Differences between revisions 89 and 90
Revision 89 as of 2015-02-26 13:23:50
Size: 14100
Editor: kao
Comment: add link to the french page
Revision 90 as of 2015-05-03 05:46:14
Size: 13408
Editor: ?CameronNorman
Comment: Update new jessie container description, adjust homepage link
Deletions are marked like this. Additions are marked like this.
Line 271: Line 271:
If you intend to create a fresh "Jessie" VM, then the follwing patch could be useful. Please note that the patch is not broadly tested, so confirmations, that the patch works would be very wellcomed here. Please also read the discussion in the thread, since as of this writing (23.11.2014) the patch is still under review/not applied.

[[https://lists.linuxcontainers.org/pipermail/lxc-devel/2014-November/010893.html|Antonio Terceiro's patch]]

Also, when you run lxc VMs then you should set "{{{lxc.autodev = 1}}}" in your "{{{/var/lib/lxc/myvm/config}}}". Also see DebianBug:761197 in the [[#Known_bugs_and_.22got_to_know_issues.22|'Known bugs and "got to know issues"']] section below, and this [[https://github.com/lxc/lxc/issues/335|LXC issue on Github]].
Creating new Jessie containers should work without issue.
Line 285: Line 280:
 * [[http://lxc.sourceforge.net/|LXC Homepage]]  * [[https://linuxcontainers.org/lxc/introduction/|LXC Homepage]]

Translation(s): English - Français

(!) ?Discussion


Linux Containers (LXC) provide a Free Software virtualization system for computers running GNU/Linux. This is accomplished through kernel level isolation. It allows one to run multiple virtual units simultaneously. Those units, similar to chroots, are sufficiently isolated to guarantee the required security, but utilize available resources efficiently, as they run on the same kernel.

For all related information visit : http://lxc.sourceforge.net/

Full support for LXC (including userspace tools) is available since the Debian 6.0 "Squeeze" release.

Current issues in Debian 7 "Wheezy":

You can also read some sub pages :

Installation

  • Install required packages

aptitude install lxc
  • Install optional packages

aptitude install bridge-utils libvirt-bin debootstrap

Prepare the host

Add this line to /etc/fstab (Do not do this on jessie with systemd, since it mounts cgroup. This is not necessary if libvirt-bin is installed as init.d/libvirt-bin will mount /sys/fs/cgroup automatically)

cgroup  /sys/fs/cgroup  cgroup  defaults  0   0

Try to mount it (a reboot solves an eventual "resource busy problem" in any case)

mount /sys/fs/cgroup
  • Optional: Enable memory cgroup support (CONFIG_CGROUP_MEM_RES_CTLR, 534964, builtin since 2.6.39-bpo60-2 for Squeeze). It is deactivated by default. You need to activate it with a kernel parameter. When using grub2, this can be easily done by setting GRUB_CMDLINE_LINUX="cgroup_enable=memory" in /etc/default/grub and running update-grub2.
    Same goes for swap+memory (CONFIG_CGROUP_MEM_RES_CTLR_SWAP), kernel parameter "swapaccount=1" - see http://lists.debian.org/debian-kernel/2012/01/msg00804.html .

Check kernel configuration :

# lxc-checkconfig 
Kernel config /proc/config.gz not found, looking in other places...
Found kernel config file /boot/config-2.6.32-5-amd64
--- Namespaces ---
Namespaces: enabled
Utsname namespace: enabled
Ipc namespace: enabled
Pid namespace: enabled
User namespace: enabled
Network namespace: enabled
Multiple /dev/pts instances: enabled

--- Control groups ---
Cgroup: enabled
Cgroup namespace: enabled
Cgroup device: enabled
Cgroup sched: enabled
Cgroup cpu account: enabled
Cgroup memory controller: missing
Cgroup cpuset: enabled

--- Misc ---
Veth pair device: enabled
Macvlan: enabled
Vlan: enabled
File capabilities: enabled

Note : Before booting a new kernel, you can check its configuration
usage : CONFIG=/path/to/config /usr/bin/lxc-checkconfig

Above the lxc-checkconfig program is reporting "Cgroup memory controller: missing". If you want memory control via cgroups then you need to recompile the linux kernel (or simply add cgroup_enable=memory to the kernel command line on jessie or later).

RootFS creation

Debian 8 "Jessie"/testing

Same as Debian 7 (see below), though if you want to specify the suite or mirror, use environment variables:

SUITE=wheezy MIRROR=http://ftp.fr.debian.org/debian lxc-create -n myvm -t debian

Alternatively you can use this command line:

lxc-create -n myvm -t debian -- -r jessie

But you will get systemd inside the container, which does not work properly currently. Please take note of the root password of the container. So start the container, switch to sysvinit and stop it again.

lxc-start -n myvm 
# login
apt-get -y install sysvinit-core
# logout und kill container
lxc-stop -n myvm -k

Please also see section "Incompatibility with systemd".

Debian 7 "Wheezy"

LXC installs correctly on "Wheezy" (including a working Debian template since 7.4).

Use:

lxc-create -n myvm -t debian

which will prompt you on what distribution to install.

Then adapt network configuration in /var/lib/lxc/myvm/config, e.g. to plug it on libvirt's bridge:

lxc.utsname = myvm
lxc.network.type = veth
lxc.network.flags = up
lxc.network.link = virbr0
lxc.network.ipv4 = 0.0.0.0/24
lxc.network.hwaddr = 00:1E:62:CH:NG:ME

Other templates can be downloaded, before 7.4 we recommended the one referenced on the LXC container mailing list:

lxc-create -n myvm -t debian-wheezy
# or for a 32-bit container:
linux32 lxc-create -n myvm -t debian-wheezy

Debian 6.0 "Squeeze"

  • In theory you may use any tool to create a rootfs (debootstrap, multistrap, rootstock) as long as you are sure, that the result will run inside a container.
  • For the first time and as an example, use the provided creation script of the lxc package.

cp -a /usr/lib/lxc/templates/lxc-debian /usr/lib/lxc/templates/lxc-squeeze
  • (lxc-debian is designed to install lenny, which is no longer accessible from the specified archive.) Edit lxc-squeeze, replacing "lenny" with "squeeze" and "dhcp-client" with "isc-dhcp-client"

lxc-create -n myvm -t squeeze -f /usr/share/doc/lxc/examples/lxc-veth.conf
  • Here, we use lxc-veth.conf config file

Setup networked containers

Start and stop containers

Notes/warnings on starting and stopping containers:

  • When you connect to a container console, lxc will let you know how to quit it. The first time you log in however, getty will clear the screen, so you'll probably miss this bit of information:

    Type <Ctrl+a q> to exit the console, <Ctrl+a Ctrl+a> to enter Ctrl+a itself
  • If you're using screen and also use the Ctrl+a command prefix, type <Ctrl+a a q> to exit the console.

  • <!> When you start the container in foreground mode (without -d), there's apparently no way to quit the terminal (<Ctrl+a q> doesn't work). Make sure you start the containers in background mode with -d, unless you need to debug why a container didn't start.

  • lxc-halt yields telinit: timeout opening/writing control channel /run/initctl - instead, do a 'poweroff' inside the container, (this is bad advice - it powers off the HOST) and finish it off with lxc-stop. Alternative work-around: use lxc.cap.drop = sys_admin in the container config file.

Actual commands:

  • To start a container in the background and attached to the console at any time later run (by default, login/password is root/root):

    lxc-start -n myvm -d
    lxc-console -n myvm
  • To start a container in foregroup mode and stay attached to the console run (see warning above):

    lxc-start -n myvm
  • To halt a container cleanly by the containers initv-system (see timeout note above):

    lxc-halt -n myvm
  • To stop a container without proper halt inside the container:

    lxc-stop -n myvm
  • To have containers automatically started on booting the host, link their config file in /etc/lxc/auto/:

    ln -s /var/lib/lxc/mycontainer/config /etc/lxc/auto/mycontainer

Bind mounts inside the container

By default only the container's filesystem is mounted inside the container (even if on the host, /var/lib/lxc/mycontainer/rootfs has other mount points).

To mount another filesystem in the container, add to /var/lib/lxc/mycontainer/config:

lxc.mount.entry=/path/in/host/mount_point /var/lib/lxc/mycontainer/rootfs/mount_point none bind 0 0

and restart the container. The mount point will now be visible inside the container as well.

Both paths can be identical if necessary.

Incompatibility with systemd

As of 0.8.0~rc1-8+deb7u2 ("Wheezy") and 1:1.0.6-4 ("Unstable") Debian's lxc is not compatible with running systemd inside the container. See 766216.

Scenarios

Upgrading container from "Wheezy" to "Jessie"

When upgrading an lxc guest running "Wheezy" to "Jessie", the lxc VM will stop working, because at the time of writing (23.11.2014) systems will automatically be migrated to systemd. See 766233. This behaviour is being reviewed in 762194.

Workarounds:

Switch back to sysv

If the VM was migrated to systemd automatically via an upgrade then you can switch back to sysvinit:

lxc-stop -n myvm               # stop the vm
                               # or, if that doesn't work use lxc-kill

# the next step requires the VM to be mounted at /var/lib/lxc/myvm/root

chroot /var/lib/lxc/myvm/root  # chroot into the vm
apt-get install sysvinit-core # reinstall old sysvinit

Alternatively you can try to start the container in the foreground and do the same via the container's console as described in section Debian 8 "Jessie"/testing.

Not letting your system be updated to systemd during the upgrade

Before upgrade, run:

apt-get install sysvinit-core

or run the following command in place of a usual dist-upgrade:

apt-get dist-upgrade sysvinit-core

Reconfiguring updated VMs

Note that the following recipe only works on hosts running jessie. It will not work on hosts still running wheezy.

Add the following to your container config:

lxc.autodev = 1
lxc.kmsg = 0

Do the following in the guest.

Adjust getty@.service:

cp /lib/systemd/system/getty@.service /etc/systemd/system
# Comment out the line ConditionPathExists=/dev/tty0 in the copied getty@.service

Mask udev.service and systemd-udevd.service:

systemctl mask udev.service systemd-udevd.service

Creating new "Jessie" VMs

Creating new Jessie containers should work without issue.

Support

References

See also :

Known bugs and "got to know issues"

  • 600466 - "Respawning too fast" messages and can't connect to console due to missing tty(1234) nodes in generated container rootfs. Workaround: remove from container's /etc/inittab or start container in interactive mode and mknod -m 660 dev/tty1 c 5 1 for each required tty.

  • Some bugs that might apply to non-official containers - read the follow-ups for solutions.

  • "telinit: /run/initctl: No such file or directory" running lxc-halt?

    mknod -m 600 /var/lib/lxc/myvm/rootfs/run/initctl p

    and add "sys_admin" to the lxc.cap.drop line in /var/lib/lxc/myvm/config? See http://wiki.deimos.fr/LXC_:_Install_and_configure_the_Linux_Containers#telinit:_.2Frun.2Finitctl:_No_such_file_or_directory

  • 761197 - "systemd-journald eats CPU in lxc jessie container"
    As noted in the bug report, setting "lxc.kmsg=0" in "/var/lib/lxc/myvm/root" and removing "/dev/kmsg" inside the container seems to fix the problem.

See also