User Tools
docs:lxc
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
|
docs:lxc [2013-11-24 15:17] glen separate section for problems/solutio |
docs:lxc [2013-12-09 15:33] glen load iptables from hook |
||
|---|---|---|---|
| Line 64: | Line 64: | ||
| ===== Common problems / Useful tricks ===== | ===== Common problems / Useful tricks ===== | ||
| + | |||
| + | ==== lxc-stop is not graceful ==== | ||
| + | |||
| + | Currently ''lxc-stop -n test'' sends ''SIGPWR'' to init inside container, but ''rc-scripts'' fails to shutdown things properly (shutdown scripts are not invoked). For workaround, stop services manually before issueing ''lxc-stop'' or run ''poweroff''/''halt''/''reboot'' from container. | ||
| + | |||
| + | Details: In process table is only this process runrning, no further actions from ''rc-scripts'': | ||
| + | <file> | ||
| + | /sbin/shutdown -f -h +2 Power Failure; System Shutting Down | ||
| + | </file> | ||
| ==== loginuid ==== | ==== loginuid ==== | ||
| - | ''pam_loginuid.so'' does not allow ''sshd'' to login | + | having ''audit_control'' dropped: |
| + | <file config config> | ||
| + | lxc.cap.drop = audit_control | ||
| + | </file> | ||
| + | ''pam_loginuid.so'' does not allow ''sshd'' to login: | ||
| <file> | <file> | ||
| Nov 24 16:02:10 test sshd[2694]: error: PAM: pam_open_session(): Cannot make/remove an entry for the specified session | Nov 24 16:02:10 test sshd[2694]: error: PAM: pam_open_session(): Cannot make/remove an entry for the specified session | ||
| </file> | </file> | ||
| - | + | You can either [[http://kb.parallels.com/en/112597|workaround]] to disable ''pam_loginuid.so'' in the authentication rules: | |
| - | Similar problem as [[http://kb.parallels.com/en/112597|here]], to workaround, disable ''pam_loginuid.so'' in the authentication rules: | + | |
| <file> | <file> | ||
| # sed '/pam_loginuid.so/s/^/#/g' -i /etc/pam.d/* | # sed '/pam_loginuid.so/s/^/#/g' -i /etc/pam.d/* | ||
| </file> | </file> | ||
| + | Or just **do not** drop the capability. | ||
| ===== Vserver comparision ===== | ===== Vserver comparision ===== | ||
| Line 104: | Line 117: | ||
| - you can't filter it from host's firewall | - you can't filter it from host's firewall | ||
| - you HAVE to set mac. If not - on every container start you'll have different one (your router will not pass the traffic). | - you HAVE to set mac. If not - on every container start you'll have different one (your router will not pass the traffic). | ||
| + | - iptables is initialized from lxc.hook.pre-mount hook (ran in the container's namespace and having macvlan interface visible) | ||
| + | |||
| first boot with ''hwaddr'' line disabled, look what the random address was assigned, set it in config. | first boot with ''hwaddr'' line disabled, look what the random address was assigned, set it in config. | ||
| Line 122: | Line 137: | ||
| lxc.network.ipv4 = 192.168.2.160/23 | lxc.network.ipv4 = 192.168.2.160/23 | ||
| lxc.network.ipv4.gateway = 192.168.2.1 | lxc.network.ipv4.gateway = 192.168.2.1 | ||
| + | |||
| + | lxc.hook.pre-mount = /sbin/service iptables start | ||
| + | lxc.cap.drop = net_admin | ||
| </file> | </file> | ||
docs/lxc.txt · Last modified: 2016-08-21 00:36 by glen
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: Public Domain
