This is an old revision of the document!
Table of Contents
LXC - Linux Container Tools
LXC is a tool to create and manage containers. It contains a full featured container with the isolation / virtualization of the pids, the ipc, the utsname, the mount points, /proc, /sys, the network and it takes into account the control groups. It is very light, flexible, and provides a set of tools around the container like the monitoring with asynchronous events notification, or the freeze of the container. This package is useful to create Virtual Private Server, or to run isolated applications like bash or sshd.
Resources
Contents
Guest creation
Build the guest container.
Bare minimum, no template
# lxc-create -n test lxc-create: No config file specified, using the default config /etc/lxc/default.conf 'test' created # lxc-ls --fancy NAME STATE IPV4 IPV6 ----------------------------------- test STOPPED -
this just creates $LXC_ROOT/test directory with config copied from /etc/lxc/default.conf inside.
PLD Linux from template
create guest with default config using pld template:
# lxc-create -n test -t pld
NOTYET:
There are two versions of PLD available for guest systems:
- ac - PLD 2.0 (Ac)
- th - PLD 3.0 (Th)
You may choose one using -R option:
# lxc-create -t pld-test -p pld -f network-configuration-file -- -R th
!!! WARNING: pld template for LXC is yet to be written !!!
Vserver comparision
| Vserver | LXC | Notes |
|---|---|---|
| vserver test enter | lxc-attach -n test -e | Use -e option with care, especially when restarting processess |
| vserver test start | lxc-start -n test -d | |
| vserver test stop | lxc-stop -n test | |
| vserver-stat | lxc-ls --fancy --running | you need python3-lxc installed for this tool |
config for network
static networking, set VSERVER=yes and VSERVER_ISOLATION_NET=yes in guest /etc/sysconfig/system to disable all network configuration by guest.
- uses
macvlan - that interface is NOT visible on host
- you can't filter it from host's firewall
- you HAVE to set mac. If not - on every container start you'll have different one (your router will not pass the traffic).
first boot with hwaddr line disabled, look what the random address was assigned, set it in config.
also you may use some generation techniques like these (assuming the ip is 192.168.2.160):
$ printf "02:00:%x:%x:%x:%x" 192 168 2 160 02:00:c0:a8:2:a0
lxc.network.type = macvlan lxc.network.flags = up #lxc.network.hwaddr = 00:16:c0:a8:3:34 lxc.network.link = eth0 lxc.network.macvlan.mode = bridge lxc.network.name = eth0 lxc.network.ipv4 = 192.168.2.160/23 lxc.network.ipv4.gateway = 192.168.2.1