests IP! <br />
</pre><br />
<br />
Then '/etc/init.d/ssh restart' on the host, after that on the guest (if you did apt-get install ssh on the guest already.)<br />
<br />
Do I have to explain more? If the hosts sshd binds all available IP addresses on port 22 (The hosts 'sees' even all addresses of the guests!). So if the guest starts its sshd, it cant bind to port 22 any more. You need to change that setting only on the host. <br />
(BTW: A similar approach has to be done for a lot of daemons, e.g. Apache. If the daemon does not support an explicit bind, you may use the chbind command to 'hide' IP addresses from the daemon before starting.)|Signature=derjohn}}<br />
<br />
{{Question|Question=I did everything right, but the application foo does not start. What's up there?||Details=<br />
A: Before asking on the IRC channel, please check out the 'problematic programs' page:<br />
[[Problematic Programs]]|Signature=derjohn}}<br />
<br />
{{Question|Question=Bind9 does not like to start in my guest.||Details=<br />
A: Check out the 'problematic programs' page:<br />
((ProblematicPrograms)) and/or get my [((ProblematicPrograms)) and/or get my [http://linux-vserver.derjohn.de/bind9-packages/bind9-capacheck_9.3.2-2_i386.deb vserver-guest-ready Debian package] for Debian Sid guests from that URL: http://linux-vserver.derjohn.de/bind9-packages/bind9-capacheck_9.3.2-2_i386.deb and check out the [http://linux-vserver.derjohn.de/bind9-packages/README.txt readme]. (Hint: This is fresh stuff. The give me Feedback)<br />
<br />
[UPDATE] Since VServer Devel 2.1.1-rc18 you do not need to patch the userland tools anymore. The capabilities are masked.|Signature=derjohn}}<br />
<br />
{{Question|Question=Which guest vservers are running?||Details=<br />
A: {{vserver-stat}}. Example output:<br />
<pre><br />
CTX PROC VSZ RSS userTIME sysTIME UPTIME NAME<br />
0 77 965.1M 334.6M 14m14s18 2m28s69 1h33m46 root server<br />
49152 7 14M 5.2M 0m00s40 0m00s30 1h30m15 chiffon<br />
</pre>|Signature=derjohn}}<br />
<br />
<br />
<br />
{{Question|Question=How can I reboot/halt guests?||Details=<br />
A: It depends. <br />
For vserver with legacy-interfaces support, you have to replace {{/sbin/halt}} in guests with vreboot and start rebootmgr in host. You also need to have a dummy <guest>.conf file in /etc/vservers for each guest. Please have a look at /etc/init.d/rebootmgr.<br />
Vserver with native interface utilizes /dev/initctl. No changes are needed in guests. Just make sure that REBOOT capability is adjusted in guests.|Signature=derjohn}}<br />
<br />
{{Question|Question=Do I really need the legacy-interfaces? What are these legacy-interfaces?||Details=<br />
A: Since vserver is an ongoing project, new features might replace old ones, some might still on development. Legacy-interfaces are available for backward compability (which might be removed someday). See Q: How can I reboot/halt guests?|Signature=derjohn}}<br />
<br />
{{Question|Question= I have a vserver running on a Linux kernel with preemption. Is VServer "preempt" safe?||Details=<br />
A: There are no known issues about running vserver on a preemption enabled kernel. I would like to add, that the vserver kernelhackers would probably exclude that option in 'make menuconfig' if there would be an incompatibility. Just my $.02 :)|Signature=derjohn}}<br />
<br />
{{Question|Question=Is this a new project? When was it started?||Details=<br />
A: The first public occurance of linux-vserver was Oct 2001. The initial mail can be found here: http://www.cs.helsinki.fi/linux/linux-kernel/2001-40/1065.html<br />
So you can expect a mature software product wich does it's magic quite well (And hey, we have a version > 2.0 ! )|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=Can I run an OpenVPN Server in a guest?||Details=<br />
A: Yes. I don't want to provide an in-depth OpenVPN tutorial, but want to show how I made OpenVPN work in a guest as server. I was not able to run it with a tun devive, due to a buglet in util-vserver and kernel when it comes to settings a an ip address a point to point link: If you add "ip addr add <ip> peer <mypeer> dev tun0" there is no way to map the tun0 interface into a guest, even not with a 'nodev' option. (bug confirmed to be reproducible by daniel_hoczac)<br />
<br />
First of all you have to prepare the host with a persistent tuntap interface in tap-mode. The tools we need come from the uml-utilities.<br />
Then you need to create a device /dev/net/tun, which the OpenVPN userspace daemon reads. Well assume 10.10.10.100 is the server IP, and 10.10.10.101 is the client ip - to be cool be choose a /31 netmask (255.255.255.254), so we have a net without broadcast and don't waste IPs :)<br />
<br />
On the host do: <br />
<pre><br />
# apt-get install uml-utilities<br />
# cd /var/lib/vserver/<myopenvpnserver>/dev/<br />
# ./MAKEDEV tun<br />
(creates the dev/net/tun device accessible by te guest - even a tap interface need /dev/net/tun !)<br />
# tunctl -t tap0<br />
(creates the network device 'tap0' persistently)<br />
</pre><br />
<br />
Then add the ip to the guest:<br />
<pre><br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/ip<br />
10.10.10.100<br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/prefix<br />
31<br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/dev<br />
tap0<br />
(This kind of config brings the ip when the vserver is started - only the tap0 interface has to exist already, see above!)<br />
</pre><br />
<br />
Here is a sample config for the guest (which is acting as a server):<br />
<br />
Install OpenVPN package on server and client, in the Debian case:<br />
<pre><br />
# apt-get install openvpn<br />
</pre><br />
<br />
The server's conf looks like that:<br />
<pre><br />
# port and interface specs<br />
<br />
# behave like a ssl-webserver<br />
port 443<br />
proto tcp-server<br />
<br />
# tap device? (keep in mind you need /dev/net/tun !)<br />
dev tap0<br />
<br />
# now the ips we will use for the tunnel<br />
ifconfig 10.10.10.100 255.255.255.254<br />
ifconfig-noexec<br />
<br />
# the server part<br />
<br />
# Keep VPN connections, even if the client IP changes<br />
float<br />
<br />
# use compression (may also even obfuscate content filters)<br />
comp-lzo<br />
<br />
# use a static key - create it with 'openvpn --genkey --secret static.key'<br />
secret static.key<br />
<br />
# dont reload the key after a SIGUSR1<br />
persist-key<br />
<br />
# check alive all 10 secs<br />
keepalive 10 60<br />
<br />
# verbosity level (from 1 to 9, 9 is max log level)<br />
verb 4<br />
status openvpn-status.log<br />
</pre><br />
<br />
The client's conf may look like that (This example even makes the tunnel the clients default address):<br />
<pre><br />
# cat /etc/openvpn/client.conf<br />
# port and interface specs<br />
<br />
# the following is not necessary, if you bring up openvpn via Debian's init script:<br />
daemon ovpn-my-clients-name<br />
<br />
# behave like a ssl-webserver<br />
port 443<br />
proto tcp-client<br />
remote %%%<insert-the-guest-primary-public-ip-here>%%%%<br />
# what device tun ot tap?<br />
dev tap<br />
<br />
# now the ips we will use for the tunnel<br />
ifconfig 10.10.10.101 255.255.255.254<br />
<br />
# Keep VPN connections, even if the client IP changes<br />
float<br />
mssfix<br />
<br />
# use compression (may also even obfuscate content filters)<br />
comp-lzo<br />
<br />
# use a static key<br />
secret static.key<br />
<br />
# dont reload the key after a SIGUSR1<br />
persist-key<br />
<br />
# check alive all 10 secs<br />
keepalive 10 60<br />
<br />
# verbosity level (from 1 to 9, 9 is max log level)<br />
verb 4<br />
<br />
# set the default route<br />
route-gateway 10.10.10.100<br />
redirect-gateway def1<br />
# to add special routes you can do it wihtin the openvpn client conf:<br />
# route <dest> <mask> <gateway><br />
<br />
# if you need to connect via proxy (like squid)<br />
# http-proxy s p [up] [auth] : Connect to remote host through an HTTP proxy at<br />
# address s and port p. If proxy authentication is required,<br />
# up is a file containing username/password on 2 lines, or<br />
# 'stdin' to prompt from console. Add auth='ntlm' if<br />
# the proxy requires NTLM authentication.<br />
<br />
# http-proxy s p [up] [auth]<br />
<br />
<br />
# http-proxy-option type [parm] : Set extended HTTP proxy options.<br />
# Repeat to set multiple options.<br />
# VERSION version (default=1.0)<br />
# AGENT user-agent<br />
<br />
# http-proxy-option type [parm]<br />
</pre><br />
<br />
In the next lesson I will talk about OpenVPN's server mode, which can deal with with multiple clients connecting to one ip and one port (i.e. you only need one guest for tons or 'roadwarriros'), tls connections and pki.<br />
<br />
Contributions welcome. :)|Signature=derjohn}}<br />
<br />
{{Question|Question=32 vs 64 Bit? What should I take?||Details=<br />
A: If you have the choice make the host a 64 bit one. You can run a guest as 32 bit or as 64 bit on a 64 bit host. To run it as 32 bit, you need to compile the x86_64 (a.k.a. AMD64) with the following options:<br />
<br />
<pre><br />
[*] Kernel support for ELF binaries<br />
<M> Kernel support for MISC binaries<br />
[*] IA32 Emulation <---- without that, the entire 32bit API is not present<br />
<M> IA32 a.out support <br />
</pre><br />
<br />
You can force the guest to behave like a 32 environment like this:<br />
<pre><br />
echo linux_32bit > /etc/vservers/$NAME/personality<br />
echo i686 > /etc/vservers/$NAME/uts/machine<br />
</pre><br />
(thanks cehteh for the hint!)<br />
<br />
But you can force debootstrap to but 32 bit binaries into the guest by 'export ARCH=i386';<br />
<pre><br />
export ARCH=i386 ; vserver build .... <br />
</pre>|Signature=derjohn}}<br />
<br />
{{Question|Question=I want to (re)mount a partition in a running guest ... but the guest has no rights (capability) to (re)mount?||Details=<br />
A: I'll explain. I take as example your /tmp partition within the guest is too small, what will be likely the case if you stay with the 16MB default (vserver build mounts /tmp as 16 MB tempfs!).<br />
<pre><br />
# vnamespace -e XID mount -t tmpfs -o remount,size=256m,mode=1777 none /var/lib/vservers/<guest>/tmp/<br />
</pre><br />
Be warned that the guest will not recognize the change, as the /etc/mtab file is not updated when you mount like this. To permanently change the mount, edit /etc/vserver/<guest>/fstab on the host.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=How do I limit a guests RAM? I want to prevent OOM situations on the host!||Details=<br />
A: First you can read [http://linux-vserver.org/Memory+Allocation].<br />
If you want a recipe, do that:<br />
1. Check the size of memory pages. On x86 and x86_64 is usually 4 KB per page.<br />
2. Create /etc/vserver/<guest>/rlimits/<br />
3. Check your physical memory size on the host, e.g. with "free -m". maxram = kilobytes/pagesize.<br />
4. Limit the guests physical RAM to value smaller then maxram:<br />
<br />
<pre><br />
echo %%insertYourPagesHereSmallerThanMaxram%% > /etc/vserver/<guest>/rlimits/rss<br />
</pre><br />
<br />
5. Check your swapspace, e.g. with 'swapon -s'. maxswap = swapkilobytes/pagesize.<br />
6. Limit the guest's maximum number of as pages to a value smaller than (maxram+maxswap):<br />
<br />
<pre><br />
echo %%desiredvalue%% > /etc/vserver/<guest>/rlimits/as<br />
</pre><br />
<br />
It should be clear this can still lead to OOM situations. Example: You have two guests and your as limit per guest is greater than 50% of (maxram+maxswap). If both guests request their maximum at the same point in time, there will be not enough mem .....|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=Were can I get newer versions of VServer as ready made packages for Debian?||Details=<br />
A: Here you go: http://linux-vserver.derjohn.de/ . There is also some stuff on backports.org, but my kernels are always 'devel' branch.|Signature=derjohn}}<br />
<br />
{{Question|Question=Can I use iptables ?||Details=<br />
Yes but right now only on the host (rootserver). Please realize that all traffic is local and will not touch the forward chain.|Signature=BeginnerFAQ}}<br />
<br />
{{Question|Question=Trying to connect to a vserver from the host or another vserver on the same host fails||Details=<br />
strace shows<br />
<pre> <br />
sin_addr=inet_addr("xx.xx.xx.xx")}, yy) = -1 EINVAL (Invalid argument)<br />
</pre><br />
A: The host/guest cannot communicate with another guest on same host.<br />
* check all netmasks on all interfaces (do they overlap) ?<br />
* check policy routing (disable it temporary) ?<br />
* check that lo is up (Networking within a host/guest always uses lo interface)<br />
|Signature=CommonProblems}}<br />
<br />
{{Question|Question=#1 ERROR: capset(): Operation not permitted||Details=capabilities are not enabled in kernel-setup<br />
please check that CONFIG_SECURITY_CAPABILITIES is loaded or included in the kernel. ( check with "cat /path_to_kernel/.config | grep -i cap ")<br />
(2.6.11.5-vs-1.9.5 + 0.30-205)|Signature=IrcQuestions}}<br />
<br />
{{Question|Question=How can I make 'vserver start' mount the root filesystem||Details=<br />
mount it via /etc/vservers/vserver-name/fstab, make sure to set the option 'dev' e.g.:<br />
<pre>/dev/drbd0 / xfs rw,dev 0 0</pre><br />
util-vserver 210 won't be able to find some scripts for the reboot, add into /etc/vservers/vserver-name/apps/init/cmd.stop<br />
<pre>/etc/init.d/rc<br />
6</pre><br />
|Signature=AdrianReyer}}<br />
<br />
{{Question|Question=How do I tag a guest's directory with xid?||Details=<br />
Tagging the guest's files gives you serveral advantages, e.g. the accoutung will work properly.<br />
Filesystem XID tagging only works on supported filesystem. Those are currently: ext2/3, reiserfs/reiser3, xfs and jfs.<br />
To activate the XID tagging you have to mount the filesystem with "-o tagxid". Attention: It's _not_ possible to "-o remount,tagxid", you have to mount it freshly. The guests will tag their files automatiaclly. If you copy files in from the host, you have to tag them manually like this:<br />
<pre>chxid -c xid -R /var/lib/vservers/<guest></pre><br />
Note: Context 0 and 1 will see all files, guests will only be able to acess untagged files and their own XID. They can see other XID files but no information about the file, e.g. no owner, no group, no permissions.<br />
|Signature=derjohn_and_gonzo_and_are}}<br />
<br />
More FAQs to be merged;<br />
[http://www.linux-vserver.org/Frequently_Asked_Questions_scratch]<br />
<br />
{{Question|Question=My mysqld running in a guest behaves strangely and is awfully slow/locks up||Details=<br />
This can be related to /tmp being too small. mysqld stores temporary tables in /tmp and as such, if a lot of queries happen and /tmp runs full this can cause one query to lock up whilst creating the tmp table and all other queries waiting to acquire the lock. There are two possible solutions to that problem: a.) Modify /etc/vservers/vserver-name/fstab and assign more memory to the tmpfs of /tmp and b.) remove the /tmp entry from /etc/vservers/vserver-name/fstab completly. Especially on database servers with a rather high load the second one might be the preferred method.|Signature=sp}}</div>AdrianReyerhttp://www.linux-vserver.org/Frequently_Asked_QuestionsFrequently Asked Questions2006-09-18T15:58:34Z<p>AdrianReyer: </p>
<hr />
<div><div style="margin: 2em auto 2em auto; padding: 10px; background-color: #F9ECCD; border: 1px solid #004433; text-align: center;"><br />
[[Image:Icon-Caution.png|left]]<br />
We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the [[Wiki Team]] page for instructions how to help or look at the [http://oldwiki.linux-vserver.org old wiki] to find the information not migrated yet.<br />
<br />
'''To ease migration we created a [[List of old Documentation pages]].'''<br />
</div><br />
<br />
CURRENTLY THE CONTENT OF THE OLD WIKI FAQ (AND MORE) IS BEING MIGRATED TO THIS PAGE (TASK: DERJOHN)<br />
<br />
<br />
__TOC__<br />
<br />
{{Question|Question=What is a 'Guest'?||Details=To talk about stuff, we need some naming. The physical machine is called 'Host' and the 'main' context running the Host Distro is called 'Host Context'. The virtual machine/distro is called 'Guest' and basically is a Distribution (Userspace) running inside a 'Guest Context'.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=What kind of Operating System (OS) can I run as guest?||Details=<br />
A: With VServer you can only run Linux guests. The trick is that a guest does not run a kernel on its own (as XEN and UML do), it merely uses a virtualized host kernel-interface. VServer offers so called security contexts which make it possible to seperate one guest from each other, i.e. they cannot get data from each other. Imagine it as a chroot environment with much more security and features.|Signature=derjohn}}<br />
<br />
{{Question|Question=Which distributions did you test?||Details=<br />
A: Some. Check out the wiki for ready-made guest images. But you can easily build own guest images, e.g. with Debian's debootstrap. Checkout ((step-by-step Guide 2.6)) how to do that.|Signature=derjohn}}<br />
<br />
{{Question|Question=Is VServer comparable to XEN/UML/QEMU?||Details=<br />
A: Nope. XEN/UML/QEMU and VServer are just good friends. Because you ask, you probably know what XEN/UML/QEMU are. VServer in contrary to XEN/UML/QEMU not "emulate" any hardware you run a kernel on. You can run a VServer kernel in a XEN/UML/QEMU guest. This is confirmed to work at least with Linux 2.6/vs2.0.|Signature=derjohn}}<br />
<br />
{{Question|Question=Is VServer secure?||Details=<br />
A: We hope so. It should be as least as secure as Linux is. We consider it much much more secure though.|Signature=derjohn}}<br />
<br />
{{Question|Question=Performance?||Details=<br />
A: For a single guest, we basically have native performance. Some tests showed insignificant overhead (about 1-2%) others ran faster than on an unpatched kernel. This is IMVHO significantly less than other solutions waste, especially if you have more than a single guest (because of the resource sharing).|Signature=derjohn}}<br />
<br />
{{Question|Question=Is SMP Supported?||Details=<br />
A: Yes, on all SMP capable kernel architectures.|Signature=derjohn}}<br />
<br />
{{Question|Question=Resource sharing?||Details=<br />
A: Yes ....<br />
* memory: Dynamically.<br />
* CPU usage: Dynamically (token bucket)|Signature=derjohn}}<br />
<br />
{{Question|Question=Resource limiting?||Details=<br />
A: Yes, you can set maximum limits per guest, but you can only offer guaranteed resource availability with some ticks at the time. There is the possibility to ulimit and to rlimit. Rlimit is a new feature of kernel 2.6/vs2.0.|Signature=derjohn}}<br />
<br />
{{Question|Question=Disk I/O limiting? Is that possible?||Details=<br />
A: Well, since vs2.1.1 linux-vserver supports a mechanism called 'I/O scheduling', which appeared in the 2.6 mainline some time ago. The mainline kernel offers several I/O schedulers:<br />
<br />
<pre><br />
# cat /sys/block/hdc/queue/scheduler<br />
noop [anticipatory] deadline cfq<br />
</pre><br />
<br />
The default is anticipatory a.k.a. "AS". When running several guests on a host you probably want the I/O performance shared in a fair way among the different guests. The kernel comes with a "completely fair queueing" scheduler, CFQ, which can do that. (More on schedulers can be found at http://lwn.net/Articles/114770/)<br />
<br />
This is how to set the scheduler to "cfq" manually:<br />
<pre><br />
root# echo "cfq" > /sys/block/hdc/queue/scheduler<br />
root# cat /sys/block/hdc/queue/scheduler<br />
noop anticipatory deadline [cfq]<br />
</pre><br />
<br />
Keep in mind that you have to do it on all physical discs. So if you run an md-softraid, do it to all physical /dev/hdXYZ discs!<br />
<br />
If you run Debian there is a predefined way to set the /sys values at boot-time:<br />
<br />
<pre><br />
# apt-get install sysfsutils<br />
[...]<br />
<br />
# cat /etc/sysfs.conf | grep cfq<br />
block/sda/queue/scheduler = cfq<br />
block/sdc/queue/scheduler = cfq<br />
<br />
# /etc/init.d/sysfsutils restart<br />
</pre><br />
<br />
For non-vserver processes and CFQ you can set by which key the kernel decides about the fairness:<br />
<br />
<pre><br />
cat /sys/block/hdc/queue/iosched/key_type<br />
pgid [tgid] uid gid<br />
</pre><br />
Hint: The 'key_type'-feature has been removed in the mainline kernel recently. Don't look for it any longer :(<br />
<br />
The default is tgid, which means to share fairly among process groups. Think every guest is treated like a own process group. It's not possible to set a scheduler strategy within a guest. All processes belonging to the same guest are treated like "noop" within the guest. So: If you run apache and some ftp-server within the _same_ guest, there is no fair scheduling between them, but there is fair scheduling between the whole guest and all other guests.<br />
<br />
And: It's possible to tune the scheduler parameters in several ways. Have a look at /sys/block/hdc/queue/....<br />
<br />
You need a very recent Version of VS devel, e.g. the 2.1.1-rc18 can do it. Some older version have that feature too, then it got lost and was reinvented. So: Go and get a rc18 - only in 'devel', not stable!|Signature=derjohn}}<br />
<br />
{{Question|Question=Why isn't there a device /dev/bla? within a guest||Details=<br />
A: Device nodes allow Userspace to access hardware (or virtual resources). Creating a device node inside the guest's namespace will give access to that device, so for security reasons, the number of 'given' devices is small.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is Unification (vunify)?||Details=<br />
A: Unification is Hard Links on Steroids. Guests can 'share' common files (usually binaries and libraries) in a secure way, by creating hard links with special properties (immutable but unlinkable (removable)). The tool to identify common files and to unify them is called vunify.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is vhashify?||Details=<br />
A: The successor of vunify, a tool which does unification based on hash values (which allows to find common files in arbitrary paths.)|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I manage a multi-guest setup with vhashify?||Details=<br />
A: For 'vhashify', just do these once:<br />
<br />
<pre><br />
mkdir /etc/vservers/.defaults/apps/vunify/hash /vservers/.hash<br />
ln -0s /vservers/.hash /etc/vservers/.defaults/apps/vunify/hash/root<br />
</pre><br />
<br />
Then, do this one line per vserver:<br />
<br />
<pre><br />
mkdir /etc/vservers/<vservername>/apps/vunify # vhashify reuses vunify configuration<br />
</pre><br />
<br />
<br />
The command 'ln' creates a link between two files. "ln -s" creates a symbolic link -- two files are linked by name. "ln -0s" uses a Vserver extention to create a unified link.|Signature=derjohn}}<br />
<br />
{{Question|Question=With which VS version should I begin?||Details=<br />
A: If you are new to VServer I recommend to try 2.0.+. Take "alpha utils" Version 0.30.210. In Debian Sid there appeared well running version of it recently. (It's a .210 at the time of writing).|Signature=derjohn}}<br />
<br />
{{Question|Question=is there a way to implement "user/group quota" per VServer?||Details=<br />
A: Yes, but not on a shared partition for now. You need to put the guest on a separate partition, setup a vroot device (to make the quota access secure), copy that into the guest, and adjust the mtab line inside the guest.|Signature=derjohn}}<br />
<br />
{{Question|Question=what about "Quota" for a context?||Details=<br />
A: Context quotas are now called Disk Limits (so that we can tell them apart from the user/group quotas :). They are supported out of the box (with vs2.0) for all major filesystems (Ext2/3, ReiserFS, XFS, JFS)|Signature=derjohn}}<br />
<br />
{{Question|Question=Does it support IPv6?||Details=<br />
A: Currently not. Some developer has to move his ... to reimplement this functionality from the V4 code (I read that on the ML ;)). Will probably be superseded by the ngnet (next generation networking) soon. There is a Wiki page regarding this: http://linux-vserver.org/IPv6|Signature=derjohn}}<br />
<br />
{{Question|Question=I can't do all I want with the network interfaces inside the guest?||Details=<br />
A: For now the networking is 'Host Business' -- the host is a router, and each guest is a server. You can set the capability ICMP_RAW in the context of the guest, or even the capability CAP_NET_RAW (which would even allow to sniff interfaces of other guests!). Likely to change with ngnet. |Signature=derjohn}}<br />
<br />
{{Question|Question=Is there a web-based interface for vserver that will allow creation/deletion/configuration etc. of vserver guests?||Details=<br />
A. [Update] Errrh, there is http://OpenVPS.org which is a set of scripts with a web-interface for webhosters/ISPs. <br />
A. [Update] Errrh, there is http://Openvcp.org which is a distributed system (agent!) with a web-interface, with which you can build/remove guests! cool stuff! beta, try out!|Signature=derjohn}}<br />
<br />
{{Question|Question=What is old-style and new-style config?||Details=<br />
A. Old-style config refers to a single text-file that contains all the configuration settings. With new-style config the configuration is split into several directories and files. You should probably go for new-style config if you are asking.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is the "great flower page"?||Details=<br />
A. Well, this page contains all configation options for vserver in version > 1.9 (I think .. I joined Linux-VServer in version 2, so I don't know for sure). The name of the page is derivived from the stylesheet(s) it contains: It displays background pictures of a very great flower, so regard it as highly optimized. It was designed by a non-designer, who asks us to create a better one. I played with the thought of creating a complete new theme for that page - but actually we all got used to the name "great flower page", so we stick to it. If you are unable to read it clearly, feel invited to join the IRC channel #vserver, we may tell you how to ;)|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I add several IPs to a vserver? ||Details=<br />
A: First of all a single guest vserver only supports up to 16 IPs (There is a 64-IP patch available, which is in "derjohn's kernel", you need extra util-vserver anyway).<br />
Here is a little helper-script that adds a list of IPs defined in a text file, one per line.<br />
<pre><br />
#!/bin/bash<br />
j=1<br />
for i in `cat myiplist`; do<br />
j=$(($j+1))<br />
mkdir $j<br />
echo $i > $j/ip<br />
echo $i > $j/ip-old<br />
echo "24" > $j/prefix<br />
done<br />
</pre>|Signature=derjohn}}<br />
<br />
{{Question|Question=If my host has only one a single public IP, can I use RFC1918 IP (e.g. 192.168.foo.bar) for the guest vservers?||Details=<br />
A: Yes, use iptables with SNAT to masquerade it. <br />
<pre><br />
iptables -t nat -I POSTROUTING -s $VSERVER_NETZ ! -d $VSERVER_NETZ -j SNAT --to $EXT_IP<br />
</pre><br />
See: HowtoPrivateNetworking and <br />
http://www.tgunkel.de/it/software/doc/linux_server#h3-Vserver_Masquerading_SNAT (THX, [MUPPETS]Gonzo)|Signature=derjohn}}<br />
<br />
{{Question|Question=If I shut down my vserver guest, the whole Internet interface ethX on the host is shut down. What happened? ||Details=<br />
A: When you shut down a guest (i.e. {{vserver foo stop}}), the IP is brought down on the host also. If this IP happens to be the primary IP of the host, the kernel will not only bring down the primary IP, but also all secondary IP addresses. But in very recent kernels, there is an option {{settable}} which prevents that nasty feature. It's called "alias promotion". You may set it via sysctl by adding {{net.ipv4.conf.all.promote_secondaries=1}} in /etc/sysctl.conf or via sysctl command line.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=On Debian Sarge (stable) only util-vserver is 0.30-204 available, which has been reported to be buggy (I didnt check the version for longer time) How do I compile a local version of alpha util-vserver .210 on Debian?||Details=<br />
A:<br />
<pre><br />
apt-get build-dep util-vserver<br />
<br />
./configure --prefix=/usr/local/ --enable-release \<br />
--mandir=/usr/local/share/man \<br />
--infodir=/usr/local/share/info \<br />
--sysconfdir=/etc --enable-dietlibc \<br />
--localstatedir=/var \<br />
--with-vrootdir=/var/lib/vservers<br />
<br />
make<br />
<br />
make install-distribution<br />
(Which does a make install + setting a symlink ln -s /usr/local/lib/util-vserver/vshelper /sbin/vshelper )<br />
<br />
</pre><br />
<br />
To test which version you are running:<br />
<pre><br />
# which vserver<br />
/usr/local/sbin/vserver<br />
<br />
</pre><br />
<br />
This should point to ..local...<br />
<br />
If you dont want to build it yourself: On www.backports.org there are backported (for sarge) linux-images (2.6.16) with vserver-patch enabled and a updated util-vserver package as well.<br />
|Signature=derjohn}}<br />
<br />
{{Question|Question=I use derjohn's kernel or a differnet kernel with a more-than-16-IPs-per-guest-patch and can't use more than 16 IPs. Why?||Details=<br />
A: You need to patch util-vserver, too. So you obviously need to recompile util-vserver (see above). In the util-vserver directory there are header files in the ./kernel/ directory. Patch like this:<br />
<br />
<pre><br />
kernel/network.h:#define NB_IPV4ROOT 64<br />
</pre><br />
<br />
BTW: The initial patches can be found here: http://vserver.13thfloor.at/Experimental/VARIOUS/util-vserver-0.30.196-net64.diff.bz2 and http://vserver.13thfloor.at/Experimental/VARIOUS/delta-2.6.9-vs1.9.3-net64.diff<br />
|Signature=unknown}}<br />
<br />
{{Question|Question=I run a Debian host and want to build an Ubuntu guest. Howto?||Details=<br />
A: Simple ;) Assume you want to build a breezy guest on a sid host with IP 192.168.0.2 and hostname vubuntu, then do:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu<br />
</pre><br />
<br />
[UPDATE] Currently there are problems in building breezy under unclear circumstances, which seems to have to do with udev. If the above didnt work, try:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu -- --exclude=udev<br />
</pre><br />
In very recent versions of the utils, the problem should not occur anymore (it has to do with the 'secure-mount' if you look in the MLs)<br />
<br />
Well, sid's debootstrap knows how to bootstrap Ubuntu linux. Make sure to have a current debootstrap package: <br />
<pre><br />
apt-get update<br />
apt-get install debootstrap<br />
</pre><br />
The knowledge how to build ubuntu 'breezy badger' (which you probably want to be your guest at the time of writing) has been added recently.|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I make a vserver guest start by default?||Details=<br />
A: At least on Debian, I can tell you how to do it with the new-style config. If your guest is called "derjohn" and you want it to be started somewhere at the of your bootstrap process, then do:<br />
<pre><br />
echo "default" > /etc/vservers/derjohn/apps/init/mark<br />
</pre><br />
If you want to start it earlier, please read the init script "/etc/init.d/vserver-default" to find out how to do it. In most cases you don't need to change this. On Debian the vservers are started at "90", so after most other stuff is up (networking etc.).<br />
<br />
Besides that I created a small helper script for managing the autostart foo: ((vserver-autostart))|Signature=derjohn}}<br />
<br />
{{Question|Question=My host works, but when I start a guest it says that it has a problem with chbind.||Details=<br />
A: You are probably using util-vserver <= 0.30.209, which does use dynamic network contexts internally (With 0.30.210 this fact changed). So if you compiled your kernel without dynamic contexts, you may start guests, but you can't use the network context.The solution is either to switch to .210 util (or Hollow's toolset) or compile the kernel with dynamic network contexts.<br />
SE Keyword: invalid option `nid' testme.sh|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=When I try to ssh to the guest, I log into the host, even if I installed sshd on the guest. What's wrong here?||Details=<br />
A: Look at /etc/ssh/sshd_config of the host:<br />
<br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
#ListenAddress ::<br />
</pre><br />
<br />
And now change the setting to <br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
ListenAddress your.hosts.ip.here # not the guests IP! <br />
</pre><br />
<br />
Then '/etc/init.d/ssh restart' on the host, after that on the guest (if you did apt-get install ssh on the guest already.)<br />
<br />
Do I have to explain more? If the hosts sshd binds all available IP addresses on port 22 (The hosts 'sees' even all addresses of the guests!). So if the guest starts its sshd, it cant bind to port 22 any more. You need to change that setting only on the host. <br />
(BTW: A similar approach has to be done for a lot of daemons, e.g. Apache. If the daemon does not support an explicit bind, you may use the chbind command to 'hide' IP addresses from the daemon before starting.)|Signature=derjohn}}<br />
<br />
{{Question|Question=I did everything right, but the application foo does not start. What's up there?||Details=<br />
A: Before asking on the IRC channel, please check out the 'problematic programs' page:<br />
{{ProblematicPrograms}}|Signature=derjohn}}<br />
<br />
{{Question|Question=Bind9 does not like to start in my guest.||Details=<br />
A: Check out the 'problematic programs' page:<br />
((ProblematicPrograms)) and/or get my [((ProblematicPrograms)) and/or get my [http://linux-vserver.derjohn.de/bind9-packages/bind9-capacheck_9.3.2-2_i386.deb vserver-guest-ready Debian package] for Debian Sid guests from that URL: http://linux-vserver.derjohn.de/bind9-packages/bind9-capacheck_9.3.2-2_i386.deb and check out the [http://linux-vserver.derjohn.de/bind9-packages/README.txt readme]. (Hint: This is fresh stuff. The give me Feedback)<br />
<br />
[UPDATE] Since VServer Devel 2.1.1-rc18 you do not need to patch the userland tools anymore. The capabilities are masked.|Signature=derjohn}}<br />
<br />
{{Question|Question=Which guest vservers are running?||Details=<br />
A: {{vserver-stat}}. Example output:<br />
<pre><br />
CTX PROC VSZ RSS userTIME sysTIME UPTIME NAME<br />
0 77 965.1M 334.6M 14m14s18 2m28s69 1h33m46 root server<br />
49152 7 14M 5.2M 0m00s40 0m00s30 1h30m15 chiffon<br />
</pre>|Signature=derjohn}}<br />
<br />
<br />
<br />
{{Question|Question=How can I reboot/halt guests?||Details=<br />
A: It depends. <br />
For vserver with legacy-interfaces support, you have to replace {{/sbin/halt}} in guests with vreboot and start rebootmgr in host. You also need to have a dummy <guest>.conf file in /etc/vservers for each guest. Please have a look at /etc/init.d/rebootmgr.<br />
Vserver with native interface utilizes /dev/initctl. No changes are needed in guests. Just make sure that REBOOT capability is adjusted in guests.|Signature=derjohn}}<br />
<br />
{{Question|Question=Do I really need the legacy-interfaces? What are these legacy-interfaces?||Details=<br />
A: Since vserver is an ongoing project, new features might replace old ones, some might still on development. Legacy-interfaces are available for backward compability (which might be removed someday). See Q: How can I reboot/halt guests?|Signature=derjohn}}<br />
<br />
{{Question|Question= I have a vserver running on a Linux kernel with preemption. Is VServer "preempt" safe?||Details=<br />
A: There are no known issues about running vserver on a preemption enabled kernel. I would like to add, that the vserver kernelhackers would probably exclude that option in 'make menuconfig' if there would be an incompatibility. Just my $.02 :)|Signature=derjohn}}<br />
<br />
{{Question|Question=Is this a new project? When was it started?||Details=<br />
A: The first public occurance of linux-vserver was Oct 2001. The initial mail can be found here: http://www.cs.helsinki.fi/linux/linux-kernel/2001-40/1065.html<br />
So you can expect a mature software product wich does it's magic quite well (And hey, we have a version > 2.0 ! )|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=Can I run an OpenVPN Server in a guest?||Details=<br />
A: Yes. I don't want to provide an in-depth OpenVPN tutorial, but want to show how I made OpenVPN work in a guest as server. I was not able to run it with a tun devive, due to a buglet in util-vserver and kernel when it comes to settings a an ip address a point to point link: If you add "ip addr add <ip> peer <mypeer> dev tun0" there is no way to map the tun0 interface into a guest, even not with a 'nodev' option. (bug confirmed to be reproducible by daniel_hoczac)<br />
<br />
First of all you have to prepare the host with a persistent tuntap interface in tap-mode. The tools we need come from the uml-utilities.<br />
Then you need to create a device /dev/net/tun, which the OpenVPN userspace daemon reads. Well assume 10.10.10.100 is the server IP, and 10.10.10.101 is the client ip - to be cool be choose a /31 netmask (255.255.255.254), so we have a net without broadcast and don't waste IPs :)<br />
<br />
On the host do: <br />
<pre><br />
# apt-get install uml-utilities<br />
# cd /var/lib/vserver/<myopenvpnserver>/dev/<br />
# ./MAKEDEV tun<br />
(creates the dev/net/tun device accessible by te guest - even a tap interface need /dev/net/tun !)<br />
# tunctl -t tap0<br />
(creates the network device 'tap0' persistently)<br />
</pre><br />
<br />
Then add the ip to the guest:<br />
<pre><br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/ip<br />
10.10.10.100<br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/prefix<br />
31<br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/dev<br />
tap0<br />
(This kind of config brings the ip when the vserver is started - only the tap0 interface has to exist already, see above!)<br />
</pre><br />
<br />
Here is a sample config for the guest (which is acting as a server):<br />
<br />
Install OpenVPN package on server and client, in the Debian case:<br />
<pre><br />
# apt-get install openvpn<br />
</pre><br />
<br />
The server's conf looks like that:<br />
<pre><br />
# port and interface specs<br />
<br />
# behave like a ssl-webserver<br />
port 443<br />
proto tcp-server<br />
<br />
# tap device? (keep in mind you need /dev/net/tun !)<br />
dev tap0<br />
<br />
# now the ips we will use for the tunnel<br />
ifconfig 10.10.10.100 255.255.255.254<br />
ifconfig-noexec<br />
<br />
# the server part<br />
<br />
# Keep VPN connections, even if the client IP changes<br />
float<br />
<br />
# use compression (may also even obfuscate content filters)<br />
comp-lzo<br />
<br />
# use a static key - create it with 'openvpn --genkey --secret static.key'<br />
secret static.key<br />
<br />
# dont reload the key after a SIGUSR1<br />
persist-key<br />
<br />
# check alive all 10 secs<br />
keepalive 10 60<br />
<br />
# verbosity level (from 1 to 9, 9 is max log level)<br />
verb 4<br />
status openvpn-status.log<br />
</pre><br />
<br />
The client's conf may look like that (This example even makes the tunnel the clients default address):<br />
<pre><br />
# cat /etc/openvpn/client.conf<br />
# port and interface specs<br />
<br />
# the following is not necessary, if you bring up openvpn via Debian's init script:<br />
daemon ovpn-my-clients-name<br />
<br />
# behave like a ssl-webserver<br />
port 443<br />
proto tcp-client<br />
remote %%%<insert-the-guest-primary-public-ip-here>%%%%<br />
# what device tun ot tap?<br />
dev tap<br />
<br />
# now the ips we will use for the tunnel<br />
ifconfig 10.10.10.101 255.255.255.254<br />
<br />
# Keep VPN connections, even if the client IP changes<br />
float<br />
mssfix<br />
<br />
# use compression (may also even obfuscate content filters)<br />
comp-lzo<br />
<br />
# use a static key<br />
secret static.key<br />
<br />
# dont reload the key after a SIGUSR1<br />
persist-key<br />
<br />
# check alive all 10 secs<br />
keepalive 10 60<br />
<br />
# verbosity level (from 1 to 9, 9 is max log level)<br />
verb 4<br />
<br />
# set the default route<br />
route-gateway 10.10.10.100<br />
redirect-gateway def1<br />
# to add special routes you can do it wihtin the openvpn client conf:<br />
# route <dest> <mask> <gateway><br />
<br />
# if you need to connect via proxy (like squid)<br />
# http-proxy s p [up] [auth] : Connect to remote host through an HTTP proxy at<br />
# address s and port p. If proxy authentication is required,<br />
# up is a file containing username/password on 2 lines, or<br />
# 'stdin' to prompt from console. Add auth='ntlm' if<br />
# the proxy requires NTLM authentication.<br />
<br />
# http-proxy s p [up] [auth]<br />
<br />
<br />
# http-proxy-option type [parm] : Set extended HTTP proxy options.<br />
# Repeat to set multiple options.<br />
# VERSION version (default=1.0)<br />
# AGENT user-agent<br />
<br />
# http-proxy-option type [parm]<br />
</pre><br />
<br />
In the next lesson I will talk about OpenVPN's server mode, which can deal with with multiple clients connecting to one ip and one port (i.e. you only need one guest for tons or 'roadwarriros'), tls connections and pki.<br />
<br />
Contributions welcome. :)|Signature=derjohn}}<br />
<br />
{{Question|Question=32 vs 64 Bit? What should I take?||Details=<br />
A: If you have the choice make the host a 64 bit one. You can run a guest as 32 bit or as 64 bit on a 64 bit host. To run it as 32 bit, you need to compile the x86_64 (a.k.a. AMD64) with the following options:<br />
<br />
<pre><br />
[*] Kernel support for ELF binaries<br />
<M> Kernel support for MISC binaries<br />
[*] IA32 Emulation <---- without that, the entire 32bit API is not present<br />
<M> IA32 a.out support <br />
</pre><br />
<br />
You can force the guest to behave like a 32 environment like this:<br />
<pre><br />
echo linux_32bit > /etc/vservers/$NAME/personality<br />
echo i686 > /etc/vservers/$NAME/uts/machine<br />
</pre><br />
(thanks cehteh for the hint!)<br />
<br />
But you can force debootstrap to but 32 bit binaries into the guest by 'export ARCH=i386';<br />
<pre><br />
export ARCH=i386 ; vserver build .... <br />
</pre>|Signature=derjohn}}<br />
<br />
{{Question|Question=I want to (re)mount a partition in a running guest ... but the guest has no rights (capability) to (re)mount?||Details=<br />
A: I'll explain. I take as example your /tmp partition within the guest is too small, what will be likely the case if you stay with the 16MB default (vserver build mounts /tmp as 16 MB tempfs!).<br />
<pre><br />
# vnamespace -e XID mount -t tmpfs -o remount,size=256m,mode=1777 none /var/lib/vservers/<guest>/tmp/<br />
</pre><br />
Be warned that the guest will not recognize the change, as the /etc/mtab file is not updated when you mount like this. To permanently change the mount, edit /etc/vserver/<guest>/fstab on the host.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=How do I limit a guests RAM? I want to prevent OOM situations on the host!||Details=<br />
A: First you can read [http://linux-vserver.org/Memory+Allocation].<br />
If you want a recipe, do that:<br />
1. Check the size of memory pages. On x86 and x86_64 is usually 4 KB per page.<br />
2. Create /etc/vserver/<guest>/rlimits/<br />
3. Check your physical memory size on the host, e.g. with "free -m". maxram = kilobytes/pagesize.<br />
4. Limit the guests physical RAM to value smaller then maxram:<br />
<br />
<pre><br />
echo %%insertYourPagesHereSmallerThanMaxram%% > /etc/vserver/<guest>/rlimits/rss<br />
</pre><br />
<br />
5. Check your swapspace, e.g. with 'swapon -s'. maxswap = swapkilobytes/pagesize.<br />
6. Limit the guest's maximum number of as pages to a value smaller than (maxram+maxswap):<br />
<br />
<pre><br />
echo %%desiredvalue%% > /etc/vserver/<guest>/rlimits/as<br />
</pre><br />
<br />
It should be clear this can still lead to OOM situations. Example: You have two guests and your as limit per guest is greater than 50% of (maxram+maxswap). If both guests request their maximum at the same point in time, there will be not enough mem .....|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=Were can I get newer versions of VServer as ready made packages for Debian?||Details=<br />
A: Here you go: http://linux-vserver.derjohn.de/ . There is also some stuff on backports.org, but my kernels are always 'devel' branch.|Signature=derjohn}}<br />
<br />
{{Question|Question=Can I use iptables ?||Details=<br />
Yes but right now only on the host (rootserver). Please realize that all traffic is local and will not touch the forward chain.|Signature=BeginnerFAQ}}<br />
<br />
{{Question|Question=Try to connect to a vserver from the master or another vserver on the same host fails with<br />
:: strace shows:<br />
<pre> <br />
sin_addr=inet_addr("xx.xx.xx.xx")}, yy) = -1 EINVAL (Invalid argument)<br />
</pre><br />
<br />
||Details=<br />
A: The vserver/master cannot communicate with another vserver on same host.<br />
* check all netmasks on all interfaces (do they overlap) ?<br />
* check policy routing (disable it temporary) ?<br />
* check that lo is up (Networking within a host/vserver always uses lo interface)<br />
|Signature=CommonProblems}}<br />
<br />
{{Question|Question=#1 ERROR: capset(): Operation not permitted||Details=capabilities are not enabled in kernel-setup<br />
please check that CONFIG_SECURITY_CAPABILITIES is loaded or included in the kernel. ( check with "cat /path_to_kernel/.config | grep -i cap ")<br />
(2.6.11.5-vs-1.9.5 + 0.30-205)|Signature=IrcQuestions}}<br />
<br />
{{Question|Question=How can I make 'vserver start' mount the root filesystem||Details=<br />
mount it via /etc/vservers/vserver-name/fstab, make sure to set the option 'dev' e.g.:<br />
<pre>/dev/drbd0 / xfs rw,dev 0 0</pre><br />
util-vserver 210 won't be able to find some scripts for the reboot, add into /etc/vservers/vserver-name/apps/init/cmd.stop<br />
<pre>/etc/init.d/rc<br />
6</pre><br />
|Signature=AdrianReyer}}</div>AdrianReyerhttp://www.linux-vserver.org/Frequently_Asked_QuestionsFrequently Asked Questions2006-09-18T11:45:04Z<p>AdrianReyer: </p>
<hr />
<div><div style="margin: 2em auto 2em auto; padding: 10px; background-color: #F9ECCD; border: 1px solid #004433; text-align: center;"><br />
[[Image:Icon-Caution.png|left]]<br />
We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the [[Wiki Team]] page for instructions how to help or look at the [http://oldwiki.linux-vserver.org old wiki] to find the information not migrated yet.<br />
<br />
'''To ease migration we created a [[List of old Documentation pages]].'''<br />
</div><br />
<br />
CURRENTLY THE CONTENT OF THE OLD WIKI FAQ (AND MORE) IS BEING MIGRATED TO THIS PAGE (TASK: DERJOHN)<br />
<br />
<br />
__TOC__<br />
<br />
{{Question|Question=What is a 'Guest'?||Details=To talk about stuff, we need some naming. The physical machine is called 'Host' and the 'main' context running the Host Distro is called 'Host Context'. The virtual machine/distro is called 'Guest' and basically is a Distribution (Userspace) running inside a 'Guest Context'.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=What kind of Operating System (OS) can I run as guest?||Details=<br />
A: With VServer you can only run Linux guests. The trick is that a guest does not run a kernel on its own (as XEN and UML do), it merely uses a virtualized host kernel-interface. VServer offers so called security contexts which make it possible to seperate one guest from each other, i.e. they cannot get data from each other. Imagine it as a chroot environment with much more security and features.|Signature=derjohn}}<br />
<br />
{{Question|Question=Which distributions did you test?||Details=<br />
A: Some. Check out the wiki for ready-made guest images. But you can easily build own guest images, e.g. with Debian's debootstrap. Checkout ((step-by-step Guide 2.6)) how to do that.|Signature=derjohn}}<br />
<br />
{{Question|Question=Is VServer comparable to XEN/UML/QEMU?||Details=<br />
A: Nope. XEN/UML/QEMU and VServer are just good friends. Because you ask, you probably know what XEN/UML/QEMU are. VServer in contrary to XEN/UML/QEMU not "emulate" any hardware you run a kernel on. You can run a VServer kernel in a XEN/UML/QEMU guest. This is confirmed to work at least with Linux 2.6/vs2.0.|Signature=derjohn}}<br />
<br />
{{Question|Question=Is VServer secure?||Details=<br />
A: We hope so. It should be as least as secure as Linux is. We consider it much much more secure though.|Signature=derjohn}}<br />
<br />
{{Question|Question=Performance?||Details=<br />
A: For a single guest, we basically have native performance. Some tests showed insignificant overhead (about 1-2%) others ran faster than on an unpatched kernel. This is IMVHO significantly less than other solutions waste, especially if you have more than a single guest (because of the resource sharing).|Signature=derjohn}}<br />
<br />
{{Question|Question=Is SMP Supported?||Details=<br />
A: Yes, on all SMP capable kernel architectures.|Signature=derjohn}}<br />
<br />
{{Question|Question=Resource sharing?||Details=<br />
A: Yes ....<br />
* memory: Dynamically.<br />
* CPU usage: Dynamically (token bucket)|Signature=derjohn}}<br />
<br />
{{Question|Question=Resource limiting?||Details=<br />
A: Yes, you can set maximum limits per guest, but you can only offer guaranteed resource availability with some ticks at the time. There is the possibility to ulimit and to rlimit. Rlimit is a new feature of kernel 2.6/vs2.0.|Signature=derjohn}}<br />
<br />
{{Question|Question=Disk I/O limiting? Is that possible?||Details=<br />
A: Well, since vs2.1.1 linux-vserver supports a mechanism called 'I/O scheduling', which appeared in the 2.6 mainline some time ago. The mainline kernel offers several I/O schedulers:<br />
<br />
<pre><br />
# cat /sys/block/hdc/queue/scheduler<br />
noop [anticipatory] deadline cfq<br />
</pre><br />
<br />
The default is anticipatory a.k.a. "AS". When running several guests on a host you probably want the I/O performance shared in a fair way among the different guests. The kernel comes with a "completely fair queueing" scheduler, CFQ, which can do that. (More on schedulers can be found at http://lwn.net/Articles/114770/)<br />
<br />
This is how to set the scheduler to "cfq" manually:<br />
<pre><br />
root# echo "cfq" > /sys/block/hdc/queue/scheduler<br />
root# cat /sys/block/hdc/queue/scheduler<br />
noop anticipatory deadline [cfq]<br />
</pre><br />
<br />
Keep in mind that you have to do it on all physical discs. So if you run an md-softraid, do it to all physical /dev/hdXYZ discs!<br />
<br />
If you run Debian there is a predefined way to set the /sys values at boot-time:<br />
<br />
<pre><br />
# apt-get install sysfsutils<br />
[...]<br />
<br />
# cat /etc/sysfs.conf | grep cfq<br />
block/sda/queue/scheduler = cfq<br />
block/sdc/queue/scheduler = cfq<br />
<br />
# /etc/init.d/sysfsutils restart<br />
</pre><br />
<br />
For non-vserver processes and CFQ you can set by which key the kernel decides about the fairness:<br />
<br />
<pre><br />
cat /sys/block/hdc/queue/iosched/key_type<br />
pgid [tgid] uid gid<br />
</pre><br />
Hint: The 'key_type'-feature has been removed in the mainline kernel recently. Don't look for it any longer :(<br />
<br />
The default is tgid, which means to share fairly among process groups. Think every guest is treated like a own process group. It's not possible to set a scheduler strategy within a guest. All processes belonging to the same guest are treated like "noop" within the guest. So: If you run apache and some ftp-server within the _same_ guest, there is no fair scheduling between them, but there is fair scheduling between the whole guest and all other guests.<br />
<br />
And: It's possible to tune the scheduler parameters in several ways. Have a look at /sys/block/hdc/queue/....<br />
<br />
You need a very recent Version of VS devel, e.g. the 2.1.1-rc18 can do it. Some older version have that feature too, then it got lost and was reinvented. So: Go and get a rc18 - only in 'devel', not stable!|Signature=derjohn}}<br />
<br />
{{Question|Question=Why isn't there a device /dev/bla? within a guest||Details=<br />
A: Device nodes allow Userspace to access hardware (or virtual resources). Creating a device node inside the guest's namespace will give access to that device, so for security reasons, the number of 'given' devices is small.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is Unification (vunify)?||Details=<br />
A: Unification is Hard Links on Steroids. Guests can 'share' common files (usually binaries and libraries) in a secure way, by creating hard links with special properties (immutable but unlinkable (removable)). The tool to identify common files and to unify them is called vunify.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is vhashify?||Details=<br />
A: The successor of vunify, a tool which does unification based on hash values (which allows to find common files in arbitrary paths.)|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I manage a multi-guest setup with vhashify?||Details=<br />
A: For 'vhashify', just do these once:<br />
<br />
<pre><br />
mkdir /etc/vservers/.defaults/apps/vunify/hash /vservers/.hash<br />
ln -0s /vservers/.hash /etc/vservers/.defaults/apps/vunify/hash/root<br />
</pre><br />
<br />
Then, do this one line per vserver:<br />
<br />
<pre><br />
mkdir /etc/vservers/<vservername>/apps/vunify # vhashify reuses vunify configuration<br />
</pre><br />
<br />
<br />
The command 'ln' creates a link between two files. "ln -s" creates a symbolic link -- two files are linked by name. "ln -0s" uses a Vserver extention to create a unified link.|Signature=derjohn}}<br />
<br />
{{Question|Question=With which VS version should I begin?||Details=<br />
A: If you are new to VServer I recommend to try 2.0.+. Take "alpha utils" Version 0.30.210. In Debian Sid there appeared well running version of it recently. (It's a .210 at the time of writing).|Signature=derjohn}}<br />
<br />
{{Question|Question=is there a way to implement "user/group quota" per VServer?||Details=<br />
A: Yes, but not on a shared partition for now. You need to put the guest on a separate partition, setup a vroot device (to make the quota access secure), copy that into the guest, and adjust the mtab line inside the guest.|Signature=derjohn}}<br />
<br />
{{Question|Question=what about "Quota" for a context?||Details=<br />
A: Context quotas are now called Disk Limits (so that we can tell them apart from the user/group quotas :). They are supported out of the box (with vs2.0) for all major filesystems (Ext2/3, ReiserFS, XFS, JFS)|Signature=derjohn}}<br />
<br />
{{Question|Question=Does it support IPv6?||Details=<br />
A: Currently not. Some developer has to move his ... to reimplement this functionality from the V4 code (I read that on the ML ;)). Will probably be superseded by the ngnet (next generation networking) soon. There is a Wiki page regarding this: http://linux-vserver.org/IPv6|Signature=derjohn}}<br />
<br />
{{Question|Question=I can't do all I want with the network interfaces inside the guest?||Details=<br />
A: For now the networking is 'Host Business' -- the host is a router, and each guest is a server. You can set the capability ICMP_RAW in the context of the guest, or even the capability CAP_NET_RAW (which would even allow to sniff interfaces of other guests!). Likely to change with ngnet. |Signature=derjohn}}<br />
<br />
{{Question|Question=Is there a web-based interface for vserver that will allow creation/deletion/configuration etc. of vserver guests?||Details=<br />
A. [Update] Errrh, there is http://OpenVPS.org which is a set of scripts with a web-interface for webhosters/ISPs. <br />
A. [Update] Errrh, there is http://Openvcp.org which is a distributed system (agent!) with a web-interface, with which you can build/remove guests! cool stuff! beta, try out!|Signature=derjohn}}<br />
<br />
{{Question|Question=What is old-style and new-style config?||Details=<br />
A. Old-style config refers to a single text-file that contains all the configuration settings. With new-style config the configuration is split into several directories and files. You should probably go for new-style config if you are asking.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is the "great flower page"?||Details=<br />
A. Well, this page contains all configation options for vserver in version > 1.9 (I think .. I joined Linux-VServer in version 2, so I don't know for sure). The name of the page is derivived from the stylesheet(s) it contains: It displays background pictures of a very great flower, so regard it as highly optimized. It was designed by a non-designer, who asks us to create a better one. I played with the thought of creating a complete new theme for that page - but actually we all got used to the name "great flower page", so we stick to it. If you are unable to read it clearly, feel invited to join the IRC channel #vserver, we may tell you how to ;)|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I add several IPs to a vserver? ||Details=<br />
A: First of all a single guest vserver only supports up to 16 IPs (There is a 64-IP patch available, which is in "derjohn's kernel", you need extra util-vserver anyway).<br />
Here is a little helper-script that adds a list of IPs defined in a text file, one per line.<br />
<pre><br />
#!/bin/bash<br />
j=1<br />
for i in `cat myiplist`; do<br />
j=$(($j+1))<br />
mkdir $j<br />
echo $i > $j/ip<br />
echo $i > $j/ip-old<br />
echo "24" > $j/prefix<br />
done<br />
</pre>|Signature=derjohn}}<br />
<br />
{{Question|Question=If my host has only one a single public IP, can I use RFC1918 IP (e.g. 192.168.foo.bar) for the guest vservers?||Details=<br />
A: Yes, use iptables with SNAT to masquerade it. <br />
<pre><br />
iptables -t nat -I POSTROUTING -s $VSERVER_NETZ ! -d $VSERVER_NETZ -j SNAT --to $EXT_IP<br />
</pre><br />
See: HowtoPrivateNetworking and <br />
http://www.tgunkel.de/it/software/doc/linux_server#h3-Vserver_Masquerading_SNAT (THX, [MUPPETS]Gonzo)|Signature=derjohn}}<br />
<br />
{{Question|Question=If I shut down my vserver guest, the whole Internet interface ethX on the host is shut down. What happened? ||Details=<br />
A: When you shut down a guest (i.e. {{vserver foo stop}}), the IP is brought down on the host also. If this IP happens to be the primary IP of the host, the kernel will not only bring down the primary IP, but also all secondary IP addresses. But in very recent kernels, there is an option {{settable}} which prevents that nasty feature. It's called "alias promotion". You may set it via sysctl by adding {{net.ipv4.conf.all.promote_secondaries=1}} in /etc/sysctl.conf or via sysctl command line.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=On Debian Sarge (stable) only util-vserver is 0.30-204 available, which has been reported to be buggy (I didnt check the version for longer time) How do I compile a local version of alpha util-vserver .210 on Debian?||Details=<br />
A:<br />
<pre><br />
apt-get build-dep util-vserver<br />
<br />
./configure --prefix=/usr/local/ --enable-release \<br />
--mandir=/usr/local/share/man \<br />
--infodir=/usr/local/share/info \<br />
--sysconfdir=/etc --enable-dietlibc \<br />
--localstatedir=/var \<br />
--with-vrootdir=/var/lib/vservers<br />
<br />
make<br />
<br />
make install-distribution<br />
(Which does a make install + setting a symlink ln -s /usr/local/lib/util-vserver/vshelper /sbin/vshelper )<br />
<br />
</pre><br />
<br />
To test which version you are running:<br />
<pre><br />
# which vserver<br />
/usr/local/sbin/vserver<br />
<br />
</pre><br />
<br />
This should point to ..local...<br />
<br />
If you dont want to build it yourself: On www.backports.org there are backported (for sarge) linux-images (2.6.16) with vserver-patch enabled and a updated util-vserver package as well.<br />
|Signature=derjohn}}<br />
<br />
{{Question|Question=I use derjohn's kernel or a differnet kernel with a more-than-16-IPs-per-guest-patch and can't use more than 16 IPs. Why?||Details=<br />
A: You need to patch util-vserver, too. So you obviously need to recompile util-vserver (see above). In the util-vserver directory there are header files in the ./kernel/ directory. Patch like this:<br />
<br />
<pre><br />
kernel/network.h:#define NB_IPV4ROOT 64<br />
</pre><br />
<br />
BTW: The initial patches can be found here: http://vserver.13thfloor.at/Experimental/VARIOUS/util-vserver-0.30.196-net64.diff.bz2 and http://vserver.13thfloor.at/Experimental/VARIOUS/delta-2.6.9-vs1.9.3-net64.diff<br />
|Signature=unknown}}<br />
<br />
{{Question|Question=I run a Debian host and want to build an Ubuntu guest. Howto?||Details=<br />
A: Simple ;) Assume you want to build a breezy guest on a sid host with IP 192.168.0.2 and hostname vubuntu, then do:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu<br />
</pre><br />
<br />
[UPDATE] Currently there are problems in building breezy under unclear circumstances, which seems to have to do with udev. If the above didnt work, try:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu -- --exclude=udev<br />
</pre><br />
In very recent versions of the utils, the problem should not occur anymore (it has to do with the 'secure-mount' if you look in the MLs)<br />
<br />
Well, sid's debootstrap knows how to bootstrap Ubuntu linux. Make sure to have a current debootstrap package: <br />
<pre><br />
apt-get update<br />
apt-get install debootstrap<br />
</pre><br />
The knowledge how to build ubuntu 'breezy badger' (which you probably want to be your guest at the time of writing) has been added recently.|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I make a vserver guest start by default?||Details=<br />
A: At least on Debian, I can tell you how to do it with the new-style config. If your guest is called "derjohn" and you want it to be started somewhere at the of your bootstrap process, then do:<br />
<pre><br />
echo "default" > /etc/vservers/derjohn/apps/init/mark<br />
</pre><br />
If you want to start it earlier, please read the init script "/etc/init.d/vserver-default" to find out how to do it. In most cases you don't need to change this. On Debian the vservers are started at "90", so after most other stuff is up (networking etc.).<br />
<br />
Besides that I created a small helper script for managing the autostart foo: ((vserver-autostart))|Signature=derjohn}}<br />
<br />
{{Question|Question=My host works, but when I start a guest it says that it has a problem with chbind.||Details=<br />
A: You are probably using util-vserver <= 0.30.209, which does use dynamic network contexts internally (With 0.30.210 this fact changed). So if you compiled your kernel without dynamic contexts, you may start guests, but you can't use the network context.The solution is either to switch to .210 util (or Hollow's toolset) or compile the kernel with dynamic network contexts.<br />
SE Keyword: invalid option `nid' testme.sh|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=When I try to ssh to the guest, I log into the host, even if I installed sshd on the guest. What's wrong here?||Details=<br />
A: Look at /etc/ssh/sshd_config of the host:<br />
<br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
#ListenAddress ::<br />
</pre><br />
<br />
And now change the setting to <br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
ListenAddress your.hosts.ip.here # not the guests IP! <br />
</pre><br />
<br />
Then '/etc/init.d/ssh restart' on the host, after that on the guest (if you did apt-get install ssh on the guest already.)<br />
<br />
Do I have to explain more? If the hosts sshd binds all available IP addresses on port 22 (The hosts 'sees' even all addresses of the guests!). So if the guest starts its sshd, it cant bind to port 22 any more. You need to change that setting only on the host. <br />
(BTW: A similar approach has to be done for a lot of daemons, e.g. Apache. If the daemon does not support an explicit bind, you may use the chbind command to 'hide' IP addresses from the daemon before starting.)|Signature=derjohn}}<br />
<br />
{{Question|Question=I did everything right, but the application foo does not start. What's up there?||Details=<br />
A: Before asking on the IRC channel, please check out the 'problematic programs' page:<br />
((ProblematicPrograms))|Signature=derjohn}}<br />
<br />
{{Question|Question=Bind9 does not like to start in my guest.||Details=<br />
A: Check out the 'problematic programs' page:<br />
((ProblematicPrograms)) and/or get my [((ProblematicPrograms)) and/or get my [http://linux-vserver.derjohn.de/bind9-packages/bind9-capacheck_9.3.2-2_i386.deb vserver-guest-ready Debian package] for Debian Sid guests from that URL: http://linux-vserver.derjohn.de/bind9-packages/bind9-capacheck_9.3.2-2_i386.deb and check out the [http://linux-vserver.derjohn.de/bind9-packages/README.txt readme]. (Hint: This is fresh stuff. The give me Feedback)<br />
<br />
[UPDATE] Since VServer Devel 2.1.1-rc18 you do not need to patch the userland tools anymore. The capabilities are masked.|Signature=derjohn}}<br />
<br />
{{Question|Question=Which guest vservers are running?||Details=<br />
A: {{vserver-stat}}. Example output:<br />
<pre><br />
CTX PROC VSZ RSS userTIME sysTIME UPTIME NAME<br />
0 77 965.1M 334.6M 14m14s18 2m28s69 1h33m46 root server<br />
49152 7 14M 5.2M 0m00s40 0m00s30 1h30m15 chiffon<br />
</pre>|Signature=derjohn}}<br />
<br />
<br />
<br />
{{Question|Question=How can I reboot/halt guests?||Details=<br />
A: It depends. <br />
For vserver with legacy-interfaces support, you have to replace {{/sbin/halt}} in guests with vreboot and start rebootmgr in host. You also need to have a dummy <guest>.conf file in /etc/vservers for each guest. Please have a look at /etc/init.d/rebootmgr.<br />
Vserver with native interface utilizes /dev/initctl. No changes are needed in guests. Just make sure that REBOOT capability is adjusted in guests.|Signature=derjohn}}<br />
<br />
{{Question|Question=Do I really need the legacy-interfaces? What are these legacy-interfaces?||Details=<br />
A: Since vserver is an ongoing project, new features might replace old ones, some might still on development. Legacy-interfaces are available for backward compability (which might be removed someday). See Q: How can I reboot/halt guests?|Signature=derjohn}}<br />
<br />
{{Question|Question= I have a vserver running on a Linux kernel with preemption. Is VServer "preempt" safe?||Details=<br />
A: There are no known issues about running vserver on a preemption enabled kernel. I would like to add, that the vserver kernelhackers would probably exclude that option in 'make menuconfig' if there would be an incompatibility. Just my $.02 :)|Signature=derjohn}}<br />
<br />
{{Question|Question=Is this a new project? When was it started?||Details=<br />
A: The first public occurance of linux-vserver was Oct 2001. The initial mail can be found here: http://www.cs.helsinki.fi/linux/linux-kernel/2001-40/1065.html<br />
So you can expect a mature software product wich does it's magic quite well (And hey, we have a version > 2.0 ! )|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=Can I run an OpenVPN Server in a guest?||Details=<br />
A: Yes. I don't want to provide an in-depth OpenVPN tutorial, but want to show how I made OpenVPN work in a guest as server. I was not able to run it with a tun devive, due to a buglet in util-vserver and kernel when it comes to settings a an ip address a point to point link: If you add "ip addr add <ip> peer <mypeer> dev tun0" there is no way to map the tun0 interface into a guest, even not with a 'nodev' option. (bug confirmed to be reproducible by daniel_hoczac)<br />
<br />
First of all you have to prepare the host with a persistent tuntap interface in tap-mode. The tools we need come from the uml-utilities.<br />
Then you need to create a device /dev/net/tun, which the OpenVPN userspace daemon reads. Well assume 10.10.10.100 is the server IP, and 10.10.10.101 is the client ip - to be cool be choose a /31 netmask (255.255.255.254), so we have a net without broadcast and don't waste IPs :)<br />
<br />
On the host do: <br />
<pre><br />
# apt-get install uml-utilities<br />
# cd /var/lib/vserver/<myopenvpnserver>/dev/<br />
# ./MAKEDEV tun<br />
(creates the dev/net/tun device accessible by te guest - even a tap interface need /dev/net/tun !)<br />
# tunctl -t tap0<br />
(creates the network device 'tap0' persistently)<br />
</pre><br />
<br />
Then add the ip to the guest:<br />
<pre><br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/ip<br />
10.10.10.100<br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/prefix<br />
31<br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/dev<br />
tap0<br />
(This kind of config brings the ip when the vserver is started - only the tap0 interface has to exist already, see above!)<br />
</pre><br />
<br />
Here is a sample config for the guest (which is acting as a server):<br />
<br />
Install OpenVPN package on server and client, in the Debian case:<br />
<pre><br />
# apt-get install openvpn<br />
</pre><br />
<br />
The server's conf looks like that:<br />
<pre><br />
# port and interface specs<br />
<br />
# behave like a ssl-webserver<br />
port 443<br />
proto tcp-server<br />
<br />
# tap device? (keep in mind you need /dev/net/tun !)<br />
dev tap0<br />
<br />
# now the ips we will use for the tunnel<br />
ifconfig 10.10.10.100 255.255.255.254<br />
ifconfig-noexec<br />
<br />
# the server part<br />
<br />
# Keep VPN connections, even if the client IP changes<br />
float<br />
<br />
# use compression (may also even obfuscate content filters)<br />
comp-lzo<br />
<br />
# use a static key - create it with 'openvpn --genkey --secret static.key'<br />
secret static.key<br />
<br />
# dont reload the key after a SIGUSR1<br />
persist-key<br />
<br />
# check alive all 10 secs<br />
keepalive 10 60<br />
<br />
# verbosity level (from 1 to 9, 9 is max log level)<br />
verb 4<br />
status openvpn-status.log<br />
</pre><br />
<br />
The client's conf may look like that (This example even makes the tunnel the clients default address):<br />
<pre><br />
# cat /etc/openvpn/client.conf<br />
# port and interface specs<br />
<br />
# the following is not necessary, if you bring up openvpn via Debian's init script:<br />
daemon ovpn-my-clients-name<br />
<br />
# behave like a ssl-webserver<br />
port 443<br />
proto tcp-client<br />
remote %%%<insert-the-guest-primary-public-ip-here>%%%%<br />
# what device tun ot tap?<br />
dev tap<br />
<br />
# now the ips we will use for the tunnel<br />
ifconfig 10.10.10.101 255.255.255.254<br />
<br />
# Keep VPN connections, even if the client IP changes<br />
float<br />
mssfix<br />
<br />
# use compression (may also even obfuscate content filters)<br />
comp-lzo<br />
<br />
# use a static key<br />
secret static.key<br />
<br />
# dont reload the key after a SIGUSR1<br />
persist-key<br />
<br />
# check alive all 10 secs<br />
keepalive 10 60<br />
<br />
# verbosity level (from 1 to 9, 9 is max log level)<br />
verb 4<br />
<br />
# set the default route<br />
route-gateway 10.10.10.100<br />
redirect-gateway def1<br />
# to add special routes you can do it wihtin the openvpn client conf:<br />
# route <dest> <mask> <gateway><br />
<br />
# if you need to connect via proxy (like squid)<br />
# http-proxy s p [up] [auth] : Connect to remote host through an HTTP proxy at<br />
# address s and port p. If proxy authentication is required,<br />
# up is a file containing username/password on 2 lines, or<br />
# 'stdin' to prompt from console. Add auth='ntlm' if<br />
# the proxy requires NTLM authentication.<br />
<br />
# http-proxy s p [up] [auth]<br />
<br />
<br />
# http-proxy-option type [parm] : Set extended HTTP proxy options.<br />
# Repeat to set multiple options.<br />
# VERSION version (default=1.0)<br />
# AGENT user-agent<br />
<br />
# http-proxy-option type [parm]<br />
</pre><br />
<br />
In the next lesson I will talk about OpenVPN's server mode, which can deal with with multiple clients connecting to one ip and one port (i.e. you only need one guest for tons or 'roadwarriros'), tls connections and pki.<br />
<br />
Contributions welcome. :)|Signature=derjohn}}<br />
<br />
{{Question|Question=32 vs 64 Bit? What should I take?||Details=<br />
A: If you have the choice make the host a 64 bit one. You can run a guest as 32 bit or as 64 bit on a 64 bit host. To run it as 32 bit, you need to compile the x86_64 (a.k.a. AMD64) with the following options:<br />
<br />
<pre><br />
[*] Kernel support for ELF binaries<br />
<M> Kernel support for MISC binaries<br />
[*] IA32 Emulation <---- without that, the entire 32bit API is not present<br />
<M> IA32 a.out support <br />
</pre><br />
<br />
You can force the guest to behave like a 32 environment like this:<br />
<pre><br />
echo linux_32bit > /etc/vservers/$NAME/personality<br />
echo i686 > /etc/vservers/$NAME/uts/machine<br />
</pre><br />
(thanks cehteh for the hint!)<br />
<br />
But you can force debootstrap to but 32 bit binaries into the guest by 'export ARCH=i386';<br />
<pre><br />
export ARCH=i386 ; vserver build .... <br />
</pre>|Signature=derjohn}}<br />
<br />
{{Question|Question=I want to (re)mount a partition in a running guest ... but the guest has no rights (capability) to (re)mount?||Details=<br />
A: I'll explain. I take as example your /tmp partition within the guest is too small, what will be likely the case if you stay with the 16MB default (vserver build mounts /tmp as 16 MB tempfs!).<br />
<pre><br />
# vnamespace -e XID mount -t tmpfs -o remount,size=256m,mode=1777 none /var/lib/vservers/<guest>/tmp/<br />
</pre><br />
Be warned that the guest will not recognize the change, as the /etc/mtab file is not updated when you mount like this. To permanently change the mount, edit /etc/vserver/<guest>/fstab on the host.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=How do I limit a guests RAM? I want to prevent OOM situations on the host!||Details=<br />
A: First you can read [http://linux-vserver.org/Memory+Allocation].<br />
If you want a recipe, do that:<br />
1. Check the size of memory pages. On x86 and x86_64 is usually 4 KB per page.<br />
2. Create /etc/vserver/<guest>/rlimits/<br />
3. Check your physical memory size on the host, e.g. with "free -m". maxram = kilobytes/pagesize.<br />
4. Limit the guests physical RAM to value smaller then maxram:<br />
<br />
<pre><br />
echo %%insertYourPagesHereSmallerThanMaxram%% > /etc/vserver/<guest>/rlimits/rss<br />
</pre><br />
<br />
5. Check your swapspace, e.g. with 'swapon -s'. maxswap = swapkilobytes/pagesize.<br />
6. Limit the guest's maximum number of as pages to a value smaller than (maxram+maxswap):<br />
<br />
<pre><br />
echo %%desiredvalue%% > /etc/vserver/<guest>/rlimits/as<br />
</pre><br />
<br />
It should be clear this can still lead to OOM situations. Example: You have two guests and your as limit per guest is greater than 50% of (maxram+maxswap). If both guests request their maximum at the same point in time, there will be not enough mem .....|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=Were can I get newer versions of VServer as ready made packages for Debian?||Details=<br />
A: Here you go: http://linux-vserver.derjohn.de/ . There is also some stuff on backports.org, but my kernels are always 'devel' branch.|Signature=derjohn}}<br />
<br />
{{Question|Question=Can I use iptables ?||Details=<br />
Yes but right now only on the host (rootserver). Please realize that all traffic is local and will not touch the forward chain.|Signature=BeginnerFAQ}}<br />
<br />
{{Question|Question=Try to connect to a vserver from the master or another vserver on the same host fails with<br />
:: strace shows:<br />
<pre> <br />
sin_addr=inet_addr("xx.xx.xx.xx")}, yy) = -1 EINVAL (Invalid argument)<br />
</pre><br />
<br />
||Details=<br />
A: The vserver/master cannot communicate with another vserver on same host.<br />
* check all netmasks on all interfaces (do they overlap) ?<br />
* check policy routing (disable it temporary) ?<br />
* check that lo is up (Networking within a host/vserver always uses lo interface)<br />
|Signature=CommonProblems}}<br />
<br />
{{Question|Question=#1 ERROR: capset(): Operation not permitted||Details=capabilities are not enabled in kernel-setup<br />
please check that CONFIG_SECURITY_CAPABILITIES is loaded or included in the kernel. ( check with "cat /path_to_kernel/.config | grep -i cap ")<br />
(2.6.11.5-vs-1.9.5 + 0.30-205)|Signature=IrcQuestions}}<br />
<br />
{{Question|Question=How can I make 'vserver start' mount the root filesystem||Details=<br />
mount it via /etc/vservers/vserver-name/fstab, make sure to set the option 'dev' e.g.:<br />
<pre>/dev/drbd0 / xfs rw,dev 0 0</pre><br />
util-vserver 210 won't be able to find some scripts for the reboot, add into /etc/vservers/vserver-name/apps/init/cmd.stop<br />
<pre>/etc/init.d/rc<br />
6</pre><br />
|Signature=AdrianReyer}}</div>AdrianReyerhttp://www.linux-vserver.org/Frequently_Asked_QuestionsFrequently Asked Questions2006-09-18T11:40:50Z<p>AdrianReyer: </p>
<hr />
<div><div style="margin: 2em auto 2em auto; padding: 10px; background-color: #F9ECCD; border: 1px solid #004433; text-align: center;"><br />
[[Image:Icon-Caution.png|left]]<br />
We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the [[Wiki Team]] page for instructions how to help or look at the [http://oldwiki.linux-vserver.org old wiki] to find the information not migrated yet.<br />
<br />
'''To ease migration we created a [[List of old Documentation pages]].'''<br />
</div><br />
<br />
CURRENTLY THE CONTENT OF THE OLD WIKI FAQ (AND MORE) IS BEING MIGRATED TO THIS PAGE (TASK: DERJOHN)<br />
<br />
<br />
__TOC__<br />
<br />
{{Question|Question=What is a 'Guest'?||Details=To talk about stuff, we need some naming. The physical machine is called 'Host' and the 'main' context running the Host Distro is called 'Host Context'. The virtual machine/distro is called 'Guest' and basically is a Distribution (Userspace) running inside a 'Guest Context'.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=What kind of Operating System (OS) can I run as guest?||Details=<br />
A: With VServer you can only run Linux guests. The trick is that a guest does not run a kernel on its own (as XEN and UML do), it merely uses a virtualized host kernel-interface. VServer offers so called security contexts which make it possible to seperate one guest from each other, i.e. they cannot get data from each other. Imagine it as a chroot environment with much more security and features.|Signature=derjohn}}<br />
<br />
{{Question|Question=Which distributions did you test?||Details=<br />
A: Some. Check out the wiki for ready-made guest images. But you can easily build own guest images, e.g. with Debian's debootstrap. Checkout ((step-by-step Guide 2.6)) how to do that.|Signature=derjohn}}<br />
<br />
{{Question|Question=Is VServer comparable to XEN/UML/QEMU?||Details=<br />
A: Nope. XEN/UML/QEMU and VServer are just good friends. Because you ask, you probably know what XEN/UML/QEMU are. VServer in contrary to XEN/UML/QEMU not "emulate" any hardware you run a kernel on. You can run a VServer kernel in a XEN/UML/QEMU guest. This is confirmed to work at least with Linux 2.6/vs2.0.|Signature=derjohn}}<br />
<br />
{{Question|Question=Is VServer secure?||Details=<br />
A: We hope so. It should be as least as secure as Linux is. We consider it much much more secure though.|Signature=derjohn}}<br />
<br />
{{Question|Question=Performance?||Details=<br />
A: For a single guest, we basically have native performance. Some tests showed insignificant overhead (about 1-2%) others ran faster than on an unpatched kernel. This is IMVHO significantly less than other solutions waste, especially if you have more than a single guest (because of the resource sharing).|Signature=derjohn}}<br />
<br />
{{Question|Question=Is SMP Supported?||Details=<br />
A: Yes, on all SMP capable kernel architectures.|Signature=derjohn}}<br />
<br />
{{Question|Question=Resource sharing?||Details=<br />
A: Yes ....<br />
* memory: Dynamically.<br />
* CPU usage: Dynamically (token bucket)|Signature=derjohn}}<br />
<br />
{{Question|Question=Resource limiting?||Details=<br />
A: Yes, you can set maximum limits per guest, but you can only offer guaranteed resource availability with some ticks at the time. There is the possibility to ulimit and to rlimit. Rlimit is a new feature of kernel 2.6/vs2.0.|Signature=derjohn}}<br />
<br />
{{Question|Question=Disk I/O limiting? Is that possible?||Details=<br />
A: Well, since vs2.1.1 linux-vserver supports a mechanism called 'I/O scheduling', which appeared in the 2.6 mainline some time ago. The mainline kernel offers several I/O schedulers:<br />
<br />
<pre><br />
# cat /sys/block/hdc/queue/scheduler<br />
noop [anticipatory] deadline cfq<br />
</pre><br />
<br />
The default is anticipatory a.k.a. "AS". When running several guests on a host you probably want the I/O performance shared in a fair way among the different guests. The kernel comes with a "completely fair queueing" scheduler, CFQ, which can do that. (More on schedulers can be found at http://lwn.net/Articles/114770/)<br />
<br />
This is how to set the scheduler to "cfq" manually:<br />
<pre><br />
root# echo "cfq" > /sys/block/hdc/queue/scheduler<br />
root# cat /sys/block/hdc/queue/scheduler<br />
noop anticipatory deadline [cfq]<br />
</pre><br />
<br />
Keep in mind that you have to do it on all physical discs. So if you run an md-softraid, do it to all physical /dev/hdXYZ discs!<br />
<br />
If you run Debian there is a predefined way to set the /sys values at boot-time:<br />
<br />
<pre><br />
# apt-get install sysfsutils<br />
[...]<br />
<br />
# cat /etc/sysfs.conf | grep cfq<br />
block/sda/queue/scheduler = cfq<br />
block/sdc/queue/scheduler = cfq<br />
<br />
# /etc/init.d/sysfsutils restart<br />
</pre><br />
<br />
For non-vserver processes and CFQ you can set by which key the kernel decides about the fairness:<br />
<br />
<pre><br />
cat /sys/block/hdc/queue/iosched/key_type<br />
pgid [tgid] uid gid<br />
</pre><br />
Hint: The 'key_type'-feature has been removed in the mainline kernel recently. Don't look for it any longer :(<br />
<br />
The default is tgid, which means to share fairly among process groups. Think every guest is treated like a own process group. It's not possible to set a scheduler strategy within a guest. All processes belonging to the same guest are treated like "noop" within the guest. So: If you run apache and some ftp-server within the _same_ guest, there is no fair scheduling between them, but there is fair scheduling between the whole guest and all other guests.<br />
<br />
And: It's possible to tune the scheduler parameters in several ways. Have a look at /sys/block/hdc/queue/....<br />
<br />
You need a very recent Version of VS devel, e.g. the 2.1.1-rc18 can do it. Some older version have that feature too, then it got lost and was reinvented. So: Go and get a rc18 - only in 'devel', not stable!|Signature=derjohn}}<br />
<br />
{{Question|Question=Why isn't there a device /dev/bla? within a guest||Details=<br />
A: Device nodes allow Userspace to access hardware (or virtual resources). Creating a device node inside the guest's namespace will give access to that device, so for security reasons, the number of 'given' devices is small.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is Unification (vunify)?||Details=<br />
A: Unification is Hard Links on Steroids. Guests can 'share' common files (usually binaries and libraries) in a secure way, by creating hard links with special properties (immutable but unlinkable (removable)). The tool to identify common files and to unify them is called vunify.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is vhashify?||Details=<br />
A: The successor of vunify, a tool which does unification based on hash values (which allows to find common files in arbitrary paths.)|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I manage a multi-guest setup with vhashify?||Details=<br />
A: For 'vhashify', just do these once:<br />
<br />
<pre><br />
mkdir /etc/vservers/.defaults/apps/vunify/hash /vservers/.hash<br />
ln -0s /vservers/.hash /etc/vservers/.defaults/apps/vunify/hash/root<br />
</pre><br />
<br />
Then, do this one line per vserver:<br />
<br />
<pre><br />
mkdir /etc/vservers/<vservername>/apps/vunify # vhashify reuses vunify configuration<br />
</pre><br />
<br />
<br />
The command 'ln' creates a link between two files. "ln -s" creates a symbolic link -- two files are linked by name. "ln -0s" uses a Vserver extention to create a unified link.|Signature=derjohn}}<br />
<br />
{{Question|Question=With which VS version should I begin?||Details=<br />
A: If you are new to VServer I recommend to try 2.0.+. Take "alpha utils" Version 0.30.210. In Debian Sid there appeared well running version of it recently. (It's a .210 at the time of writing).|Signature=derjohn}}<br />
<br />
{{Question|Question=is there a way to implement "user/group quota" per VServer?||Details=<br />
A: Yes, but not on a shared partition for now. You need to put the guest on a separate partition, setup a vroot device (to make the quota access secure), copy that into the guest, and adjust the mtab line inside the guest.|Signature=derjohn}}<br />
<br />
{{Question|Question=what about "Quota" for a context?||Details=<br />
A: Context quotas are now called Disk Limits (so that we can tell them apart from the user/group quotas :). They are supported out of the box (with vs2.0) for all major filesystems (Ext2/3, ReiserFS, XFS, JFS)|Signature=derjohn}}<br />
<br />
{{Question|Question=Does it support IPv6?||Details=<br />
A: Currently not. Some developer has to move his ... to reimplement this functionality from the V4 code (I read that on the ML ;)). Will probably be superseded by the ngnet (next generation networking) soon. There is a Wiki page regarding this: http://linux-vserver.org/IPv6|Signature=derjohn}}<br />
<br />
{{Question|Question=I can't do all I want with the network interfaces inside the guest?||Details=<br />
A: For now the networking is 'Host Business' -- the host is a router, and each guest is a server. You can set the capability ICMP_RAW in the context of the guest, or even the capability CAP_NET_RAW (which would even allow to sniff interfaces of other guests!). Likely to change with ngnet. |Signature=derjohn}}<br />
<br />
{{Question|Question=Is there a web-based interface for vserver that will allow creation/deletion/configuration etc. of vserver guests?||Details=<br />
A. [Update] Errrh, there is http://OpenVPS.org which is a set of scripts with a web-interface for webhosters/ISPs. <br />
A. [Update] Errrh, there is http://Openvcp.org which is a distributed system (agent!) with a web-interface, with which you can build/remove guests! cool stuff! beta, try out!|Signature=derjohn}}<br />
<br />
{{Question|Question=What is old-style and new-style config?||Details=<br />
A. Old-style config refers to a single text-file that contains all the configuration settings. With new-style config the configuration is split into several directories and files. You should probably go for new-style config if you are asking.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is the "great flower page"?||Details=<br />
A. Well, this page contains all configation options for vserver in version > 1.9 (I think .. I joined Linux-VServer in version 2, so I don't know for sure). The name of the page is derivived from the stylesheet(s) it contains: It displays background pictures of a very great flower, so regard it as highly optimized. It was designed by a non-designer, who asks us to create a better one. I played with the thought of creating a complete new theme for that page - but actually we all got used to the name "great flower page", so we stick to it. If you are unable to read it clearly, feel invited to join the IRC channel #vserver, we may tell you how to ;)|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I add several IPs to a vserver? ||Details=<br />
A: First of all a single guest vserver only supports up to 16 IPs (There is a 64-IP patch available, which is in "derjohn's kernel", you need extra util-vserver anyway).<br />
Here is a little helper-script that adds a list of IPs defined in a text file, one per line.<br />
<pre><br />
#!/bin/bash<br />
j=1<br />
for i in `cat myiplist`; do<br />
j=$(($j+1))<br />
mkdir $j<br />
echo $i > $j/ip<br />
echo $i > $j/ip-old<br />
echo "24" > $j/prefix<br />
done<br />
</pre>|Signature=derjohn}}<br />
<br />
{{Question|Question=If my host has only one a single public IP, can I use RFC1918 IP (e.g. 192.168.foo.bar) for the guest vservers?||Details=<br />
A: Yes, use iptables with SNAT to masquerade it. <br />
<pre><br />
iptables -t nat -I POSTROUTING -s $VSERVER_NETZ ! -d $VSERVER_NETZ -j SNAT --to $EXT_IP<br />
</pre><br />
See: HowtoPrivateNetworking and <br />
http://www.tgunkel.de/it/software/doc/linux_server#h3-Vserver_Masquerading_SNAT (THX, [MUPPETS]Gonzo)|Signature=derjohn}}<br />
<br />
{{Question|Question=If I shut down my vserver guest, the whole Internet interface ethX on the host is shut down. What happened? ||Details=<br />
A: When you shut down a guest (i.e. {{vserver foo stop}}), the IP is brought down on the host also. If this IP happens to be the primary IP of the host, the kernel will not only bring down the primary IP, but also all secondary IP addresses. But in very recent kernels, there is an option {{settable}} which prevents that nasty feature. It's called "alias promotion". You may set it via sysctl by adding {{net.ipv4.conf.all.promote_secondaries=1}} in /etc/sysctl.conf or via sysctl command line.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=On Debian Sarge (stable) only util-vserver is 0.30-204 available, which has been reported to be buggy (I didnt check the version for longer time) How do I compile a local version of alpha util-vserver .210 on Debian?||Details=<br />
A:<br />
<pre><br />
apt-get build-dep util-vserver<br />
<br />
./configure --prefix=/usr/local/ --enable-release \<br />
--mandir=/usr/local/share/man \<br />
--infodir=/usr/local/share/info \<br />
--sysconfdir=/etc --enable-dietlibc \<br />
--localstatedir=/var \<br />
--with-vrootdir=/var/lib/vservers<br />
<br />
make<br />
<br />
make install-distribution<br />
(Which does a make install + setting a symlink ln -s /usr/local/lib/util-vserver/vshelper /sbin/vshelper )<br />
<br />
</pre><br />
<br />
To test which version you are running:<br />
<pre><br />
# which vserver<br />
/usr/local/sbin/vserver<br />
<br />
</pre><br />
<br />
This should point to ..local...<br />
<br />
If you dont want to build it yourself: On www.backports.org there are backported (for sarge) linux-images (2.6.16) with vserver-patch enabled and a updated util-vserver package as well.<br />
|Signature=derjohn}}<br />
<br />
{{Question|Question=I use derjohn's kernel or a differnet kernel with a more-than-16-IPs-per-guest-patch and can't use more than 16 IPs. Why?||Details=<br />
A: You need to patch util-vserver, too. So you obviously need to recompile util-vserver (see above). In the util-vserver directory there are header files in the ./kernel/ directory. Patch like this:<br />
<br />
<pre><br />
kernel/network.h:#define NB_IPV4ROOT 64<br />
</pre><br />
<br />
BTW: The initial patches can be found here: http://vserver.13thfloor.at/Experimental/VARIOUS/util-vserver-0.30.196-net64.diff.bz2 and http://vserver.13thfloor.at/Experimental/VARIOUS/delta-2.6.9-vs1.9.3-net64.diff<br />
|Signature=unknown}}<br />
<br />
{{Question|Question=I run a Debian host and want to build an Ubuntu guest. Howto?||Details=<br />
A: Simple ;) Assume you want to build a breezy guest on a sid host with IP 192.168.0.2 and hostname vubuntu, then do:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu<br />
</pre><br />
<br />
[UPDATE] Currently there are problems in building breezy under unclear circumstances, which seems to have to do with udev. If the above didnt work, try:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu -- --exclude=udev<br />
</pre><br />
In very recent versions of the utils, the problem should not occur anymore (it has to do with the 'secure-mount' if you look in the MLs)<br />
<br />
Well, sid's debootstrap knows how to bootstrap Ubuntu linux. Make sure to have a current debootstrap package: <br />
<pre><br />
apt-get update<br />
apt-get install debootstrap<br />
</pre><br />
The knowledge how to build ubuntu 'breezy badger' (which you probably want to be your guest at the time of writing) has been added recently.|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I make a vserver guest start by default?||Details=<br />
A: At least on Debian, I can tell you how to do it with the new-style config. If your guest is called "derjohn" and you want it to be started somewhere at the of your bootstrap process, then do:<br />
<pre><br />
echo "default" > /etc/vservers/derjohn/apps/init/mark<br />
</pre><br />
If you want to start it earlier, please read the init script "/etc/init.d/vserver-default" to find out how to do it. In most cases you don't need to change this. On Debian the vservers are started at "90", so after most other stuff is up (networking etc.).<br />
<br />
Besides that I created a small helper script for managing the autostart foo: ((vserver-autostart))|Signature=derjohn}}<br />
<br />
{{Question|Question=My host works, but when I start a guest it says that it has a problem with chbind.||Details=<br />
A: You are probably using util-vserver <= 0.30.209, which does use dynamic network contexts internally (With 0.30.210 this fact changed). So if you compiled your kernel without dynamic contexts, you may start guests, but you can't use the network context.The solution is either to switch to .210 util (or Hollow's toolset) or compile the kernel with dynamic network contexts.<br />
SE Keyword: invalid option `nid' testme.sh|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=When I try to ssh to the guest, I log into the host, even if I installed sshd on the guest. What's wrong here?||Details=<br />
A: Look at /etc/ssh/sshd_config of the host:<br />
<br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
#ListenAddress ::<br />
</pre><br />
<br />
And now change the setting to <br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
ListenAddress your.hosts.ip.here # not the guests IP! <br />
</pre><br />
<br />
Then '/etc/init.d/ssh restart' on the host, after that on the guest (if you did apt-get install ssh on the guest already.)<br />
<br />
Do I have to explain more? If the hosts sshd binds all available IP addresses on port 22 (The hosts 'sees' even all addresses of the guests!). So if the guest starts its sshd, it cant bind to port 22 any more. You need to change that setting only on the host. <br />
(BTW: A similar approach has to be done for a lot of daemons, e.g. Apache. If the daemon does not support an explicit bind, you may use the chbind command to 'hide' IP addresses from the daemon before starting.)|Signature=derjohn}}<br />
<br />
{{Question|Question=I did everything right, but the application foo does not start. What's up there?||Details=<br />
A: Before asking on the IRC channel, please check out the 'problematic programs' page:<br />
((ProblematicPrograms))|Signature=derjohn}}<br />
<br />
{{Question|Question=Bind9 does not like to start in my guest.||Details=<br />
A: Check out the 'problematic programs' page:<br />
((ProblematicPrograms)) and/or get my [((ProblematicPrograms)) and/or get my [http://linux-vserver.derjohn.de/bind9-packages/bind9-capacheck_9.3.2-2_i386.deb vserver-guest-ready Debian package] for Debian Sid guests from that URL: http://linux-vserver.derjohn.de/bind9-packages/bind9-capacheck_9.3.2-2_i386.deb and check out the [http://linux-vserver.derjohn.de/bind9-packages/README.txt readme]. (Hint: This is fresh stuff. The give me Feedback)<br />
<br />
[UPDATE] Since VServer Devel 2.1.1-rc18 you do not need to patch the userland tools anymore. The capabilities are masked.|Signature=derjohn}}<br />
<br />
{{Question|Question=Which guest vservers are running?||Details=<br />
A: {{vserver-stat}}. Example output:<br />
<pre><br />
CTX PROC VSZ RSS userTIME sysTIME UPTIME NAME<br />
0 77 965.1M 334.6M 14m14s18 2m28s69 1h33m46 root server<br />
49152 7 14M 5.2M 0m00s40 0m00s30 1h30m15 chiffon<br />
</pre>|Signature=derjohn}}<br />
<br />
<br />
<br />
{{Question|Question=How can I reboot/halt guests?||Details=<br />
A: It depends. <br />
For vserver with legacy-interfaces support, you have to replace {{/sbin/halt}} in guests with vreboot and start rebootmgr in host. You also need to have a dummy <guest>.conf file in /etc/vservers for each guest. Please have a look at /etc/init.d/rebootmgr.<br />
Vserver with native interface utilizes /dev/initctl. No changes are needed in guests. Just make sure that REBOOT capability is adjusted in guests.|Signature=derjohn}}<br />
<br />
{{Question|Question=Do I really need the legacy-interfaces? What are these legacy-interfaces?||Details=<br />
A: Since vserver is an ongoing project, new features might replace old ones, some might still on development. Legacy-interfaces are available for backward compability (which might be removed someday). See Q: How can I reboot/halt guests?|Signature=derjohn}}<br />
<br />
{{Question|Question= I have a vserver running on a Linux kernel with preemption. Is VServer "preempt" safe?||Details=<br />
A: There are no known issues about running vserver on a preemption enabled kernel. I would like to add, that the vserver kernelhackers would probably exclude that option in 'make menuconfig' if there would be an incompatibility. Just my $.02 :)|Signature=derjohn}}<br />
<br />
{{Question|Question=Is this a new project? When was it started?||Details=<br />
A: The first public occurance of linux-vserver was Oct 2001. The initial mail can be found here: http://www.cs.helsinki.fi/linux/linux-kernel/2001-40/1065.html<br />
So you can expect a mature software product wich does it's magic quite well (And hey, we have a version > 2.0 ! )|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=Can I run an OpenVPN Server in a guest?||Details=<br />
A: Yes. I don't want to provide an in-depth OpenVPN tutorial, but want to show how I made OpenVPN work in a guest as server. I was not able to run it with a tun devive, due to a buglet in util-vserver and kernel when it comes to settings a an ip address a point to point link: If you add "ip addr add <ip> peer <mypeer> dev tun0" there is no way to map the tun0 interface into a guest, even not with a 'nodev' option. (bug confirmed to be reproducible by daniel_hoczac)<br />
<br />
First of all you have to prepare the host with a persistent tuntap interface in tap-mode. The tools we need come from the uml-utilities.<br />
Then you need to create a device /dev/net/tun, which the OpenVPN userspace daemon reads. Well assume 10.10.10.100 is the server IP, and 10.10.10.101 is the client ip - to be cool be choose a /31 netmask (255.255.255.254), so we have a net without broadcast and don't waste IPs :)<br />
<br />
On the host do: <br />
<pre><br />
# apt-get install uml-utilities<br />
# cd /var/lib/vserver/<myopenvpnserver>/dev/<br />
# ./MAKEDEV tun<br />
(creates the dev/net/tun device accessible by te guest - even a tap interface need /dev/net/tun !)<br />
# tunctl -t tap0<br />
(creates the network device 'tap0' persistently)<br />
</pre><br />
<br />
Then add the ip to the guest:<br />
<pre><br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/ip<br />
10.10.10.100<br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/prefix<br />
31<br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/dev<br />
tap0<br />
(This kind of config brings the ip when the vserver is started - only the tap0 interface has to exist already, see above!)<br />
</pre><br />
<br />
Here is a sample config for the guest (which is acting as a server):<br />
<br />
Install OpenVPN package on server and client, in the Debian case:<br />
<pre><br />
# apt-get install openvpn<br />
</pre><br />
<br />
The server's conf looks like that:<br />
<pre><br />
# port and interface specs<br />
<br />
# behave like a ssl-webserver<br />
port 443<br />
proto tcp-server<br />
<br />
# tap device? (keep in mind you need /dev/net/tun !)<br />
dev tap0<br />
<br />
# now the ips we will use for the tunnel<br />
ifconfig 10.10.10.100 255.255.255.254<br />
ifconfig-noexec<br />
<br />
# the server part<br />
<br />
# Keep VPN connections, even if the client IP changes<br />
float<br />
<br />
# use compression (may also even obfuscate content filters)<br />
comp-lzo<br />
<br />
# use a static key - create it with 'openvpn --genkey --secret static.key'<br />
secret static.key<br />
<br />
# dont reload the key after a SIGUSR1<br />
persist-key<br />
<br />
# check alive all 10 secs<br />
keepalive 10 60<br />
<br />
# verbosity level (from 1 to 9, 9 is max log level)<br />
verb 4<br />
status openvpn-status.log<br />
</pre><br />
<br />
The client's conf may look like that (This example even makes the tunnel the clients default address):<br />
<pre><br />
# cat /etc/openvpn/client.conf<br />
# port and interface specs<br />
<br />
# the following is not necessary, if you bring up openvpn via Debian's init script:<br />
daemon ovpn-my-clients-name<br />
<br />
# behave like a ssl-webserver<br />
port 443<br />
proto tcp-client<br />
remote %%%<insert-the-guest-primary-public-ip-here>%%%%<br />
# what device tun ot tap?<br />
dev tap<br />
<br />
# now the ips we will use for the tunnel<br />
ifconfig 10.10.10.101 255.255.255.254<br />
<br />
# Keep VPN connections, even if the client IP changes<br />
float<br />
mssfix<br />
<br />
# use compression (may also even obfuscate content filters)<br />
comp-lzo<br />
<br />
# use a static key<br />
secret static.key<br />
<br />
# dont reload the key after a SIGUSR1<br />
persist-key<br />
<br />
# check alive all 10 secs<br />
keepalive 10 60<br />
<br />
# verbosity level (from 1 to 9, 9 is max log level)<br />
verb 4<br />
<br />
# set the default route<br />
route-gateway 10.10.10.100<br />
redirect-gateway def1<br />
# to add special routes you can do it wihtin the openvpn client conf:<br />
# route <dest> <mask> <gateway><br />
<br />
# if you need to connect via proxy (like squid)<br />
# http-proxy s p [up] [auth] : Connect to remote host through an HTTP proxy at<br />
# address s and port p. If proxy authentication is required,<br />
# up is a file containing username/password on 2 lines, or<br />
# 'stdin' to prompt from console. Add auth='ntlm' if<br />
# the proxy requires NTLM authentication.<br />
<br />
# http-proxy s p [up] [auth]<br />
<br />
<br />
# http-proxy-option type [parm] : Set extended HTTP proxy options.<br />
# Repeat to set multiple options.<br />
# VERSION version (default=1.0)<br />
# AGENT user-agent<br />
<br />
# http-proxy-option type [parm]<br />
</pre><br />
<br />
In the next lesson I will talk about OpenVPN's server mode, which can deal with with multiple clients connecting to one ip and one port (i.e. you only need one guest for tons or 'roadwarriros'), tls connections and pki.<br />
<br />
Contributions welcome. :)|Signature=derjohn}}<br />
<br />
{{Question|Question=32 vs 64 Bit? What should I take?||Details=<br />
A: If you have the choice make the host a 64 bit one. You can run a guest as 32 bit or as 64 bit on a 64 bit host. To run it as 32 bit, you need to compile the x86_64 (a.k.a. AMD64) with the following options:<br />
<br />
<pre><br />
[*] Kernel support for ELF binaries<br />
<M> Kernel support for MISC binaries<br />
[*] IA32 Emulation <---- without that, the entire 32bit API is not present<br />
<M> IA32 a.out support <br />
</pre><br />
<br />
You can force the guest to behave like a 32 environment like this:<br />
<pre><br />
echo linux_32bit > /etc/vservers/$NAME/personality<br />
echo i686 > /etc/vservers/$NAME/uts/machine<br />
</pre><br />
(thanks cehteh for the hint!)<br />
<br />
But you can force debootstrap to but 32 bit binaries into the guest by 'export ARCH=i386';<br />
<pre><br />
export ARCH=i386 ; vserver build .... <br />
</pre>|Signature=derjohn}}<br />
<br />
{{Question|Question=I want to (re)mount a partition in a running guest ... but the guest has no rights (capability) to (re)mount?||Details=<br />
A: I'll explain. I take as example your /tmp partition within the guest is too small, what will be likely the case if you stay with the 16MB default (vserver build mounts /tmp as 16 MB tempfs!).<br />
<pre><br />
# vnamespace -e XID mount -t tmpfs -o remount,size=256m,mode=1777 none /var/lib/vservers/<guest>/tmp/<br />
</pre><br />
Be warned that the guest will not recognize the change, as the /etc/mtab file is not updated when you mount like this. To permanently change the mount, edit /etc/vserver/<guest>/fstab on the host.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=How do I limit a guests RAM? I want to prevent OOM situations on the host!||Details=<br />
A: First you can read [http://linux-vserver.org/Memory+Allocation].<br />
If you want a recipe, do that:<br />
1. Check the size of memory pages. On x86 and x86_64 is usually 4 KB per page.<br />
2. Create /etc/vserver/<guest>/rlimits/<br />
3. Check your physical memory size on the host, e.g. with "free -m". maxram = kilobytes/pagesize.<br />
4. Limit the guests physical RAM to value smaller then maxram:<br />
<br />
<pre><br />
echo %%insertYourPagesHereSmallerThanMaxram%% > /etc/vserver/<guest>/rlimits/rss<br />
</pre><br />
<br />
5. Check your swapspace, e.g. with 'swapon -s'. maxswap = swapkilobytes/pagesize.<br />
6. Limit the guest's maximum number of as pages to a value smaller than (maxram+maxswap):<br />
<br />
<pre><br />
echo %%desiredvalue%% > /etc/vserver/<guest>/rlimits/as<br />
</pre><br />
<br />
It should be clear this can still lead to OOM situations. Example: You have two guests and your as limit per guest is greater than 50% of (maxram+maxswap). If both guests request their maximum at the same point in time, there will be not enough mem .....|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=Were can I get newer versions of VServer as ready made packages for Debian?||Details=<br />
A: Here you go: http://linux-vserver.derjohn.de/ . There is also some stuff on backports.org, but my kernels are always 'devel' branch.|Signature=derjohn}}<br />
<br />
{{Question|Question=Can I use iptables ?||Details=<br />
Yes but right now only on the host (rootserver). Please realize that all traffic is local and will not touch the forward chain.|Signature=BeginnerFAQ}}<br />
<br />
{{Question|Question=Try to connect to a vserver from the master or another vserver on the same host fails with<br />
:: strace shows:<br />
<pre> <br />
sin_addr=inet_addr("xx.xx.xx.xx")}, yy) = -1 EINVAL (Invalid argument)<br />
</pre><br />
<br />
||Details=<br />
A: The vserver/master cannot communicate with another vserver on same host.<br />
* check all netmasks on all interfaces (do they overlap) ?<br />
* check policy routing (disable it temporary) ?<br />
* check that lo is up (Networking within a host/vserver always uses lo interface)<br />
|Signature=CommonProblems}}<br />
<br />
{{Question|Question=#1 ERROR: capset(): Operation not permitted||Details=capabilities are not enabled in kernel-setup<br />
please check that CONFIG_SECURITY_CAPABILITIES is loaded or included in the kernel. ( check with "cat /path_to_kernel/.config | grep -i cap ")<br />
(2.6.11.5-vs-1.9.5 + 0.30-205)|Signature=IrcQuestions}}<br />
<br />
{{Question|Question=How can I make 'vserver start' mount the root filesystem||Details=<br />
* mount it via /etc/vservers/vserver-name/fstab, make sure to set the option 'dev' e.g.:<br />
<pre>/dev/drbd0 / xfs rw,dev 0 0</pre><br />
* util-vserver 210 won't be able to find some scripts for the reboot, add into /etc/vservers/vserver-name/apps/init/cmd.stop<br />
<pre>/etc/init.d/rc<br />
6</pre><br />
|Signature=AdrianReyer}}</div>AdrianReyerhttp://www.linux-vserver.org/Frequently_Asked_QuestionsFrequently Asked Questions2006-09-18T11:39:35Z<p>AdrianReyer: vserver mounting its own root-fs</p>
<hr />
<div><div style="margin: 2em auto 2em auto; padding: 10px; background-color: #F9ECCD; border: 1px solid #004433; text-align: center;"><br />
[[Image:Icon-Caution.png|left]]<br />
We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the [[Wiki Team]] page for instructions how to help or look at the [http://oldwiki.linux-vserver.org old wiki] to find the information not migrated yet.<br />
<br />
'''To ease migration we created a [[List of old Documentation pages]].'''<br />
</div><br />
<br />
CURRENTLY THE CONTENT OF THE OLD WIKI FAQ (AND MORE) IS BEING MIGRATED TO THIS PAGE (TASK: DERJOHN)<br />
<br />
<br />
__TOC__<br />
<br />
{{Question|Question=What is a 'Guest'?||Details=To talk about stuff, we need some naming. The physical machine is called 'Host' and the 'main' context running the Host Distro is called 'Host Context'. The virtual machine/distro is called 'Guest' and basically is a Distribution (Userspace) running inside a 'Guest Context'.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=What kind of Operating System (OS) can I run as guest?||Details=<br />
A: With VServer you can only run Linux guests. The trick is that a guest does not run a kernel on its own (as XEN and UML do), it merely uses a virtualized host kernel-interface. VServer offers so called security contexts which make it possible to seperate one guest from each other, i.e. they cannot get data from each other. Imagine it as a chroot environment with much more security and features.|Signature=derjohn}}<br />
<br />
{{Question|Question=Which distributions did you test?||Details=<br />
A: Some. Check out the wiki for ready-made guest images. But you can easily build own guest images, e.g. with Debian's debootstrap. Checkout ((step-by-step Guide 2.6)) how to do that.|Signature=derjohn}}<br />
<br />
{{Question|Question=Is VServer comparable to XEN/UML/QEMU?||Details=<br />
A: Nope. XEN/UML/QEMU and VServer are just good friends. Because you ask, you probably know what XEN/UML/QEMU are. VServer in contrary to XEN/UML/QEMU not "emulate" any hardware you run a kernel on. You can run a VServer kernel in a XEN/UML/QEMU guest. This is confirmed to work at least with Linux 2.6/vs2.0.|Signature=derjohn}}<br />
<br />
{{Question|Question=Is VServer secure?||Details=<br />
A: We hope so. It should be as least as secure as Linux is. We consider it much much more secure though.|Signature=derjohn}}<br />
<br />
{{Question|Question=Performance?||Details=<br />
A: For a single guest, we basically have native performance. Some tests showed insignificant overhead (about 1-2%) others ran faster than on an unpatched kernel. This is IMVHO significantly less than other solutions waste, especially if you have more than a single guest (because of the resource sharing).|Signature=derjohn}}<br />
<br />
{{Question|Question=Is SMP Supported?||Details=<br />
A: Yes, on all SMP capable kernel architectures.|Signature=derjohn}}<br />
<br />
{{Question|Question=Resource sharing?||Details=<br />
A: Yes ....<br />
* memory: Dynamically.<br />
* CPU usage: Dynamically (token bucket)|Signature=derjohn}}<br />
<br />
{{Question|Question=Resource limiting?||Details=<br />
A: Yes, you can set maximum limits per guest, but you can only offer guaranteed resource availability with some ticks at the time. There is the possibility to ulimit and to rlimit. Rlimit is a new feature of kernel 2.6/vs2.0.|Signature=derjohn}}<br />
<br />
{{Question|Question=Disk I/O limiting? Is that possible?||Details=<br />
A: Well, since vs2.1.1 linux-vserver supports a mechanism called 'I/O scheduling', which appeared in the 2.6 mainline some time ago. The mainline kernel offers several I/O schedulers:<br />
<br />
<pre><br />
# cat /sys/block/hdc/queue/scheduler<br />
noop [anticipatory] deadline cfq<br />
</pre><br />
<br />
The default is anticipatory a.k.a. "AS". When running several guests on a host you probably want the I/O performance shared in a fair way among the different guests. The kernel comes with a "completely fair queueing" scheduler, CFQ, which can do that. (More on schedulers can be found at http://lwn.net/Articles/114770/)<br />
<br />
This is how to set the scheduler to "cfq" manually:<br />
<pre><br />
root# echo "cfq" > /sys/block/hdc/queue/scheduler<br />
root# cat /sys/block/hdc/queue/scheduler<br />
noop anticipatory deadline [cfq]<br />
</pre><br />
<br />
Keep in mind that you have to do it on all physical discs. So if you run an md-softraid, do it to all physical /dev/hdXYZ discs!<br />
<br />
If you run Debian there is a predefined way to set the /sys values at boot-time:<br />
<br />
<pre><br />
# apt-get install sysfsutils<br />
[...]<br />
<br />
# cat /etc/sysfs.conf | grep cfq<br />
block/sda/queue/scheduler = cfq<br />
block/sdc/queue/scheduler = cfq<br />
<br />
# /etc/init.d/sysfsutils restart<br />
</pre><br />
<br />
For non-vserver processes and CFQ you can set by which key the kernel decides about the fairness:<br />
<br />
<pre><br />
cat /sys/block/hdc/queue/iosched/key_type<br />
pgid [tgid] uid gid<br />
</pre><br />
Hint: The 'key_type'-feature has been removed in the mainline kernel recently. Don't look for it any longer :(<br />
<br />
The default is tgid, which means to share fairly among process groups. Think every guest is treated like a own process group. It's not possible to set a scheduler strategy within a guest. All processes belonging to the same guest are treated like "noop" within the guest. So: If you run apache and some ftp-server within the _same_ guest, there is no fair scheduling between them, but there is fair scheduling between the whole guest and all other guests.<br />
<br />
And: It's possible to tune the scheduler parameters in several ways. Have a look at /sys/block/hdc/queue/....<br />
<br />
You need a very recent Version of VS devel, e.g. the 2.1.1-rc18 can do it. Some older version have that feature too, then it got lost and was reinvented. So: Go and get a rc18 - only in 'devel', not stable!|Signature=derjohn}}<br />
<br />
{{Question|Question=Why isn't there a device /dev/bla? within a guest||Details=<br />
A: Device nodes allow Userspace to access hardware (or virtual resources). Creating a device node inside the guest's namespace will give access to that device, so for security reasons, the number of 'given' devices is small.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is Unification (vunify)?||Details=<br />
A: Unification is Hard Links on Steroids. Guests can 'share' common files (usually binaries and libraries) in a secure way, by creating hard links with special properties (immutable but unlinkable (removable)). The tool to identify common files and to unify them is called vunify.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is vhashify?||Details=<br />
A: The successor of vunify, a tool which does unification based on hash values (which allows to find common files in arbitrary paths.)|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I manage a multi-guest setup with vhashify?||Details=<br />
A: For 'vhashify', just do these once:<br />
<br />
<pre><br />
mkdir /etc/vservers/.defaults/apps/vunify/hash /vservers/.hash<br />
ln -0s /vservers/.hash /etc/vservers/.defaults/apps/vunify/hash/root<br />
</pre><br />
<br />
Then, do this one line per vserver:<br />
<br />
<pre><br />
mkdir /etc/vservers/<vservername>/apps/vunify # vhashify reuses vunify configuration<br />
</pre><br />
<br />
<br />
The command 'ln' creates a link between two files. "ln -s" creates a symbolic link -- two files are linked by name. "ln -0s" uses a Vserver extention to create a unified link.|Signature=derjohn}}<br />
<br />
{{Question|Question=With which VS version should I begin?||Details=<br />
A: If you are new to VServer I recommend to try 2.0.+. Take "alpha utils" Version 0.30.210. In Debian Sid there appeared well running version of it recently. (It's a .210 at the time of writing).|Signature=derjohn}}<br />
<br />
{{Question|Question=is there a way to implement "user/group quota" per VServer?||Details=<br />
A: Yes, but not on a shared partition for now. You need to put the guest on a separate partition, setup a vroot device (to make the quota access secure), copy that into the guest, and adjust the mtab line inside the guest.|Signature=derjohn}}<br />
<br />
{{Question|Question=what about "Quota" for a context?||Details=<br />
A: Context quotas are now called Disk Limits (so that we can tell them apart from the user/group quotas :). They are supported out of the box (with vs2.0) for all major filesystems (Ext2/3, ReiserFS, XFS, JFS)|Signature=derjohn}}<br />
<br />
{{Question|Question=Does it support IPv6?||Details=<br />
A: Currently not. Some developer has to move his ... to reimplement this functionality from the V4 code (I read that on the ML ;)). Will probably be superseded by the ngnet (next generation networking) soon. There is a Wiki page regarding this: http://linux-vserver.org/IPv6|Signature=derjohn}}<br />
<br />
{{Question|Question=I can't do all I want with the network interfaces inside the guest?||Details=<br />
A: For now the networking is 'Host Business' -- the host is a router, and each guest is a server. You can set the capability ICMP_RAW in the context of the guest, or even the capability CAP_NET_RAW (which would even allow to sniff interfaces of other guests!). Likely to change with ngnet. |Signature=derjohn}}<br />
<br />
{{Question|Question=Is there a web-based interface for vserver that will allow creation/deletion/configuration etc. of vserver guests?||Details=<br />
A. [Update] Errrh, there is http://OpenVPS.org which is a set of scripts with a web-interface for webhosters/ISPs. <br />
A. [Update] Errrh, there is http://Openvcp.org which is a distributed system (agent!) with a web-interface, with which you can build/remove guests! cool stuff! beta, try out!|Signature=derjohn}}<br />
<br />
{{Question|Question=What is old-style and new-style config?||Details=<br />
A. Old-style config refers to a single text-file that contains all the configuration settings. With new-style config the configuration is split into several directories and files. You should probably go for new-style config if you are asking.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is the "great flower page"?||Details=<br />
A. Well, this page contains all configation options for vserver in version > 1.9 (I think .. I joined Linux-VServer in version 2, so I don't know for sure). The name of the page is derivived from the stylesheet(s) it contains: It displays background pictures of a very great flower, so regard it as highly optimized. It was designed by a non-designer, who asks us to create a better one. I played with the thought of creating a complete new theme for that page - but actually we all got used to the name "great flower page", so we stick to it. If you are unable to read it clearly, feel invited to join the IRC channel #vserver, we may tell you how to ;)|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I add several IPs to a vserver? ||Details=<br />
A: First of all a single guest vserver only supports up to 16 IPs (There is a 64-IP patch available, which is in "derjohn's kernel", you need extra util-vserver anyway).<br />
Here is a little helper-script that adds a list of IPs defined in a text file, one per line.<br />
<pre><br />
#!/bin/bash<br />
j=1<br />
for i in `cat myiplist`; do<br />
j=$(($j+1))<br />
mkdir $j<br />
echo $i > $j/ip<br />
echo $i > $j/ip-old<br />
echo "24" > $j/prefix<br />
done<br />
</pre>|Signature=derjohn}}<br />
<br />
{{Question|Question=If my host has only one a single public IP, can I use RFC1918 IP (e.g. 192.168.foo.bar) for the guest vservers?||Details=<br />
A: Yes, use iptables with SNAT to masquerade it. <br />
<pre><br />
iptables -t nat -I POSTROUTING -s $VSERVER_NETZ ! -d $VSERVER_NETZ -j SNAT --to $EXT_IP<br />
</pre><br />
See: HowtoPrivateNetworking and <br />
http://www.tgunkel.de/it/software/doc/linux_server#h3-Vserver_Masquerading_SNAT (THX, [MUPPETS]Gonzo)|Signature=derjohn}}<br />
<br />
{{Question|Question=If I shut down my vserver guest, the whole Internet interface ethX on the host is shut down. What happened? ||Details=<br />
A: When you shut down a guest (i.e. {{vserver foo stop}}), the IP is brought down on the host also. If this IP happens to be the primary IP of the host, the kernel will not only bring down the primary IP, but also all secondary IP addresses. But in very recent kernels, there is an option {{settable}} which prevents that nasty feature. It's called "alias promotion". You may set it via sysctl by adding {{net.ipv4.conf.all.promote_secondaries=1}} in /etc/sysctl.conf or via sysctl command line.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=On Debian Sarge (stable) only util-vserver is 0.30-204 available, which has been reported to be buggy (I didnt check the version for longer time) How do I compile a local version of alpha util-vserver .210 on Debian?||Details=<br />
A:<br />
<pre><br />
apt-get build-dep util-vserver<br />
<br />
./configure --prefix=/usr/local/ --enable-release \<br />
--mandir=/usr/local/share/man \<br />
--infodir=/usr/local/share/info \<br />
--sysconfdir=/etc --enable-dietlibc \<br />
--localstatedir=/var \<br />
--with-vrootdir=/var/lib/vservers<br />
<br />
make<br />
<br />
make install-distribution<br />
(Which does a make install + setting a symlink ln -s /usr/local/lib/util-vserver/vshelper /sbin/vshelper )<br />
<br />
</pre><br />
<br />
To test which version you are running:<br />
<pre><br />
# which vserver<br />
/usr/local/sbin/vserver<br />
<br />
</pre><br />
<br />
This should point to ..local...<br />
<br />
If you dont want to build it yourself: On www.backports.org there are backported (for sarge) linux-images (2.6.16) with vserver-patch enabled and a updated util-vserver package as well.<br />
|Signature=derjohn}}<br />
<br />
{{Question|Question=I use derjohn's kernel or a differnet kernel with a more-than-16-IPs-per-guest-patch and can't use more than 16 IPs. Why?||Details=<br />
A: You need to patch util-vserver, too. So you obviously need to recompile util-vserver (see above). In the util-vserver directory there are header files in the ./kernel/ directory. Patch like this:<br />
<br />
<pre><br />
kernel/network.h:#define NB_IPV4ROOT 64<br />
</pre><br />
<br />
BTW: The initial patches can be found here: http://vserver.13thfloor.at/Experimental/VARIOUS/util-vserver-0.30.196-net64.diff.bz2 and http://vserver.13thfloor.at/Experimental/VARIOUS/delta-2.6.9-vs1.9.3-net64.diff<br />
|Signature=unknown}}<br />
<br />
{{Question|Question=I run a Debian host and want to build an Ubuntu guest. Howto?||Details=<br />
A: Simple ;) Assume you want to build a breezy guest on a sid host with IP 192.168.0.2 and hostname vubuntu, then do:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu<br />
</pre><br />
<br />
[UPDATE] Currently there are problems in building breezy under unclear circumstances, which seems to have to do with udev. If the above didnt work, try:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu -- --exclude=udev<br />
</pre><br />
In very recent versions of the utils, the problem should not occur anymore (it has to do with the 'secure-mount' if you look in the MLs)<br />
<br />
Well, sid's debootstrap knows how to bootstrap Ubuntu linux. Make sure to have a current debootstrap package: <br />
<pre><br />
apt-get update<br />
apt-get install debootstrap<br />
</pre><br />
The knowledge how to build ubuntu 'breezy badger' (which you probably want to be your guest at the time of writing) has been added recently.|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I make a vserver guest start by default?||Details=<br />
A: At least on Debian, I can tell you how to do it with the new-style config. If your guest is called "derjohn" and you want it to be started somewhere at the of your bootstrap process, then do:<br />
<pre><br />
echo "default" > /etc/vservers/derjohn/apps/init/mark<br />
</pre><br />
If you want to start it earlier, please read the init script "/etc/init.d/vserver-default" to find out how to do it. In most cases you don't need to change this. On Debian the vservers are started at "90", so after most other stuff is up (networking etc.).<br />
<br />
Besides that I created a small helper script for managing the autostart foo: ((vserver-autostart))|Signature=derjohn}}<br />
<br />
{{Question|Question=My host works, but when I start a guest it says that it has a problem with chbind.||Details=<br />
A: You are probably using util-vserver <= 0.30.209, which does use dynamic network contexts internally (With 0.30.210 this fact changed). So if you compiled your kernel without dynamic contexts, you may start guests, but you can't use the network context.The solution is either to switch to .210 util (or Hollow's toolset) or compile the kernel with dynamic network contexts.<br />
SE Keyword: invalid option `nid' testme.sh|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=When I try to ssh to the guest, I log into the host, even if I installed sshd on the guest. What's wrong here?||Details=<br />
A: Look at /etc/ssh/sshd_config of the host:<br />
<br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
#ListenAddress ::<br />
</pre><br />
<br />
And now change the setting to <br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
ListenAddress your.hosts.ip.here # not the guests IP! <br />
</pre><br />
<br />
Then '/etc/init.d/ssh restart' on the host, after that on the guest (if you did apt-get install ssh on the guest already.)<br />
<br />
Do I have to explain more? If the hosts sshd binds all available IP addresses on port 22 (The hosts 'sees' even all addresses of the guests!). So if the guest starts its sshd, it cant bind to port 22 any more. You need to change that setting only on the host. <br />
(BTW: A similar approach has to be done for a lot of daemons, e.g. Apache. If the daemon does not support an explicit bind, you may use the chbind command to 'hide' IP addresses from the daemon before starting.)|Signature=derjohn}}<br />
<br />
{{Question|Question=I did everything right, but the application foo does not start. What's up there?||Details=<br />
A: Before asking on the IRC channel, please check out the 'problematic programs' page:<br />
((ProblematicPrograms))|Signature=derjohn}}<br />
<br />
{{Question|Question=Bind9 does not like to start in my guest.||Details=<br />
A: Check out the 'problematic programs' page:<br />
((ProblematicPrograms)) and/or get my [((ProblematicPrograms)) and/or get my [http://linux-vserver.derjohn.de/bind9-packages/bind9-capacheck_9.3.2-2_i386.deb vserver-guest-ready Debian package] for Debian Sid guests from that URL: http://linux-vserver.derjohn.de/bind9-packages/bind9-capacheck_9.3.2-2_i386.deb and check out the [http://linux-vserver.derjohn.de/bind9-packages/README.txt readme]. (Hint: This is fresh stuff. The give me Feedback)<br />
<br />
[UPDATE] Since VServer Devel 2.1.1-rc18 you do not need to patch the userland tools anymore. The capabilities are masked.|Signature=derjohn}}<br />
<br />
{{Question|Question=Which guest vservers are running?||Details=<br />
A: {{vserver-stat}}. Example output:<br />
<pre><br />
CTX PROC VSZ RSS userTIME sysTIME UPTIME NAME<br />
0 77 965.1M 334.6M 14m14s18 2m28s69 1h33m46 root server<br />
49152 7 14M 5.2M 0m00s40 0m00s30 1h30m15 chiffon<br />
</pre>|Signature=derjohn}}<br />
<br />
<br />
<br />
{{Question|Question=How can I reboot/halt guests?||Details=<br />
A: It depends. <br />
For vserver with legacy-interfaces support, you have to replace {{/sbin/halt}} in guests with vreboot and start rebootmgr in host. You also need to have a dummy <guest>.conf file in /etc/vservers for each guest. Please have a look at /etc/init.d/rebootmgr.<br />
Vserver with native interface utilizes /dev/initctl. No changes are needed in guests. Just make sure that REBOOT capability is adjusted in guests.|Signature=derjohn}}<br />
<br />
{{Question|Question=Do I really need the legacy-interfaces? What are these legacy-interfaces?||Details=<br />
A: Since vserver is an ongoing project, new features might replace old ones, some might still on development. Legacy-interfaces are available for backward compability (which might be removed someday). See Q: How can I reboot/halt guests?|Signature=derjohn}}<br />
<br />
{{Question|Question= I have a vserver running on a Linux kernel with preemption. Is VServer "preempt" safe?||Details=<br />
A: There are no known issues about running vserver on a preemption enabled kernel. I would like to add, that the vserver kernelhackers would probably exclude that option in 'make menuconfig' if there would be an incompatibility. Just my $.02 :)|Signature=derjohn}}<br />
<br />
{{Question|Question=Is this a new project? When was it started?||Details=<br />
A: The first public occurance of linux-vserver was Oct 2001. The initial mail can be found here: http://www.cs.helsinki.fi/linux/linux-kernel/2001-40/1065.html<br />
So you can expect a mature software product wich does it's magic quite well (And hey, we have a version > 2.0 ! )|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=Can I run an OpenVPN Server in a guest?||Details=<br />
A: Yes. I don't want to provide an in-depth OpenVPN tutorial, but want to show how I made OpenVPN work in a guest as server. I was not able to run it with a tun devive, due to a buglet in util-vserver and kernel when it comes to settings a an ip address a point to point link: If you add "ip addr add <ip> peer <mypeer> dev tun0" there is no way to map the tun0 interface into a guest, even not with a 'nodev' option. (bug confirmed to be reproducible by daniel_hoczac)<br />
<br />
First of all you have to prepare the host with a persistent tuntap interface in tap-mode. The tools we need come from the uml-utilities.<br />
Then you need to create a device /dev/net/tun, which the OpenVPN userspace daemon reads. Well assume 10.10.10.100 is the server IP, and 10.10.10.101 is the client ip - to be cool be choose a /31 netmask (255.255.255.254), so we have a net without broadcast and don't waste IPs :)<br />
<br />
On the host do: <br />
<pre><br />
# apt-get install uml-utilities<br />
# cd /var/lib/vserver/<myopenvpnserver>/dev/<br />
# ./MAKEDEV tun<br />
(creates the dev/net/tun device accessible by te guest - even a tap interface need /dev/net/tun !)<br />
# tunctl -t tap0<br />
(creates the network device 'tap0' persistently)<br />
</pre><br />
<br />
Then add the ip to the guest:<br />
<pre><br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/ip<br />
10.10.10.100<br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/prefix<br />
31<br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/dev<br />
tap0<br />
(This kind of config brings the ip when the vserver is started - only the tap0 interface has to exist already, see above!)<br />
</pre><br />
<br />
Here is a sample config for the guest (which is acting as a server):<br />
<br />
Install OpenVPN package on server and client, in the Debian case:<br />
<pre><br />
# apt-get install openvpn<br />
</pre><br />
<br />
The server's conf looks like that:<br />
<pre><br />
# port and interface specs<br />
<br />
# behave like a ssl-webserver<br />
port 443<br />
proto tcp-server<br />
<br />
# tap device? (keep in mind you need /dev/net/tun !)<br />
dev tap0<br />
<br />
# now the ips we will use for the tunnel<br />
ifconfig 10.10.10.100 255.255.255.254<br />
ifconfig-noexec<br />
<br />
# the server part<br />
<br />
# Keep VPN connections, even if the client IP changes<br />
float<br />
<br />
# use compression (may also even obfuscate content filters)<br />
comp-lzo<br />
<br />
# use a static key - create it with 'openvpn --genkey --secret static.key'<br />
secret static.key<br />
<br />
# dont reload the key after a SIGUSR1<br />
persist-key<br />
<br />
# check alive all 10 secs<br />
keepalive 10 60<br />
<br />
# verbosity level (from 1 to 9, 9 is max log level)<br />
verb 4<br />
status openvpn-status.log<br />
</pre><br />
<br />
The client's conf may look like that (This example even makes the tunnel the clients default address):<br />
<pre><br />
# cat /etc/openvpn/client.conf<br />
# port and interface specs<br />
<br />
# the following is not necessary, if you bring up openvpn via Debian's init script:<br />
daemon ovpn-my-clients-name<br />
<br />
# behave like a ssl-webserver<br />
port 443<br />
proto tcp-client<br />
remote %%%<insert-the-guest-primary-public-ip-here>%%%%<br />
# what device tun ot tap?<br />
dev tap<br />
<br />
# now the ips we will use for the tunnel<br />
ifconfig 10.10.10.101 255.255.255.254<br />
<br />
# Keep VPN connections, even if the client IP changes<br />
float<br />
mssfix<br />
<br />
# use compression (may also even obfuscate content filters)<br />
comp-lzo<br />
<br />
# use a static key<br />
secret static.key<br />
<br />
# dont reload the key after a SIGUSR1<br />
persist-key<br />
<br />
# check alive all 10 secs<br />
keepalive 10 60<br />
<br />
# verbosity level (from 1 to 9, 9 is max log level)<br />
verb 4<br />
<br />
# set the default route<br />
route-gateway 10.10.10.100<br />
redirect-gateway def1<br />
# to add special routes you can do it wihtin the openvpn client conf:<br />
# route <dest> <mask> <gateway><br />
<br />
# if you need to connect via proxy (like squid)<br />
# http-proxy s p [up] [auth] : Connect to remote host through an HTTP proxy at<br />
# address s and port p. If proxy authentication is required,<br />
# up is a file containing username/password on 2 lines, or<br />
# 'stdin' to prompt from console. Add auth='ntlm' if<br />
# the proxy requires NTLM authentication.<br />
<br />
# http-proxy s p [up] [auth]<br />
<br />
<br />
# http-proxy-option type [parm] : Set extended HTTP proxy options.<br />
# Repeat to set multiple options.<br />
# VERSION version (default=1.0)<br />
# AGENT user-agent<br />
<br />
# http-proxy-option type [parm]<br />
</pre><br />
<br />
In the next lesson I will talk about OpenVPN's server mode, which can deal with with multiple clients connecting to one ip and one port (i.e. you only need one guest for tons or 'roadwarriros'), tls connections and pki.<br />
<br />
Contributions welcome. :)|Signature=derjohn}}<br />
<br />
{{Question|Question=32 vs 64 Bit? What should I take?||Details=<br />
A: If you have the choice make the host a 64 bit one. You can run a guest as 32 bit or as 64 bit on a 64 bit host. To run it as 32 bit, you need to compile the x86_64 (a.k.a. AMD64) with the following options:<br />
<br />
<pre><br />
[*] Kernel support for ELF binaries<br />
<M> Kernel support for MISC binaries<br />
[*] IA32 Emulation <---- without that, the entire 32bit API is not present<br />
<M> IA32 a.out support <br />
</pre><br />
<br />
You can force the guest to behave like a 32 environment like this:<br />
<pre><br />
echo linux_32bit > /etc/vservers/$NAME/personality<br />
echo i686 > /etc/vservers/$NAME/uts/machine<br />
</pre><br />
(thanks cehteh for the hint!)<br />
<br />
But you can force debootstrap to but 32 bit binaries into the guest by 'export ARCH=i386';<br />
<pre><br />
export ARCH=i386 ; vserver build .... <br />
</pre>|Signature=derjohn}}<br />
<br />
{{Question|Question=I want to (re)mount a partition in a running guest ... but the guest has no rights (capability) to (re)mount?||Details=<br />
A: I'll explain. I take as example your /tmp partition within the guest is too small, what will be likely the case if you stay with the 16MB default (vserver build mounts /tmp as 16 MB tempfs!).<br />
<pre><br />
# vnamespace -e XID mount -t tmpfs -o remount,size=256m,mode=1777 none /var/lib/vservers/<guest>/tmp/<br />
</pre><br />
Be warned that the guest will not recognize the change, as the /etc/mtab file is not updated when you mount like this. To permanently change the mount, edit /etc/vserver/<guest>/fstab on the host.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=How do I limit a guests RAM? I want to prevent OOM situations on the host!||Details=<br />
A: First you can read [http://linux-vserver.org/Memory+Allocation].<br />
If you want a recipe, do that:<br />
1. Check the size of memory pages. On x86 and x86_64 is usually 4 KB per page.<br />
2. Create /etc/vserver/<guest>/rlimits/<br />
3. Check your physical memory size on the host, e.g. with "free -m". maxram = kilobytes/pagesize.<br />
4. Limit the guests physical RAM to value smaller then maxram:<br />
<br />
<pre><br />
echo %%insertYourPagesHereSmallerThanMaxram%% > /etc/vserver/<guest>/rlimits/rss<br />
</pre><br />
<br />
5. Check your swapspace, e.g. with 'swapon -s'. maxswap = swapkilobytes/pagesize.<br />
6. Limit the guest's maximum number of as pages to a value smaller than (maxram+maxswap):<br />
<br />
<pre><br />
echo %%desiredvalue%% > /etc/vserver/<guest>/rlimits/as<br />
</pre><br />
<br />
It should be clear this can still lead to OOM situations. Example: You have two guests and your as limit per guest is greater than 50% of (maxram+maxswap). If both guests request their maximum at the same point in time, there will be not enough mem .....|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=Were can I get newer versions of VServer as ready made packages for Debian?||Details=<br />
A: Here you go: http://linux-vserver.derjohn.de/ . There is also some stuff on backports.org, but my kernels are always 'devel' branch.|Signature=derjohn}}<br />
<br />
{{Question|Question=Can I use iptables ?||Details=<br />
Yes but right now only on the host (rootserver). Please realize that all traffic is local and will not touch the forward chain.|Signature=BeginnerFAQ}}<br />
<br />
{{Question|Question=Try to connect to a vserver from the master or another vserver on the same host fails with<br />
:: strace shows:<br />
<pre> <br />
sin_addr=inet_addr("xx.xx.xx.xx")}, yy) = -1 EINVAL (Invalid argument)<br />
</pre><br />
<br />
||Details=<br />
A: The vserver/master cannot communicate with another vserver on same host.<br />
* check all netmasks on all interfaces (do they overlap) ?<br />
* check policy routing (disable it temporary) ?<br />
* check that lo is up (Networking within a host/vserver always uses lo interface)<br />
|Signature=CommonProblems}}<br />
<br />
{{Question|Question=#1 ERROR: capset(): Operation not permitted||Details=capabilities are not enabled in kernel-setup<br />
please check that CONFIG_SECURITY_CAPABILITIES is loaded or included in the kernel. ( check with "cat /path_to_kernel/.config | grep -i cap ")<br />
(2.6.11.5-vs-1.9.5 + 0.30-205)|Signature=IrcQuestions}}<br />
<br />
{{Question|Question=How can I make 'vserver start' mount the root filesystem||Details=<br />
* mount it via /etc/vservers/vserver-name/fstab, make sure to set the option 'dev' e.g.:<br />
<pre>/dev/drbd0 / xfs rw,dev 0 0</pre><br />
* util-vserver 210 won't be able to find some scripts for the reboot, add into /etc/vservers/vserver-name/apps/init/cmd.stop<br />
<pre>/etc/init.d/rc<br />
6</pre><br />
}}</div>AdrianReyer