Albert Lea Data Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== LXC - Linux Containers ======

==== Resources ====
  * [[http://www.darlo.tv/lxc/setup-unpriv-slackware.html|Unprivileged Containers in Slackware]]
  * [[https://stgraber.org/2014/01/17/lxc-1-0-unprivileged-containers|Stephane Graber's intro]]

==== Basic setup ====
  * Physical host has to have a network bridge
  * On physical host, in ''/etc/lxc/default.conf'':<code>lxc.network.type=veth
lxc.network.link=br0
lxc.network.flags=up</code>
  * Create container: ''lxc-create -n lxcguest -t /usr/share/lxc/templates/lxc-slackware''
  * Edit container's ''config'' and set MAC for virtual NIC: ''lxc.network.hwaddr = DE:AD:BE:EF:00:00''
  * Start container:  ''lxc-start -n lxcguest -d''
  * Connect to container's console:  ''lxc-console -n lxcguest'' \\ // Default login/password is root/root //
  * In guest, set up networking as usual
  * Packages to add:
    * perl
    * python
    * python-setuptools
    * vim
    * less
    * rsync
    * sudo
    * make
    * guile
    * gc
    * libffi

==== Unprivileged ====
See: [[http://www.darlo.tv/lxc/run-unpriv-slackware.html|Unprivileged containers in Slackware]]
  - Prerequisites
  - Create standard root-privileged container
  - Remap that container's owner & group numbers to the user's subuid & subgid
  - Move the container into the user's file space
  - Run the unprivileged container

=== Prerequisites ===
  * Ensure the libcgroup package is at least ''libcgroup-0.41-x86_64-2_slack14.2''
  * In ''/etc/cgconfig.conf'': <code>group lxc { 
    perm {
        task {
            uid = rk4n3;
            gid = rk4n3;
        }
    admin {
          uid = rk4n3;
          gid = rk4n3;
      }
  }

  cpuset {
      cgroup.clone_children = 1;
      cpuset.mems = 0;
      cpuset.cpus = 0-3;
  }
  cpu {}
  cpuacct {}
  blkio {}
  memory { memory.use_hierarchy = 1; }
  devices {}
  freezer {}
  net_cls {}
  perf_event {}
  net_prio {}
}</code>
  * 

=== Re-Mapping Container UIDs & GIDs ===
As root:
<code>
usermod --add-subuids 100000-165536 rk4n3
usermod --add-subgids 100000-165536 rk4n3
</code>

Acquire ''uidmapshift.c'' and ''container-userns-convert'' from: [[http://bazaar.launchpad.net/%7Eserge-hallyn/+junk/nsexec/files|nsexec tools]]

Build ''uidmapshift'' with:
<code>gcc -o uidmapshift uidmapshift.c</code>

Near the end of the container-userns-convert , around line 61, change the call to ''uidmapshift'' to be $PATHTOYOUR/uidmapshift, then make container-userns-convert executable.
Perform the actual conversion with //(as root)//:
<code>./container-userns-convert yourcontainername 100000</code>


In ''$HOME/.config/lxc/default.conf'':
<code>
lxc.network.type = veth
lxc.network.link = br0
lxc.network.flags = up
lxc.network.hwaddr = DE:AD:BE:EF:xx:xx
lxc.id_map = u 0 100000 65536
lxc.id_map = g 0 100000 65536
</code>

In ''/etc/lxc/lxc-usernet'': <code>rk4n3 veth br0 10</code>

==== Extra Setup ====

=== MySQL ===
  * Install the mysql package(s)
    * Prerequisites in addition to template's packages: ''libaio'' and ''jemalloc''
Albert Lea Data Wiki

User Tools

Site Tools

Page Tools
