Difference between revisions of "Sandbox"

From Linux-VServer

Jump to: navigation, search
Line 1: Line 1:
<div style="margin: 2em auto 2em auto; padding: 10px; background-color: #F9ECCD; border: 1px solid #004433; text-align: center;">
 
[[Image:Icon-Caution.png|left]]
 
We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the [[Wiki Team]] page for instructions how to help or look at the [http://oldwiki.linux-vserver.org old wiki] to find the information not migrated yet.
 
 
'''To ease migration we created a [[List of old Documentation pages]].'''
 
</div>
 
 
CURRENTLY THE CONTENT OF THE OLD WIKI FAQ (AND MORE) IS BEING MIGRATED TO THIS PAGE (TASK: DERJOHN)
 
  
  
Line 23: Line 15:
 
||Details=With VServer you can only run Linux guests. The trick is that a guest does not run a kernel on its own (as XEN and UML do), it merely uses a virtualized host kernel-interface. VServer offers so called security contexts which make it possible to seperate one guest from each other, i.e. they cannot get data from each other. Imagine it as a chroot environment with much more security and features.
 
||Details=With VServer you can only run Linux guests. The trick is that a guest does not run a kernel on its own (as XEN and UML do), it merely uses a virtualized host kernel-interface. VServer offers so called security contexts which make it possible to seperate one guest from each other, i.e. they cannot get data from each other. Imagine it as a chroot environment with much more security and features.
 
|Signature=derjohn}}
 
|Signature=derjohn}}
 
{{Question
 
|Question=Is this a new project? When was it started?
 
||Details=The first public occurrence of Linux-VServer was Oct 2001. The initial mail can be found here: http://www.cs.helsinki.fi/linux/linux-kernel/2001-40/1065.html
 
So you can expect a mature software product which does its magic quite well (And hey, we have a version > 2.0!)
 
|Signature=derjohn}}
 
 
{{Question
 
|Question=Which distributions did you test?
 
||Details=Some. Check out the wiki for ready-made guest images. But you can easily build own guest images, e.g. with Debian's debootstrap. Checkout [[Building Guest Systems]] how to do that.
 
|Signature=derjohn}}
 
 
{{Question
 
|Question=Is VServer comparable to XEN/UML/QEMU?
 
||Details=Nope. XEN/UML/QEMU and VServer are just good friends. Because you ask, you probably know what XEN/UML/QEMU are. VServer in contrary to XEN/UML/QEMU not "emulate" any hardware you run a kernel on. The purpose of Linux VServer is to isolate (groups of) applications. The isolation is done by the kernel (see [[Overview]] for a more detailed comparison). You can run a VServer kernel in a XEN/UML/QEMU guest. This is confirmed to work at least with Linux 2.6/vs2.0.
 
|Signature=derjohn}}
 
 
{{Question
 
|Question=With which version should I begin?
 
||Details=If you are new to VServer I recommend to try the latest stable kernel patch, and the latest util-vserver "alpha" release.
 
|Signature=derjohn}}
 
 
{{Question
 
|Question=Is VServer secure?
 
||Details=We hope so. It should be as least as secure as Linux is. We consider it much much more secure though.
 
|Signature=derjohn}}
 
 
{{Question
 
|Question=Performance?
 
||Details=For a single guest, we basically have native performance. Some tests showed insignificant overhead (about 1-2%) others ran faster than on an unpatched kernel. This is IMVHO significantly less than other solutions waste, especially if you have more than a single guest (because of the resource sharing).
 
|Signature=derjohn}}
 
 
 
{{Question
 
|Question=What is the "great flower page"?
 
||Details=Well, [http://www.nongnu.org/util-vserver/doc/conf/configuration.html this page] contains all configuration options for util-vserver. The name of the page is derived from the stylesheet(s) it contains.
 
|Signature=derjohn}}
 
 
 
  
 
== Resources usage ==
 
== Resources usage ==
Line 80: Line 33:
 
Note that you can only offer guaranteed resource availability with some ticks at the time.
 
Note that you can only offer guaranteed resource availability with some ticks at the time.
 
|Signature=derjohn&xm}}
 
|Signature=derjohn&xm}}
 
{{Question
 
|Question=How do I limit a guests RAM? I want to prevent OOM situations on the host!
 
||Details=First you can read [http://linux-vserver.org/Memory+Allocation] and [[Memory Limits]].
 
If you want a recipe, do this:
 
# Check the size of memory pages. On x86 and x86_64 is usually 4 KB per page.
 
# Create /etc/vserver/<guest>/rlimits/
 
# Check your physical memory size on the host, e.g. with "free -m". maxram = kilobytes/pagesize.
 
# Limit the guests physical RAM to value smaller then maxram:<pre>echo %%insertYourPagesHereSmallerThanMaxram%% > /etc/vserver/<guest>/rlimits/rss </pre>
 
# Check your swapspace, e.g. with 'swapon -s'. maxswap = swapkilobytes/pagesize.
 
# Limit the guest's maximum number of as pages to a value smaller than (maxram+maxswap): <pre> echo %%desiredvalue%% > /etc/vserver/<guest>/rlimits/as </pre>
 
It should be clear this can still lead to OOM situations. Example: You have two guests and your as limit per guest is greater than 50% of (maxram+maxswap). If both guests request their maximum at the same point in time, there will be not enough mem .....
 
|Signature=derjohn}}
 
 
 
{{Question
 
|Question=Disk I/O limiting? Is that possible?
 
||Details=Well, since vs2.1.1 Linux-VServer supports a mechanism called 'I/O scheduling', which appeared in the 2.6 mainline some time ago. The mainline kernel offers several I/O schedulers:
 
<pre>
 
# cat /sys/block/hdc/queue/scheduler
 
noop [anticipatory] deadline cfq
 
</pre>
 
 
The default is anticipatory a.k.a. "AS". When running several guests on a host you probably want the I/O performance shared in a fair way among the different guests. The kernel comes with a "completely fair queueing" scheduler, CFQ, which can do that. (More on schedulers can be found at http://lwn.net/Articles/114770/)
 
This is how to set the scheduler to "cfq" manually:
 
<pre>
 
root# echo "cfq" > /sys/block/hdc/queue/scheduler
 
root# cat /sys/block/hdc/queue/scheduler
 
noop anticipatory deadline [cfq]
 
</pre>
 
Keep in mind that you have to do it on all physical discs. So if you run an md-softraid, do it to all physical /dev/hdXYZ discs!
 
If you run Debian there is a predefined way to set the /sys values at boot-time:
 
<pre>
 
# apt-get install sysfsutils
 
[...]
 
 
# grep cfq /etc/sysfs.conf
 
block/sda/queue/scheduler = cfq
 
block/sdc/queue/scheduler = cfq
 
 
# /etc/init.d/sysfsutils restart
 
</pre>
 
 
For non-vserver processes and CFQ you can set by which key the kernel decides about the fairness:
 
<pre>
 
cat /sys/block/hdc/queue/iosched/key_type
 
pgid [tgid] uid gid
 
</pre>
 
Hint: The 'key_type'-feature has been removed in the mainline kernel recently. Don't look for it any longer :(
 
 
The default is tgid, which means to share fairly among process groups. Think every guest is treated like a own process group. It's not possible to set a scheduler strategy within a guest. All processes belonging to the same guest are treated like "noop" within the guest. So: If you run apache and some ftp-server within the _same_ guest, there is no fair scheduling between them, but there is fair scheduling between the whole guest and all other guests.
 
 
And: It's possible to tune the scheduler parameters in several ways. Have a look at /sys/block/hdc/queue/....
 
|Signature=derjohn}}
 
 
{{Question
 
|Question=Nice disk I/O scheduling, is that possible?
 
||Details=Well, since linux 2.6.13 processess have another priority next to the cpu nice scheduling hint, it's called io nice.
 
It's split into three groups, called real-time, best effort and idle. The default is best-effort, but within best-effort, you can have a niceness from 0 to and including 7.
 
You can set this niceness by the tool ionice, which for debian is either in the package util-linux or schedutils.
 
To change the io-niceness you need the <tt>CAP_SYS_NICE</tt>, '''and''' need to have the same uid as the processe you want to ionice.
 
 
:'''Note:''' If you want to use any schedulung other than best-effort you will also need the <tt>CAP_SYS_ADMIN</tt>-flag. Be warned that this gives quite some capabilities to the vserver, not just for I/O scheduling!
 
 
If you want to increase the niceness of an I/O hogging process within a vserver you need to do:
 
<PRE>
 
chcontext --xid sponlp1 sudo -u '#2089' ionice -c2 -n5 -p24409
 
</PRE>
 
with sudo and ionice installed on the root server to increase the *nice*ness of pid 24409, with uid 2089
 
|Signature=Groteblup}}
 
 
== Unification ==
 
 
{{Question
 
|Question=What is unification (vunify)?
 
||Details=Unification is Hard Links on Steroids. Guests can 'share' common files (usually binaries and libraries) in a secure way, by creating hard links with special properties (immutable but unlinkable (removable)). The tool to identify common files and to unify them is called vunify.
 
|Signature=derjohn}}
 
 
{{Question
 
|Question=What is vhashify?
 
||Details=The successor of vunify, a tool which does unification based on hash values (which allows to find common files in arbitrary paths.)
 
It creates hardlinks to files named after a hash of the content of the file. If you have a recent version of the vserver patch (2.2+), with CONFIG_VSERVER_COWBL enabled, you can even modify the hardlinked files inside the vservers and the links will be broken automatically.
 
There seems to be a catch when a hashified file has multiple hardlinks inside a guest, or when another internal hardlink is added after hashification. Link breaking will remove all the internal hardlinks too, so the guest will end up with different copies of the original file. The correct solution would be to not hashify files that have multiple links prior to hashification, and to break the link to the hashified version when a new internal hardlink is created. Apparently, this is not implemented yet (?).
 
|Signature=Guy-}}
 
 
{{Question
 
|Question=How do I manage a multi-guest setup with vhashify?
 
||Details=For 'vhashify', just do these once:
 
<pre>
 
mkdir /etc/vservers/.defaults/apps/vunify/hash /vservers/.hash
 
ln -s /vservers/.hash /etc/vservers/.defaults/apps/vunify/hash/root
 
</pre>
 
Then, do this one line per vserver:
 
<pre>
 
mkdir /etc/vservers/<vservername>/apps/vunify  # vhashify reuses vunify configuration
 
</pre>
 
To hashify a running vserver, do (possibly from a cronjob):
 
<pre>
 
vserver name-of-guest hashify
 
</pre>
 
 
The guest needs to be running because vhashify tries to figure out what files not to hashify by calling the package manager of the guest via <tt>vserver enter</tt>.
 
 
In order for the OS cache to benefit from the hardlinking, you'll have to restart the vservers.
 
 
To clean up hashified files that are no longer referenced by any vserver, do (possibly from a cronjob):
 
<pre>
 
find /vservers/.hash -type f -links 1 -print0 | xargs -0 rm
 
</pre>
 
 
Until you do this, the files still take up place even though no vservers need them.
 
|Signature=Guy-}}
 
 
== Filesystem usage ==
 
 
{{Question
 
|Question=Is there a way to implement "user/group quota" per VServer?
 
||Details=Yes, but not on a shared partition for now. You need to put the guest on a separate partition, setup a vroot device (to make the quota access secure), copy that into the guest, and adjust the mtab line inside the guest.
 
|Signature=derjohn}}
 
 
{{Question
 
|Question=What about "Quota" for a context? Howto limit disk usage?
 
||Details=Context quotas are now called Disk Limits (so that we can tell them apart from the user/group quotas :). They are supported out of the box (with vs2.0+) for all major filesystems (ext2/3, ReiserFS, JFS). You need to tag the FS with XID (see below). Please read [[Disk Limits and Quota]] for more information.
 
|Signature=derjohn}}
 
 
{{Question
 
|Question=How do I tag a guest's directory with xid?
 
||Details=Tagging the guest's files gives you serveral advantages, e.g. the accouting will work properly.
 
Filesystem XID tagging only works on supported filesystem. Those are currently: ext2/3, reiserfs/reiser3, xfs and jfs.
 
To activate the XID tagging you have to mount the filesystem with "-o tag" (former tagxid is outdated since VS2.2). Attention: It's _not_ possible to "-o remount,tag", you have to mount it freshly. The guests will tag their files automatiaclly. If you copy files in from the host, you have to tag them manually like this:
 
<pre>
 
chxid -c xid -R /var/lib/vservers/<guest>
 
</pre>
 
Note: Context 0 and 1 will see all files, guests will only be able to access untagged files and their own XID. They can see other XID files but no information about the file, e.g. no owner, no group, no permissions.
 
Note: It is not advised to tag the root filesystem, as [http://www.paul.sladen.org/vserver/archives/200602/0020.html explained by Herbert] : trying to do so will expose you to some troubles !
 
|Signature=derjohn_and_gonzo_and_are}}
 
 
 
== Network ==
 
 
{{Question
 
|Question=Does it support IPv6?
 
||Details=Currently it requires an additional patch, but the functionality should be available in 2.3+ soon. [[IPv6]] has more information.
 
|Signature=derjohn}}
 
 
{{Question
 
|Question=I can't do all I want with the network interfaces inside the guest?
 
||Details=For now the networking is 'Host Business' -- the host is a router, and each guest is a server. You can set the capability ICMP_RAW in the context of the guest, or even the capability CAP_NET_RAW (which would even allow to sniff interfaces of other guests!). Likely to change with ngnet.
 
|Signature=derjohn}}
 
 
{{Question
 
|Question=How do I add several IPs to a vserver?
 
||Details=First of all a single guest vserver only supports up to 16 IPs (There is a 64-IP patch available, which is in "derjohn's kernel").
 
Here is a little helper-script that adds a list of IPs defined in a text file, one per line.
 
<pre>
 
#!/bin/bash
 
j=1
 
for i in `cat myiplist`; do
 
        j=$(($j+1))
 
        mkdir $j
 
        echo $i > $j/ip
 
        echo "24" > $j/prefix
 
done
 
</pre>
 
|Signature=derjohn}}
 
 
{{Question
 
|Question=How do I assign a new IP address to a running guest?
 
||Details=This is done from the host server:
 
* add the ip on the host, for example
 
<pre>
 
ip addr add 194.169.123.23/24 dev eth0
 
</pre>
 
* add the ip to the guest's network context (a guests NID is the same as the XID {context ID})
 
<pre>
 
naddress --add --nid <nid> --ip 194.169.123.23/24
 
</pre>
 
* enter the guest (best via ssh)
 
* restart the services that need to make use of the new address if required
 
* update the config in ''/etc/vserver/<servername>/interfaces'' to reflect the changes for the next guest restart (if desired)
 
|Signature=BenjaminGreen}}
 
 
{{Question
 
|Question=If my host has only one a single public IP, can I use RFC1918 IP (e.g. 192.168.foo.bar) for the guest vservers?
 
||Details=Yes, use iptables with SNAT to masquerade it.
 
<pre>
 
iptables -t nat -I POSTROUTING -s $VSERVER_NETZ  ! -d $VSERVER_NETZ -j SNAT --to $EXT_IP
 
</pre>
 
See: [[HowtoPrivateNetworking]] and
 
http://www.tgunkel.de/it/software/doc/linux_server.en#h3-VServer_Masquerading_SNAT (THX, [MUPPETS]Gonzo)
 
|Signature=derjohn}}
 
 
{{Question
 
|Question=If I shut down my vserver guest, the whole Internet interface ethX on the host is shut down.  What happened?
 
||Details=When you shut down a guest (''i.e. vserver foo stop''), the IP is brought down on the host also. If this IP happens to be the primary IP of the host, the kernel will not only bring down the primary IP, but also all secondary IP addresses. But in very recent kernels, there is an option ''settable'' which prevents that nasty feature. It's called "alias promotion". You may set it via sysctl by adding ''net.ipv4.conf.all.promote_secondaries=1'' in /etc/sysctl.conf or via sysctl command line.
 
|Signature=derjohn}}
 
 
{{Question
 
|Question=Can I run an OpenVPN Server in a guest?
 
||Details=
 
Yes. To get a OpenVPN Server running in a guest, all networking setup has to be done on the host. This answer describes the common case and shows some pitfalls, for detailled information about OpenVPN, please consult the appropriate documentation on the OpenVPN homepage.
 
This is the minimal OpenVPN configuration for the Server which will be used to demonstrate how to get it running in a client:
 
<pre>
 
# Networking setup
 
server 192.168.16.0    255.255.255.0
 
dev tun16
 
ifconfig-noexec
 
comp-lzo
 
# Certificates
 
dh ...
 
ca ...
 
cert ...
 
key ...
 
# Management
 
persist-key
 
keepalive 10 60
 
verb 4
 
</pre>
 
First of all you have to prepare the host with a persistent interface in the right mode and with the right settings. This is easily done by using openvpn and the ip and route tools.
 
<pre>
 
# openvpn --mktun --dev tun16
 
# ip link set dev tun16 txqueuelen 100
 
# ifconfig tun16 192.168.16.1 pointopoint 192.168.16.2 mtu 1500
 
# route add -net 192.168.16.0 netmask 255.255.255.0 gw 192.168.16.2
 
</pre>
 
If you need different settings, openvpn will tell you the ifconfig and route commands it uses to configure the interface when being started on the host with the original config file, but without ifconfig-noexec.
 
Additionally, the guest needs /dev/net/tun to make OpenVPN happy. This can be created with MAKEDEV:
 
<pre>
 
# cd /var/lib/vserver/<myopenvpnserver>/dev/
 
# ./MAKEDEV tun
 
  (creates the dev/net/tun device accessible by the guest - even a tap interface needs /dev/net/tun !)
 
</pre>
 
Finally, the guest needs to have the tun device assigned:
 
<pre>
 
# head /etc/vservers/<myopenvpnserver>/interfaces/1/*
 
==> /etc/vservers/<myopenvpnserver>/interfaces/1/ip <==
 
192.168.16.1
 
 
==> /etc/vservers/<myopenvpnserver>/interfaces/1/nodev <==
 
tun16
 
 
==> /etc/vservers/<myopenvpnserver>/interfaces/1/prefix <==
 
24
 
#
 
</pre>
 
The client's conf may look like that:
 
<pre>
 
# Basic setup
 
client
 
proto tcp-client
 
dev tun
 
remote <ipaddress>
 
comp-lzo
 
verb 4
 
 
# Certificate
 
ca ...
 
</pre>
 
 
[ Based on derJohn's original answer, all errors mine ]
 
|Signature=DavidS}}
 
 
{{Question
 
|Question=Trying to connect to a vserver from the host or another vserver on the same host fails
 
||Details=strace shows
 
<pre>
 
sin_addr=inet_addr("xx.xx.xx.xx")}, yy) = -1 EINVAL (Invalid argument)
 
</pre>
 
A: The host/guest cannot communicate with another guest on same host.
 
* check all netmasks on all interfaces (do they overlap) ?
 
* check policy routing (disable it temporary) ?
 
* check that lo is up (Networking within a host/guest always uses lo interface)
 
|Signature=CommonProblems}}
 
 
{{Question
 
|Question=Can I use iptables ?
 
||Details=Yes but right now only on the host (rootserver). Please realize that all traffic is local and will not touch the forward chain.
 
|Signature=BeginnerFAQ}}
 
 
 
== Administration tools ==
 
 
{{Question
 
|Question=Which guest vservers are running?
 
||Details=Use vserver-stat to find out.  Example output:
 
<pre>
 
CTX  PROC    VSZ    RSS  userTIME  sysTIME    UPTIME NAME
 
0      77 965.1M 334.6M  14m14s18  2m28s69  1h33m46 root server
 
49152    7    14M  5.2M  0m00s40  0m00s30  1h30m15 chiffon
 
</pre>
 
|Signature=derjohn}}
 
 
 
{{Question
 
|Question=Is there a web-based interface for vserver that will allow creation/deletion/configuration etc. of vserver guests?
 
||Details=
 
* http://OpenVPS.org which is a set of scripts with a web-interface for webhosters/ISPs
 
* http://Openvcp.org which is a distributed system (agent!) with a web-interface, with which you can build/remove guests
 
* http://vsmon.revolutionlinux.com/ is a distributed monitoring-only solution that allows you to search for a particular vserver in your park.
 
|Signature=derjohn}}
 
 
== Hosting foreign distributions ==
 
 
{{Question
 
|Question=I run a Debian host and want to build an Ubuntu guest. Howto?
 
||Details=Simple ;) Assume you want to build a breezy guest on a sid host with IP 192.168.0.2 and hostname vubuntu, then do:
 
<pre>
 
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \
 
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu
 
</pre>
 
 
[UPDATE] Currently there are problems in building breezy under unclear circumstances, which seems to have to do with udev. If the above didnt work, try:
 
<pre>
 
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \
 
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu -- --exclude=udev
 
</pre>
 
In very recent versions of the utils, the problem should not occur anymore (it has to do with the 'secure-mount' if you look in the MLs)
 
 
Well, sid's debootstrap knows how to bootstrap Ubuntu linux. Make sure to have a current debootstrap package:
 
<pre>
 
apt-get update
 
apt-get install debootstrap
 
</pre>
 
The knowledge how to build ubuntu 'breezy badger' (which you probably want to be your guest at the time of writing) has been added recently.
 
|Signature=derjohn}}
 
 
 
{{Question
 
|Question=I want to build a Gentoo guest. Howto?
 
||Details=Even simpler ;) See http://www.gentoo.org/proj/en/vps/vserver-howto.xml#doc_chap3 .
 
|Signature=gcc}}
 
 
== Application level problems ==
 
 
{{Question
 
|Question=I did everything right, but the application foo does not start. What's up there?
 
||Details=Before asking on the IRC channel, please check out the 'problematic programs' page:
 
[[Problematic Programs]]
 
|Signature=derjohn}}
 
 
{{Question
 
|Question=When I try to ssh to the guest, I log into the host, even if I installed sshd on the guest. What's wrong here?
 
||Details=Look at /etc/ssh/sshd_config of the host:
 
<pre>
 
Port 22
 
# Use these options to restrict which interfaces/protocols sshd will bind to
 
#ListenAddress ::
 
</pre>
 
And now change the setting to
 
<pre>
 
Port 22
 
# Use these options to restrict which interfaces/protocols sshd will bind to
 
ListenAddress your.hosts.ip.here  # not the guests IP!
 
</pre>
 
Then '/etc/init.d/ssh restart' on the host, after that on the guest (if you did apt-get install ssh on the guest already.)
 
Do I have to explain more? If the hosts sshd binds all available IP addresses on port 22 (The hosts 'sees' even all addresses of the guests!). So if the guest starts its sshd, it can't bind to port 22 any more. You need to change that setting only on the host.
 
(BTW: A similar approach has to be done for a lot of daemons, e.g. Apache. If the daemon does not support an explicit bind, you may use the chbind command to 'hide' IP addresses from the daemon before starting.)|Signature=derjohn}}
 
 
{{Question
 
|Question=Bind9 does not like to start in my guest.
 
||Details=Check out the [[Problematic Programs]] page and/or get my [http://linux-vserver.derjohn.de/bind9-packages/bind9-capacheck_9.3.2-2_i386.deb vserver-guest-ready Debian package] for Debian Sid guests and check out the [http://linux-vserver.derjohn.de/bind9-packages/README.txt readme]. (Hint: This is fresh stuff. Please give me feedback)
 
 
[UPDATE] Since VServer Devel 2.1.1-rc18 you do not need to patch the userland tools anymore. The capabilities are masked.
 
|Signature=derjohn}}
 
 
{{Question
 
|Question=My mysqld running in a guest behaves strangely and is awfully slow/locks up
 
||Details=This can be related to /tmp being too small. mysqld stores temporary tables in /tmp and as such, if a lot of queries happen and /tmp runs full this can cause one query to lock up whilst creating the tmp table and all other queries waiting to acquire the lock. There are two possible solutions to that problem: a.) Modify /etc/vservers/vserver-name/fstab and assign more memory to the tmpfs of /tmp and b.) remove the /tmp entry from /etc/vservers/vserver-name/fstab completly. Especially on database servers with a rather high load the second one might be the preferred method.|Signature=sp}}
 
 
{{Question
 
|Question=Pure-FTP does not run inside a VServer?
 
||Details=That's because it has capabilities enabled, make sure you rebuild your distro's package passing also the `--without-capabilities` flag to configure.
 
|Signature=Pedro Algarvio, aka, s0undt3ch}}
 
 
{{Question
 
|Question=Why do neither sshd nor crond (vixie-cron) work correctly in my CentOS / Fedora guest? I get 'pam_loginuid(crond:session): set_loginuid failed opening loginuid' and similar lines in my logs.
 
||Details=Took me a while to figure this out, and it turned out to be mentioned in the old wiki. Here is the solution on how to solve a common problem with sshd / crond, somehow related to selinux and auditing:
 
 
pam authentication (also used with openssh) enables "pam_loginuid.so" in the /etc/pam.d/* files. Comment those out as they are not necessary and will not load within a guest anyway. This probably is also necessary on updates later on, if the configs get changed. You therefore may add the following command line to a cronjob file or your software update script:
 
<pre>
 
/bin/sed --in-place -e "s/^session.*required.*pam_loginuid.so/# session\trequired\tpam_loginuid.so/g" /etc/pam.d/*
 
</pre>
 
|Signature=patrick}}
 
 
{{Question
 
|Question=How do i install nagios-plugins on a Gentoo guest?
 
||Details=Unfortunately, the nagios-plugins ./configure scripts wants to ping 127.0.0.1 which is not available inside a guest. Therefore you have to build nagios-plugins outside the guest.
 
The easiest way to do this from the host (assuming the guest is running) is:
 
<pre>
 
vnamespace -e <xid> -- chroot /vservers/<name> emerge nagios-plugins -va
 
</pre>
 
|Signature=Hollow}}
 
 
{{Question
 
|Question=Somebody runs ntpd in guest and you can't use ntpdate in host?
 
||Details=Try to run ntpdate with options -u :
 
ntpdate -u ntp.domain.xy
 
or you can use command:
 
chbind --nid 42 --ip 1.2.3.4 -- ntpdate ntp.domain.xy
 
where IP will be the IP of host.
 
|Signature=Punkie/Bertl}}
 
 
 
 
== Start / Stop a VServer ==
 
 
{{Question
 
|Question=How do I make a vserver guest start by default?
 
||Details=At least on Debian, I can tell you how to do it with the new-style config. If your guest is called "derjohn" and you want it to be started somewhere at the of your bootstrap process, then do:
 
<pre>
 
echo "default" > /etc/vservers/derjohn/apps/init/mark
 
</pre>
 
If you want to start it earlier, please read the init script "/etc/init.d/util-vserver" to find out how to do it. In most cases you don't need to change this. On Debian the vservers are started at "20", so after most other stuff is up (networking etc.).
 
 
Besides that I created a small helper script for managing the autostart foo: ((vserver-autostart))|Signature=derjohn}}
 
 
{{Question
 
|Question=My host works, but when I start a guest it says that it has a problem with chbind.
 
||Details=You are probably using util-vserver <= 0.30.209, which does use dynamic network contexts internally (With 0.30.210 this fact changed). So if you compiled your kernel without dynamic contexts, you may start guests, but you can't use the network context.The solution is either to switch to .210 util (or Hollow's toolset) or compile the kernel with dynamic network contexts.
 
SE Keyword: invalid option `nid' testme.sh
 
|Signature=derjohn}}
 
 
{{Question
 
|Question=What is old-style and new-style config?
 
||Details=Old-style config refers to a single text-file that contains all the configuration settings. With new-style config the configuration is split into several directories and files. You should probably go for new-style config if you are asking.
 
|Signature=derjohn}}
 
 
{{Question
 
|Question=How can I reboot/halt guests?
 
||Details=It depends.
 
For legacy Linux-VServer (i.e. 1.2.x), you have to replace /sbin/halt in the guests with vreboot and start rebootmgr in the host. You also need to have a <guest>.conf file in /etc/vservers for each guest. Please have a look at /etc/init.d/rebootmgr.
 
For Linux-VServer 2.0+, sys_reboot has been virtualized to do the right thing. No changes are needed in guests. Please note that some things depend on the init style used by the guest : read [[util-vserver:InitStyles]]
 
|Signature=derjohn}}
 
 
{{Question
 
|Question=What is the initial PATH?
 
||Details=By default, vserver uses the 'sysv' startup style, which mimics the init process by running the 3rd runlevel through '/etc/init.d/rc 3' (or '/etc/rc.d/rc 3'). Usually this 'rc' script uses a hard-coded PATH. In the case it doesn't, util-vserver also mimics init's default PATH through /etc/vservers/.defaults/apps/init/environment, or if not present /usr/local/lib/util-vserver/defaults/environment. Beware that all those default PATH usually do not include /usr/local.
 
|Signature=daniel_hozac&Beuc}}
 
 
{{Question
 
|Question=When I try to start a guest i get this message "/proc/uptime can not be accessed. Usually, this is caused by procfs-security. Please read the FAQ for more details"?
 
||Details=After a reboot you need to run the vprocunhide script. If running this script causes many errors to print on the screen, try checking the kernel you have booted with (perhaps it does not have the linux-vserver extensions enabled).
 
|Signature=mattzerah}}
 
 
== Kernel ==
 
 
{{Question
 
|Question=Is SMP Supported?
 
||Details=Yes, on all SMP capable kernel architectures.
 
|Signature=derjohn}}
 
 
{{Question
 
|Question=Do I really need the legacy-interfaces? What are these legacy-interfaces?
 
||Details=Since Linux-VServer is an ongoing project, new features might replace old ones, some might require a development version. Legacy-interfaces are available for backward compability (which might be removed someday) with Linux-VServer 1.2.x.
 
|Signature=derjohn}}
 
 
{{Question
 
|Question=I have a vserver running on a Linux kernel with preemption. Is VServer "preempt" safe?
 
||Details=There are no known issues about running vserver on a preemption enabled kernel. I would like to add, that the vserver kernelhackers would probably exclude that option in 'make menuconfig' if there would be an incompatibility. Just my $.02 :)
 
|Signature=derjohn}}
 
 
{{Question
 
|Question=32 vs 64 Bit? What should I take?
 
||Details=If you have the choice make the host a 64 bit one. You can run a guest as 32 bit or as 64 bit on a 64 bit host. To run it as 32 bit, you need to compile the x86_64 (a.k.a. AMD64) with the following options:
 
<pre>
 
[*] Kernel support for ELF binaries
 
<M> Kernel support for MISC binaries
 
[*] IA32 Emulation <---- without that, the entire 32bit API is not present
 
<M>  IA32 a.out support 
 
</pre>
 
You can force the guest to behave like a 32 environment like this:
 
<pre>
 
echo linux_32bit > /etc/vservers/$NAME/personality
 
echo i686 > /etc/vservers/$NAME/uts/machine
 
</pre>
 
(thanks cehteh for the hint!)
 
 
But you can force debootstrap to put 32 bit binaries into the guest by 'export ARCH=i386';
 
<pre>
 
export ARCH=i386 ; vserver build ....
 
</pre>
 
|Signature=derjohn}}
 
 
 
== Distribution specific questions ==
 
 
{{Question
 
|Question=VServer is included in the stable Debian GNU/Linux for years now. What VS version did they include?
 
||Details=At the time of writing, Debian Etch is the stable release of Debian and includes a 2.6.18 based kernel-package called 2.6.18-4-vserver. This currently contains a VServer 2.0.2.2-rc9. If you need more features, build an own one or take it from derjohn's ( http://linux-vserver.derjohn.de , details on derjohn's blog: http://blog.derjohn.de/snipsnap/space/start/2007-04-22/1 .
 
|Signature=derjohn/dhozac}}
 
 
{{Question
 
|Question=Were can I get newer versions of VServer as ready made packages for Debian?
 
||Details=Here you go: http://linux-vserver.derjohn.de/ . There is also some stuff on backports.org, but my kernels are always 'devel' branch.
 
|Signature=derjohn}}
 
 
 
 
== Misc ==
 
 
{{Question
 
|Question=Why isn't there a device /dev/xyz within a guest?
 
||Details=Device nodes allow userspace to access hardware (or virtual resources). Creating a device node inside the guest's namespace will give access to that device, so for security reasons, the number of 'given' devices is small.
 
|Signature=derjohn}}
 
 
{{Question
 
|Question=I want to (re)mount a partition in a running guest ... but the guest has no rights (capability) to (re)mount?
 
||Details=I'll explain. I take as example your /tmp partition within the guest is too small, what will be likely the case if you stay with the 16MB default (vserver build mounts /tmp as 16 MB tmpfs!).
 
<pre>
 
# vnamespace -e XID  mount -t tmpfs -o remount,size=256m,mode=1777 none /var/lib/vservers/<guest>/tmp/
 
</pre>
 
(if there's a problem, try expanding the symlinks in the mount path)
 
Be warned that the guest will not recognize the change, as the /etc/mtab file is not updated when you mount like this. To permanently change the mount, edit /etc/vserver/<guest>/fstab on the host.
 
|Signature=derjohn}}
 
 
{{Question
 
|Question=Does anyone know how to increase the size of /tmp within a vserver w/o restarting?
 
||Details=Use the remount option for mount.
 
# vnamespace -e XID mount -n -t tmpfs -o remount,size=32m tmpfs /<vdir>/<guest>/tmp
 
or something like that.  The arguments are needed since mount is not going to be using /etc/fstab for the information and the version of /proc/mounts is best understood by
 
# vnamespace -e XID cat /proc/mounts.
 
See [[Frequently_Asked_Questions#I want to (re)mount a partition in a running guest ... but the guest has no rights (capability) to (re)mount?]]
 
|Signature=derjohn/dhozac}}
 
 
 
{{Question
 
|Question=#1 ERROR:  capset(): Operation not permitted
 
||Details=capabilities are not enabled in kernel-setup
 
please check that CONFIG_SECURITY_CAPABILITIES is loaded or included in the kernel. ( check with "cat /path_to_kernel/.config | grep -i cap ")
 
(2.6.11.5-vs-1.9.5 + 0.30-205)
 
|Signature=IrcQuestions}}
 
 
{{Question
 
|Question=How can I make 'vserver start' mount the root filesystem?
 
||Details=Mount it via /etc/vservers/vserver-name/fstab, make sure to set the option 'dev' e.g.:
 
<pre>/dev/drbd0    /      xfs    rw,dev          0 0</pre>
 
|Signature=AdrianReyer}}
 
 
 
{{Question
 
|Question=I deleted a guest's directory without shutting it down. Now I have a "ghost" running. Is there any possibility to get it out of proc without rebooting?
 
||Details=
 
vkill --xid <xid> -s 15; sleep 2; vkill --xid <xid> -s 9
 
|Signature=daniel_hozac}}
 
 
{{Question
 
|Question=When using nice and su (for example, in the updatedb cron job), I get: su: Permission denied. What does it mean?
 
||Details=A guest cannot lower its nice value - and that's what 'su' does through pam_limits which sets a nice value of 0. You can see it through strace:
 
$ strace nice su nobody
 
[...]
 
setpriority(PRIO_PROCESS, 0, 0)        = -1 EACCES (Permission denied)
 
You can use 'su nobody -c nice some_cmd' instead.
 
(Now there's the question of why a guest process cannot lower its nice value.)
 
|Signature=daniel_hozac&Beuc}}
 
 
 
{{Question
 
|Question=How do I handle NFS mounts within in a guest?
 
||Details=There are three ways.
 
 
'''1)''' Mount the NFS share from the host OS and let vserver guest access it as part of it's file system.
 
 
''mount --bind'' may also be beneficial in this scenario.
 
 
'''2)''' Use util-vserver and create a ''fstab.remote'' file in the /etc/vserver/<vserver_name> directory. Populate this with the NFS shares and they will be mounted in the context of the vserver guest.
 
 
See http://www.nongnu.org/util-vserver/doc/conf/configuration.html
 
 
'''3)''' Add capabilities to the vserver guest instance to grant sufficient rights to allow NFS mounts.
 
 
Add the following to /etc/vserver/<vserver_name>/bcapabilities
 
SYS_ADMIN
 
Add the following to /etc/vserver/<vserver_name>/ccapabilities
 
SECURE_MOUNT
 
BINARY_MOUNT
 
 
See [[Capabilities_and_Flags]] for more information about vserver capabilities.
 
 
If you want the NFS shares to be mounted when the guest starts, add them to /etc/vserver/<vserver_name>/fstab
 
 
||Signature=martindk}}
 
 
 
{{Question
 
|Question=vserver start/stop/enter fails with something like "vnamespace: execvp("/usr/sbin/vserver"): No such file or directory" ?
 
||Details=Check whether ''/usr'' is mounted in the namespace you are working with.
 
<pre>vnamespace -e <guest> cat /proc/mounts</pre>
 
If there is no ''/usr'', you can fix your problem with simply mounting it using the following command:
 
<pre>vnamespace -e <guest> mount /dev/<device> /usr</pre>
 
 
||Signature=sim0n}}
 
 
 
 
== Upgrade from 2.0 to 2.2 ==
 
 
{{Question
 
|Question=I now get errors like "ncontext: vc_net_create(): Invalid argument; dynamic contexts disabled." on startup. Vservers are not started
 
||Details=Dynamic context are disabled by default and are deprecated. For example, tagxid and network checks won't be useable with dynamic ids. Now you should manually assign a explicit context to your vservers, like
 
echo 101 > /etc/vservers/myvserv/context
 
ADDENDUM: please consider that valid static contexts are between 2 and 49151 ( daniel_hozac on IRC ) otherwise you will end up with unexplainable error "ncontext: vc_net_migrate(): No such process" when trying to start the vserver.
 
 
|Signature=daniel_hozac&Beuc}}
 
 
 
{{Question
 
|Question=How do I assign a static context to an existing vserver?
 
||Details=Simple ;) See the answer above.
 
|Signature=gcc}}
 
 
 
{{Question
 
|Question=Since upgrading to a newer VS version my guest complains about "vsched: non-numeric value specified for '--priority_bias" at start time. What's wrong?
 
||Details=The scheduler paramters changed.You can use this (ugly) script to convert them or do it by hand:
 
<pre>
 
# cat /usr/local/sbin/vserver-convert-schedule-to-scheddir
 
#/bin/sh
 
mkdir /etc/vservers/$1/sched
 
sed -e 1p -n /etc/vservers/$1/schedule > /etc/vservers/$1/sched/fill-rate
 
sed -e 2p -n /etc/vservers/$1/schedule > /etc/vservers/$1/sched/interval
 
sed -e 3p -n /etc/vservers/$1/schedule > /etc/vservers/$1/sched/tokens
 
sed -e 4p -n /etc/vservers/$1/schedule > /etc/vservers/$1/sched/tokens-min
 
sed -e 5p -n /etc/vservers/$1/schedule > /etc/vservers/$1/sched/tokens-max
 
 
mv /etc/vservers/$1/schedule /etc/vservers/$1/schedule.converted.see.scheddir
 
 
# see: http://oldwiki.linux-vserver.org/Scheduler+Parameters
 
# see: http://www.nongnu.org/util-vserver/doc/conf/configuration.html#sched
 
</pre>
 
||Signature=derjohn}}
 
 
 
{{Question
 
|Question=Since upgrading to a newer VS version my guest doesn't have the amount of shared memory (SHM / SHMMAX / SHMALL ) as it had in the former version. What changed?
 
||Details=Every VS version that runs on a kernel >= 2.6.19 offers sysctl values per guest. This has to do with the 'ipc namespace' feature that was added to the mainline kernel in version 2.6.19. Linux-VServer uses that feature to give each guest a separate 'ipc namespace' and thus 'own' sysctl values per guest. Because shmmax is such a sysctl value, you have to set it per guest.
 
Here is an example how to do so:
 
 
<pre>
 
# mkdir /etc/vservers/<vserver>/sysctl/0 -p
 
# echo kernel.shmall > /etc/vservers/<vserver>/sysctl/0/setting
 
# echo 134217728 > /etc/vservers/<vserver>/sysctl/0/value
 
# mkdir /etc/vservers/<vserver>/sysctl/1 -p
 
# echo kernel.shmmax > /etc/vservers/<vserver>/sysctl/1/setting
 
# echo 134217728 > /etc/vservers/<vserver>/sysctl/1/value
 
</pre>
 
It's also explained on the geat flower page:
 
# see: http://www.nongnu.org/util-vserver/doc/conf/configuration.html -> Look for "sysctl".
 
 
After changing those values, restart your guest, enter it and check if the values are set:
 
<pre>
 
# sysctl -a | grep shm
 
...
 
kernel.shmall = 134217728
 
kernel.shmmax = 134217728
 
</pre>
 
 
||Signature=derjohn}}
 
  
 
== Title ==
 
== Title ==
 
Content
 
Content

Revision as of 11:00, 4 September 2008


Contents


General

What is a 'Guest'?

To talk about stuff, we need some naming. The physical machine is called 'Host' and the 'main' context running the Host Distro is called 'Host Context'. The virtual machine/distro is called 'Guest' and basically is a Distribution (Userspace) running inside a 'Guest Context'.
derjohn




What kind of Operating System (OS) can I run as guest?

With VServer you can only run Linux guests. The trick is that a guest does not run a kernel on its own (as XEN and UML do), it merely uses a virtualized host kernel-interface. VServer offers so called security contexts which make it possible to seperate one guest from each other, i.e. they cannot get data from each other. Imagine it as a chroot environment with much more security and features.
derjohn



Resources usage

Resource sharing?

Yes ....
  • memory: Dynamically.
  • CPU usage: Dynamically (token bucket)
derjohn



Resource limiting?

You can put limits per guest on different subsystems.
  • using ulimits and rlimits (rlimit is a new feature of kernel 2.6/vs2.0.) per guest, to limit the memory consumption, the number of processes or file-handles, ... : see Resource Limits
  • CPU usage : see CPU Scheduler
  • disk space usage : see Disk Limits and Quota
Note that you can only offer guaranteed resource availability with some ticks at the time.
derjohn&xm



Title

Content

Personal tools