This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
docs:lxc [2013-11-24 15:13] glen loginuid issue |
docs:lxc [2013-12-09 15:36] glen add full config dump |
||
---|---|---|---|
Line 24: | Line 24: | ||
Build the guest container. | Build the guest container. | ||
+ | |||
==== Bare minimum, no template ==== | ==== Bare minimum, no template ==== | ||
Line 62: | Line 63: | ||
!!! WARNING: pld template for LXC is yet to be written !!! | !!! WARNING: pld template for LXC is yet to be written !!! | ||
- | ===== Vserver comparision ===== | + | ===== Common problems / Useful tricks ===== |
- | When in Vserver, guest processes are not visible in host, then in LXC all guest processes are visible. Beware when running ''killall(1)'' commands on host. | + | ==== lxc-stop is not graceful ==== |
- | Also, unfortunately ''/proc/PID/root'' points to ''/'' for LXC guests as well, so ''rc-scripts'' ''filter_chroot()'' can't differentiate between host and guest processes. | + | Currently ''lxc-stop -n test'' sends ''SIGPWR'' to init inside container, but ''rc-scripts'' fails to shutdown things properly (shutdown scripts are not invoked). For workaround, stop services manually before issueing ''lxc-stop'' or run ''poweroff''/''halt''/''reboot'' from container. |
- | Also, ''dmesg(1)'' in guest sees hosts' dmesg by default, you can turn this off by setting ''kernel.dmesg_restrict=1'' sysctl param, available since ''2.6.37'' kernel. | + | Details: In process table is only this process runrning, no further actions from ''rc-scripts'': |
+ | <file> | ||
+ | /sbin/shutdown -f -h +2 Power Failure; System Shutting Down | ||
+ | </file> | ||
- | ''pam_loginuid.so'' does not allow ''sshd'' to login. similar problem as [[http://kb.parallels.com/en/112597|here]]. | + | ==== loginuid ==== |
- | Workaround: | + | having ''audit_control'' dropped: |
- | Disable "pam_loginuid.so" in the authentication rules: | + | <file config config> |
+ | lxc.cap.drop = audit_control | ||
+ | </file> | ||
+ | |||
+ | ''pam_loginuid.so'' does not allow ''sshd'' to login: | ||
+ | <file> | ||
+ | Nov 24 16:02:10 test sshd[2694]: error: PAM: pam_open_session(): Cannot make/remove an entry for the specified session | ||
+ | </file> | ||
+ | |||
+ | You can either [[http://kb.parallels.com/en/112597|workaround]] to disable ''pam_loginuid.so'' in the authentication rules: | ||
<file> | <file> | ||
# sed '/pam_loginuid.so/s/^/#/g' -i /etc/pam.d/* | # sed '/pam_loginuid.so/s/^/#/g' -i /etc/pam.d/* | ||
</file> | </file> | ||
+ | |||
+ | Or just **do not** drop the capability. | ||
+ | ===== Vserver comparision ===== | ||
+ | |||
+ | When in Vserver, guest processes are not visible in host, then in LXC all guest processes are visible. Beware when running ''killall(1)'' commands on host. | ||
+ | |||
+ | Also, unfortunately ''/proc/PID/root'' points to ''/'' for LXC guests as well, so ''rc-scripts'' ''filter_chroot()'' can't differentiate between host and guest processes. | ||
+ | |||
+ | Also, ''dmesg(1)'' in guest sees hosts' dmesg by default, you can turn this off by setting ''kernel.dmesg_restrict=1'' sysctl param, available since ''2.6.37'' kernel. | ||
+ | |||
**Commands:** | **Commands:** | ||
Line 94: | Line 117: | ||
- you can't filter it from host's firewall | - you can't filter it from host's firewall | ||
- you HAVE to set mac. If not - on every container start you'll have different one (your router will not pass the traffic). | - you HAVE to set mac. If not - on every container start you'll have different one (your router will not pass the traffic). | ||
+ | - iptables is initialized from lxc.hook.pre-mount hook (ran in the container's namespace and having macvlan interface visible) | ||
+ | |||
first boot with ''hwaddr'' line disabled, look what the random address was assigned, set it in config. | first boot with ''hwaddr'' line disabled, look what the random address was assigned, set it in config. | ||
Line 112: | Line 137: | ||
lxc.network.ipv4 = 192.168.2.160/23 | lxc.network.ipv4 = 192.168.2.160/23 | ||
lxc.network.ipv4.gateway = 192.168.2.1 | lxc.network.ipv4.gateway = 192.168.2.1 | ||
+ | |||
+ | lxc.hook.pre-mount = /sbin/service iptables start | ||
+ | lxc.cap.drop = net_admin | ||
</file> | </file> | ||
+ | |||
+ | |||
+ | ==== full config ==== | ||
+ | |||
+ | <code bash> | ||
+ | # lxc for test | ||
+ | |||
+ | lxc.network.type = macvlan | ||
+ | lxc.network.flags = up | ||
+ | #lxc.network.hwaddr = 00:16:c0:a8:3:34 | ||
+ | lxc.network.link = eth0 | ||
+ | lxc.network.macvlan.mode = bridge | ||
+ | lxc.network.name = eth0 | ||
+ | lxc.network.ipv4 = 192.168.2.160/23 | ||
+ | lxc.network.ipv4.gateway = 192.168.2.1 | ||
+ | |||
+ | lxc.rootfs = /srv/test | ||
+ | lxc.utsname = pldmachine.local | ||
+ | lxc.tty = 4 | ||
+ | lxc.pts = 1024 | ||
+ | |||
+ | # load delfi-fw, if you want to setup firewall when container is already up | ||
+ | # you should run 'lxc-attach -e -n white -- fw-load' | ||
+ | lxc.hook.pre-mount = /sbin/service iptables start | ||
+ | |||
+ | # lxc.mount.entry is prefered, because it supports relative paths | ||
+ | lxc.mount = /var/lib/lxc/white/fstab | ||
+ | |||
+ | lxc.cap.drop = linux_immutable | ||
+ | #lxc.cap.drop = sys_boot # works as expected in newer kernels (3.4+) | ||
+ | lxc.cap.drop = syslog | ||
+ | |||
+ | # don't drop net_admin, allows firewall to be configured from inside | ||
+ | lxc.cap.drop = net_admin | ||
+ | |||
+ | # http://www.funtoo.org/Linux_Containers | ||
+ | ## Capabilities, see capabilities(7) what is available | ||
+ | #lxc.cap.drop = audit_control | ||
+ | lxc.cap.drop = audit_write | ||
+ | lxc.cap.drop = mac_admin | ||
+ | lxc.cap.drop = mac_override | ||
+ | lxc.cap.drop = mknod | ||
+ | lxc.cap.drop = setfcap | ||
+ | lxc.cap.drop = setpcap | ||
+ | lxc.cap.drop = sys_admin | ||
+ | #lxc.cap.drop = sys_boot | ||
+ | #lxc.cap.drop = sys_chroot # required by SSH | ||
+ | lxc.cap.drop = sys_module | ||
+ | #lxc.cap.drop = sys_nice | ||
+ | lxc.cap.drop = sys_pacct | ||
+ | lxc.cap.drop = sys_rawio | ||
+ | lxc.cap.drop = sys_resource | ||
+ | lxc.cap.drop = sys_time | ||
+ | #lxc.cap.drop = sys_tty_config # required by getty | ||
+ | |||
+ | lxc.autodev = 0 | ||
+ | |||
+ | # When using LXC with apparmor, uncomment the next line to run unconfined: | ||
+ | lxc.aa_profile = unconfined | ||
+ | |||
+ | # cgroups | ||
+ | # Devices | ||
+ | lxc.cgroup.devices.deny = a # Deny access to all devices | ||
+ | |||
+ | # /dev/null and zero | ||
+ | lxc.cgroup.devices.allow = c 1:3 rwm | ||
+ | lxc.cgroup.devices.allow = c 1:5 rwm | ||
+ | # consoles | ||
+ | lxc.cgroup.devices.allow = c 5:1 rwm | ||
+ | lxc.cgroup.devices.allow = c 5:0 rwm | ||
+ | lxc.cgroup.devices.allow = c 4:0 rwm | ||
+ | lxc.cgroup.devices.allow = c 4:1 rwm | ||
+ | # /dev/{,u}random | ||
+ | lxc.cgroup.devices.allow = c 1:9 rwm | ||
+ | lxc.cgroup.devices.allow = c 1:8 rwm | ||
+ | lxc.cgroup.devices.allow = c 136:* rwm | ||
+ | lxc.cgroup.devices.allow = c 5:2 rwm | ||
+ | # rtc | ||
+ | lxc.cgroup.devices.allow = c 254:0 rm | ||
+ | </code> |