http://wiki.linux-vserver.org/api.php?action=feedcontributions&user=82.238.35.175&feedformat=atomLinux-VServer - User contributions [en]2024-03-28T21:20:09ZUser contributionsMediaWiki 1.20.2http://wiki.linux-vserver.org/Installation_on_Linux_2.6Installation on Linux 2.62009-01-09T17:13:04Z<p>82.238.35.175: /* Enabling VServers on startup */ new subsection</p>
<hr />
<div>This guide will explain how to install a Linux-VServer kernel and util-vserver manually from source. It is assumed that you have basic knowledge about building a custom kernel, i.e. that you know which stuff to turn on in the kernel configuration. Of course some Linux-VServer specific options are explained here.<br />
<br />
== Manual Kernel Compilation ==<br />
<br />
You might ask yourself, why should I build a custom kernel? Manually configuring a kernel is often seen as the most difficult procedure a Linux user ever has to perform. Nothing is less true -- after configuring a couple of kernels you don't even remember that it was difficult ;)<br />
<br />
However, one thing is true: you must know your system when you start configuring a kernel manually. Nevertheless there are good reasons to build your kernel manually:<br />
<br />
* Your distribution does not have a prebuilt Linux-VServer kernel<br />
* Your distribution does not have the latest and greatest<br />
* You don't want to install bloated prebuilt kernels<br />
* You want a monolithic kernel and your distribution uses modules<br />
* You can tell everyone that you built your kernels manually ;)<br />
<br />
If you still intend to built your own kernel, read on. Otherwise have a look at our [[Documentation]] section for how to install a prebuilt Linux-VServer kernel for your distribution.<br />
<br />
=== Getting the Sources ===<br />
<br />
You'll need the vanilla kernel sources (i.e. those from [http://www.kernel.org kernel.org]) and (of course) a Linux-VServer patch for the kernel version you intend to use. You can find links to both files in our [[Downloads]] section.<br />
<br />
In this document we will use Linux 2.6.22.19 with Linux-VServer 2.2.0.7.<br />
<br />
First, you have to create a directory for the sources, if you already have one, feel free to skip this step and/or adjust the paths to your needs.<br />
<br />
<pre><br />
# Create a directory for our sources<br />
mkdir ~/src<br />
<br />
# Switch to that directory<br />
cd ~/src<br />
</pre><br />
<br />
Now that we have a place to store our sources, we need to fetch them. We start with the vanilla sources.<br />
<br />
<pre><br />
# Get Linux 2.6.22.19 sources<br />
wget http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.22.19.tar.bz2<br />
<br />
# Extract them<br />
tar xjf linux-2.6.22.19.tar.bz2<br />
</pre><br />
<br />
Now it is time to get the Linux-VServer patch and apply it to the sources. While we're at it, I tell you a nice trick I learned from Bertl, that allows you to keep a lot of source trees on your disk without using up lots of disk space (and this also speeds up 'diff' a lot, which is really nice if you do kernel-hacking). What we do is creating a hard-linked copy of our sources and patch this copy with the Linux-VServer patch. That way, only the patched files use additional disk space (and because hard-linked files are equal by definition, diff doesn't need to compare them).<br />
<br />
<pre><br />
# Get the Linux-VServer 2.2.0.7 patch<br />
wget http://ftp.linux-vserver.org/pub/kernel/vs2.2/patch-2.6.22.19-vs2.2.0.7.diff<br />
<br />
# Create a hard-linked copy of the vanilla sources, this will get the Linux-VServer patch applied<br />
cp -la linux-2.6.22.19 linux-2.6.22.19-vs2.2.0.7<br />
<br />
# Switch to that new directory<br />
cd linux-2.6.22.19-vs2.2.0.7<br />
<br />
# Patch the sources<br />
cat ../patch-2.6.22.19-vs2.2.0.7.diff | patch -p1<br />
</pre><br />
<br />
Now you have two sources, the vanilla sources for 2.6.22.19 and the Linux-VServer sources for 2.6.22.19-vs2.2.0.7. You might ask "Why do I need two source trees at all? I only want one kernel!" and that's a good question.<br />
<br />
Here's one answer: Updates! If a new vanilla kernel is released, you can just download the patch from your version to the new version. Otherwise, if you would have applied the patch to your one and only vanilla source tree, you would not be able to do this. The same applies for new Linux-VServer releases. That is, if a new Linux-VServer patch is available, you can simply create another hardlinked copy of your vanilla sources and apply the new patch using the copy. This can really save you time (and bandwidth), since you can keep everything you might need, without wasting a lot of disk space.<br />
<br />
But be aware that this needs some discipline when hacking the source. Because hard-linked files share the same data on the disk, you need to make sure that your editor does ''The Right Thing'', otherwise you might mess up all your source trees...<br />
<br />
=== Configuring the Kernel ===<br />
<br />
Under Ubuntu (on 8.04 Hardy x86_64 tested) the configuration files of the existing kernel can be found in the /boot directory with a name similar to: config-'uname -r'-general. This file can be used if copied to the source dir of the kernel as a starting point to configure the rest of the kernel. The filename must be .config<br />
Now go to your kernel source directory and execute make menuconfig. This will fire up an ncurses-based configuration menu. (Of course you can use whatever configuration method you like, there is a text based one (make config), a GTK based one (make gconfig), and even a QT based one (make xconfig))<br />
<br />
<pre><br />
# Configure the kernel using a ncurses based menu<br />
make menuconfig<br />
</pre><br />
<br />
It is out of the scope of this guide to explain all the available configuration options. If you feel unsure about certain options either leave it with the default value, or consult your distribution manuals for help.<br />
<br />
Nevertheless, we will explain the Linux-VServer configuration options, of course. Depending on your version your configuration options may look similar to the following:<br />
<br />
<pre><br />
Linux VServer ---><br />
[*] Enable Legacy Kernel API (<2.3)<br />
[ ] Show a Legacy Version ID<br />
[*] Enable dynamic context IDs (2.1 - 2.2)<br />
[ ] Disable Legacy Networking Kernel API (2.0.x only)<br />
[*] Enable Legacy Networking Kernel API (2.1 - 2.2)<br />
[*] Automatically Assign Loopback IP (2.3+)<br />
[*] Automatic Single IP Special Casing (2.3+)<br />
[ ] Remap Source IP Address (<2.3)<br />
[*] Enable COW Immutable Link Breaking (2.1+)<br />
[ ] Enable Virtualized Guest Time (2.1+)<br />
[ ] Enable Guest Device Mapping (2.1, 2.3)<br />
[*] Enable Proc Security<br />
[ ] Enable Hard CPU Limits<br />
[ ] Avoid idle CPUs by skipping Time (2.1+)<br />
[ ] Limit the IDLE task<br />
Persistent Inode Tagging (UID24/GID24) ---><br />
[ ] Tag NFSD User Auth and Files<br />
[ ] Enable Inode Tag Propagation (2.1+)<br />
[ ] Honor Privacy Aspects of Guests (2.1+)<br />
[256] Maximum number of Contexts (1-65533) (2.2+)<br />
[*] VServer Warnings (2.2+)<br />
[ ] VServer Debugging Code<br />
[ ] VServer History Tracing<br />
(64) Per-CPU History Size (32-65536)<br />
[ ] VServer Scheduling Monitor (2.1+)<br />
(1024) Per-CPU Monitor Queue Size (32-65536) (2.1+)<br />
(256) Per-CPU Monitor Sync Interval (0-65536) (2.1+)<br />
</pre><br />
<br />
; Enable Legacy Kernel API<br />
: This enables the legacy API used in vs1.xx, maintaining compatibility with older vserver tools, and guest images that are configured using the legacy method.<br />
<br />
; Show a Legacy Version ID<br />
: This shows a special legacy version to very old tools which do not handle the current version correctly. This will probably disable some features of newer tools so better avoid it, unless you really, really need it for backwards compatibility.<br />
<br />
; Enable dynamic context IDs<br />
: This enables support for in-kernel dynamic context IDs which are deprecated and soon to be removed.<br />
<br />
; Enable/Disable Legacy Networking Kernel API<br />
: This enables/disables the legacy networking API which is required by the chbind tool in util-vserver <= 0.30.209. Do not disable it unless you exactly know what you are doing.<br />
<br />
; Automatically Assign Loopback IP<br />
: Enable this to get a unique 127.x.y.1(x.y matches the context id) address for each network context automatically, and enable the NXF_LBACK_REMAP and NXF_HIDE_LBACK flags. This creates a per-guest, isolated 127.0.0.1 address.<br />
<br />
; Automatic Single IP Special Casing<br />
: Enabling this option will make the kernel automatically set NXF_SINGLE_IP for contexts which have only one IP address (note: an lback address does not count).<br />
<br />
; Remap Source IP Address<br />
: This allows to remap the source IP address of 'local' connections from 127.0.0.1 to the first assigned guest IP.<br />
<br />
; Enable COW Immutable Link Breaking<br />
: This enables the COW (Copy-On-Write) link break code. It allows you to treat [[Unification|unified files]] like normal files when writing to them (which will implicitly break the link and create a copy of the unified file)<br />
<br />
; Enable Virtualized Guest Time<br />
: This enables per guest time offsets to allow for adjusting the system clock individually per guest. This adds some overhead to the time functions and therefore should not be enabled without good reason.<br />
<br />
; Enable Guest Device Mapping<br />
: This enables a generic remapping/access control interface for device nodes used inside the guest.<br />
<br />
; Enable Proc Security<br />
: This configures [[Secure ProcFS Entries|ProcFS security]] to initially hide non-process entries for all contexts except the main and spectator context (i.e. for all guests), which is a secure default.<br />
<br />
; Enable Hard CPU Limits<br />
: This will compile in code that allows the [[CPU Scheduler|Token Bucket Scheduler]] to put processes on hold when a context's tokens are depleted (provided that its per-context sched_hard flag is set).<br />
<br />
; Avoid idle CPUs by skipping Time<br />
: This option allows the scheduler to artificially advance time (per cpu) when otherwise the idle task would be scheduled, thus keeping the cpu busy and sharing the available resources among certain contexts.<br />
<br />
; Limit the IDLE task<br />
: Limit the idle slices, so the the next context will be scheduled as soon as possible. This might improve interactivity and latency, but will also marginally increase scheduling overhead.<br />
<br />
; Persistent Inode Tagging<br />
: This adds persistent context information to filesystems mounted with the tagxid option. [[Filesystem Tagging|Tagging]] is a requirement for per-context [[Disk Limits and Quota]].<br />
<br />
; Tag NFSD User Auth and Files<br />
: Enable this if you do want the in-kernel NFS Server to use the xid tagging specified above.<br />
<br />
; Enable Inode Tag Propagation<br />
: This allows for the tagid= mount option to specify a tagid which is to be used for the entire mount tree.<br />
<br />
; Honor Privacy Aspects of Guests<br />
: When enabled, most context checks will disallow access to structures assigned to a specific context, like ptys or loop devices.<br />
<br />
; Maximum number of Contexts<br />
: This makes sure that at least this many contexts can be created, by making sure that this much per-CPU memory is available.<br />
<br />
; VServer Warnings<br />
: Enables warnings. There's not really a good reason to disable it.<br />
<br />
; VServer Debugging Code<br />
: Set this to yes if you want to be able to activate debugging output at runtime. It adds a probably small overhead to all vserver related functions and increases the kernel size by about 20k.<br />
<br />
; VServer History Tracing<br />
: This records a history of Linux-VServer events that can be replayed in the event of a panic or an oops.<br />
<br />
; Per-CPU History Size<br />
: This allows you to set the size of the per-CPU history buffer.<br />
<br />
; VServer Scheduling Monitor<br />
: Set this to yes if you want to record the scheduling decisions, so that they can be relayed to userspace for detailed analysis.<br />
<br />
; Per-CPU Monitor Queue Size<br />
: This allows you to specify the number of entries in the per-CPU scheduling monitor buffer.<br />
<br />
; Per-CPU Monitor Sync Interval<br />
: This allows you to specify the interval in ticks when a time sync entry is inserted.<br />
<br />
=== Compiling and Installing ===<br />
<br />
Now that your kernel is configured, it is time to compile and install it. Exit the configuration and start the compilation process: <br />
<br />
<pre><br />
# make && make modules_install<br />
</pre><br />
<br />
If you don't happen to have a really fast box, it is a good time to get a new cup of coffee now ;)<br />
<br />
When the kernel has finished compiling, you have to copy the kernel image to your /boot partition and configure your boot loader. If you don't know how to do this, please consult your distribution manual or ask [http://www.google.com Google] for help.<br />
<br />
== Manual util-vserver Compilation ==<br />
<br />
The kernel alone does not help you, you also need some tools to exploit all those new features you got, so let's get them.<br />
<br />
=== Getting the Sources ===<br />
<br />
You will have to download the latest util-vserver source tarball from our [[Downloads]] section. In this guide we will use util-vserver-0.30.215.<br />
<br />
As a first step, of course, we need to get the sources.<br />
<br />
<pre><br />
# Go to our source directory<br />
cd ~/src<br />
<br />
# Get the sources for util-vserver<br />
wget http://ftp.linux-vserver.org/pub/utils/util-vserver/util-vserver-0.30.215.tar.bz2<br />
<br />
# Extract the sources<br />
tar xjf util-vserver-0.30.215.tar.bz2<br />
</pre><br />
<br />
=== Compiling and Installing ===<br />
<br />
Now that we have extracted the util-vserver source we have to do the usual configure, make, make install chain. While configuring the tools you may get some error messages about missing stuff, for example dietlibc, vconfig and e2fs headers. The error messages are accompanied by explanations what you should do, so read them carefully.<br />
<br />
<pre><br />
# Switch to the util-vserver source directory<br />
cd util-vserver-0.30.215<br />
<br />
# Configure the sources (you may want to adjust settings here, the defaults work, but may not suit your needs)<br />
./configure --prefix=... --sysconfdir=... --localstatedir=...<br />
<br />
# Build the tools<br />
make<br />
<br />
# Install the tools<br />
make install install-distribution<br />
<br />
# It's a good point to fix the /proc entries for the guests<br />
/etc/init.d/vprocunhide restart (this path depends on configuration, see output of 'vserver-info')<br />
</pre><br />
<br />
=== Enabling VServers on startup ===<br />
<br />
You need to enable 2 initscripts:<br />
* <code>vprocunhide</code> - does necessary stuff in <code>/proc</code><br />
* <code>vservers-default</code> - runs vservers marked as 'default' (<code>echo "default" > /etc/vservers/XXX/apps/init/mark</code>) on startup<br />
<br />
To do so, you can use 'update-rc.d' or 'rcconf' (Debian), 'chkconfig' or 'ntsysv' (Fedora).<br />
<br />
If you get errors like:<br />
<pre><br />
/proc/uptime can not be accessed. Usually, this is caused by<br />
procfs-security. Please read the FAQ for more details<br />
http://linux-vserver.org/Proc-Security<br />
</pre><br />
then you probably need to enable <code>vprocunhide</code>.<br />
<br />
=== Testing your setup ===<br />
<br />
To ensure that your setup works we have created two small test scripts. The testme.sh script ensures basic functionality whereas the testfs.sh script is for inode attribute testing for various filesystems.<br />
<br />
<pre><br />
# get the script<br />
wget http://vserver.13thfloor.at/Stuff/SCRIPT/testme.sh<br />
<br />
# make it executable<br />
chmod +x testme.sh<br />
<br />
# run the test script<br />
./testme.sh<br />
</pre><br />
<br />
'''Be careful! The testfs.sh script might easily reformat your hard disk :)'''<br />
<br />
<pre><br />
# get the script<br />
wget http://vserver.13thfloor.at/Stuff/SCRIPT/testfs.sh<br />
<br />
# make it executable<br />
chmod +x testfs.sh<br />
<br />
# make a loopback file<br />
dd bs=1024k count=1024 if=/dev/zero of=1gb.testfile<br />
<br />
# setup the loopback<br />
losetup /dev/loop0 1gb.testfile<br />
<br />
# run the test script for legacy mode<br />
./testfs.sh -l -t -D /dev/loop0 -M /mnt<br />
<br />
# run the test script for new-style config<br />
./testfs.sh -t -D /dev/loop0 -M /mnt<br />
</pre><br />
<br />
If the scripts show any error, be sure to read [[Report a Bug|how to report a bug]] and contact the Linux-VServer Developers for help. See [[Communicate]] for details.<br />
<br />
== Where to go from here ==<br />
<br />
Now that your setup is complete and working as expected, it is time to create your first guest system. Read on at [[Building Guest Systems]].</div>82.238.35.175http://wiki.linux-vserver.org/util-vserver:Documentationutil-vserver:Documentation2009-01-09T17:00:42Z<p>82.238.35.175: link to util-vserver installation</p>
<hr />
<div>{{NeedCompletion}}<br />
<br />
These pages describe how to configure VServer, more particularly the 'util-vserver' tools to manage the vservers.<br />
<br />
(For installing 'util-vserver', check [http://linux-vserver.org/Documentation#Installation Installation])<br />
<br />
[http://www.nongnu.org/util-vserver/doc/conf/configuration.html The Great Flower Page] - a reference for the util-vserver configuration<br /><br />
[[util-vserver:Capabilities_and_Flags]]<br /><br />
[[util-vserver:Logging]]<br /><br />
[[util-vserver:InitStyles]]<br /><br />
[[util-vserver:Vhashify]]<br /><br />
[[util-vserver:Fstab]]<br /><br />
[[util-vserver:Bash_Completion]]<br /><br />
[[util-vserver:Howto_virtualize_an_exisiting_Linux_server]]<br /><br />
[[util-vserver:Useful commands]]<br /></div>82.238.35.175http://wiki.linux-vserver.org/DocumentationDocumentation2009-01-09T16:57:14Z<p>82.238.35.175: /* Installation */ describe "Installation on Linux 2.6" link</p>
<hr />
<div><div style="margin: 2em auto 2em auto; padding: 10px; background-color: #F9ECCD; border: 1px solid #004433; text-align: center;"><br />
[[Image:Icon-Caution.png|left]]<br />
We are currently migrating to MediaWiki from our old system, but not all content has been migrated yet. Take a look at the [[Wiki Team]] page for instructions how to help or look at the [http://oldwiki.linux-vserver.org old wiki] to find the information not migrated yet.<br />
<br />
'''To ease migration we created a [[List of old Documentation pages]].'''<br />
</div><br />
<br />
== Introduction ==<br />
<br />
* [[Overview|Virtualization Overview]]<br />
* [[Usage Scenarios]]<br />
* [[Feature Matrix]]<br />
<br />
== Installation ==<br />
<br />
* [[Installation Considerations]]<br />
* [[Installation on Linux 2.6]]: from source, both the kernel and util-vserver<br />
* [[Installation on ArchLinux]]<br />
* [[Installation on CentOS]]<br />
* [[Installation on Debian]]<br />
* [[Installation on Fedora]]<br />
* [[Installation on Gentoo]]<br />
* [[Installation on Mandrake]]<br />
* [http://pld-linux.org/Vserver Installation on PLD-Linux]<br />
* [[Installation on Redhat]]<br />
* [[Installation on Slackware]]<br />
* [[Installation on SuSE/OpenSUSE]]<br />
* [[Installation on Ubuntu]]<br />
<br />
== Configuration ==<br />
<br />
* [[util-vserver:Documentation|util-vserver Documentation]]<br />
* [[vcd:Documentation|VServer Control Daemon Documentation]]<br />
* [[Share a directory among multiple guests]]<br />
<br />
== Guides and Howtos ==<br />
<br />
* [[Building Guest Systems]]<br />
* [[util-vserver:Howto virtualize an exisiting Linux server|Howto virtualize an existing Linux server]]<br />
* [[VCMD HowTo]]<br />
* [[Howto make bsd-style init sysv-compatible|Howto make Bsd-style init sysv-compatible (archlinux guest system)]]<br />
* [[Installing 32-bit Fedora on 64-bit Debian]]<br />
* [[Installing Ubuntu on Debian]]<br />
* [[Installing an openSUSE vserver guest]]<br />
* [[Networking vserver guests]]<br />
* [[Howto HostAuth]]<br />
* [[Fuse_GlusterFS| Fuse and GlusterFS]]<br />
* [[yum-patch|How to patch vyum]]<br />
* [[yum-upgrade-3.2.4|Upgrading existing installations to yum-3.2.4]]<br />
* [[Migrating from OpenVZ to Linux-Vserver]]<br />
* [[Getting_high_with_lenny]]<br />
* [[Installing_Ubuntu_Hoary_as_guest| Installing Ubuntu Hoary as guest]]<br />
* [[Applying CPU Limits]]<br />
<br />
== Lists &amp; Theory ==<br />
<br />
* Basic configuration<br />
** [[Capabilities and Flags]]<br />
** [[CPU Scheduler]]<br />
** [[Disk Limits and Quota]]<br />
** [[Resource Limits]]<br />
*** [[Memory Limits]]<br />
** [[Virtual System Information]]<br />
** [[Unification]]<br />
<br />
* Security Considerations<br />
** [[Secure Capabilities]]<br />
** [[Secure chroot Barrier]]<br />
** [[Secure Device Nodes]]<br />
** [[Secure ProcFS Entries]]<br />
<br />
* Performance and Stability<br />
** [[Virtualization Overhead]]<br />
<br />
* Implementation Details<br />
** [[Context Accounting]]<br />
** [[Filesystem Attributes]]<br />
** [[Filesystem Tagging]]<br />
** [[Filesystem Namespaces]]<br />
** [[Kernel Userspace Helper]]<br />
** [[Mainline Kernel Virtualization]]<br />
** [[ProcFS]]<br />
** [[Syscall Command Switch]]<br />
<br />
== External Resources ==</div>82.238.35.175http://wiki.linux-vserver.org/VServer_UsersVServer Users2008-05-02T19:47:48Z<p>82.238.35.175: GNU Savannah</p>
<hr />
<div>Here is a list of '''Individuals and Organizations''' utilizing '''Linux-VServer''' technology'''...<br />
<br />
{| class="wikitable" style="width: 97%"<br />
! style="width: 20%" | Name <br />
! rowspan="2" | Description<br />
|-<br />
| Location<br />
|-<br />
! [http://www.fuchs.info/ Guenther Fuchs]<br />
| rowspan=2 |<br />
Since 2002 I used vserver in experimental systems and since <br />
2004 in production environment for own hostings including Linux router. <br />
Herbert & the other guys did great work in improving the System <br />
tho the actual level.<br />
<br />
Two years ago I had the chance to compare the system to SW-Soft's <br />
Virtuozzo (very expensive license model that time), that time the <br />
development did not totally fit my needs for commercial webhosting <br />
(and my time to read through the doc's was not enough). <br />
But meanwhile one could fully rely on it - and comparing the <br />
SW-Soft support to Herbert's replies on the mailing list, <br />
there is no other choice to take ;-)<br />
<br />
If I'd need a commercial vserver system again, I'd choose this one now <br />
- thank's for the improvement and stability and - not to forget <br />
- the GNU licensing!<br />
|-<br />
| Austria<br />
|-<br />
! ISPGaya<br />
| rowspan=2 |<br />
ISPGaya (Instituto Superior Politécnico Gaya) is a "non profit" <br />
private university in Portugal.<br />
<br />
We have been using the Linux-VServer technology for about 2 years now.<br />
<br />
Our university has about 900+ users which gives us the ability to test <br />
the technology on a production environment.<br />
All our linux servers depend on it and we currently run about 20 <br />
virtual servers on them.<br />
<br />
The system seems pretty stable and the developers (especially Herbert Poetzl) <br />
keep us up to date with ("almost daily") new bugfixes/features.<br />
<br />
We haven't seen any performance problems by using this technology <br />
and encourage everybody to try it out.<br />
|-<br />
| Portugal<br />
|-<br />
! Digital Evolution<br />
| rowspan=2 |<br />
We use Linux-VServer for all wargames (more than a dozen right now) and all <br />
other services as well. The stability, ease of use and performance is <br />
unrivaled, migrating our servers to vserver is most definately one of <br />
the best decisions we've ever made. It happily serves all people <br />
(who, after all, try to break our security) logged in on our shellbased <br />
wargames and shells out hunderedes of thousands connections to other <br />
services each day.<br />
|-<br />
| Sweden<br />
|-<br />
! Nico<br />
| rowspan=2 |<br />
I use a Lycos VDS based on the vserver for a personnal server <br />
(irc, mail, www). It works fine and very cheap.<br />
<br />
Thanks!<br />
|-<br />
|<br />
|-<br />
! [http://www.assonetworx.com Association Networx]<br />
| rowspan=2 |<br />
happily running a Linux-VServer box for its mail and hosting services. <br />
Thx for the great work Bertl !<br />
|-<br />
| France<br />
|-<br />
|-<br />
! CAPEC<br />
| rowspan=2 |<br />
Research center capec.kt.dtu.dk is happily using Linux-VServer for <br />
web/CVS/automatic software build system. Rock solid, very easy to <br />
manage in the every day life. Thanks, Loïch<br />
|-<br />
| Denmark<br />
|-<br />
! Institute of Legal Medicine<br />
| rowspan=2 |<br />
The Institute of Legal Medicine, Medical University of Innsbruck/Austria, <br />
is using the excellent Linux-VServer technology to be able to fit <br />
all computing requirements for different scientific projects. <br />
<br />
Works very well, and improved the service for our scientists!<br />
|-<br />
| Austria<br />
|-<br />
! University of Padova<br />
| rowspan=2 |<br />
A Department of the university of Padova, Italy, runs happily <br />
on Linux-VServers. <br />
<br />
Really changed the life of administrators and improved service. <br />
Thanks! Grat Job! -mmzz<br />
|-<br />
| Italy<br />
|-<br />
! [http://www.iwm-kmrc.de Knowledge Media]<br />
Research Center<br />
| rowspan=2 |<br />
The Knowledge Media Research Center in [http://www.tuebingen.de Tübingen], <br />
Germany now uses [http://www.gentoo.org Gentoo Linux] based VServers<br />
<br />
* to run educational software on a scientific, i.e. psychological background,<br />
* to develop a platform independent, highly intuitive collaborative working tool named bebop that will soon be available under GPL,<br />
* to test drive changes of the in house network structure,<br />
* and to demonstrate the possibilities of modern Linux systems.<br />
<br />
On behalf of all colleagues we want to thank the developers of Linux-VServer!<br />
<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.swissgamers.ch SwissGamers.ch]<br />
| rowspan=2 |<br />
Uses Linux-VServer on all machines. <br />
Thank you guys, many things wouldn't be possible without <br />
Linux-VServer the way we do it, great job :)<br />
|-<br />
| Swiss<br />
|-<br />
! Yarihm<br />
| rowspan=2 |<br />
Linux-VServer patch installed, even on machines without vservers --<br />
I like it that much ,)<br />
|-<br />
|<br />
|-<br />
! [http://svpdata.de SVPData Ltd.]<br />
| rowspan=2 |<br />
We run Linux-VServer on a Debian Machine (production system) and a <br />
SuSe Machine (Testing System). We use Linux-VServer mainly for partitioning<br />
the www-server and the ftp-server. We also run a few MUSH Systems. <br />
<br />
We are really happy with Linux-VServer and would not use any <br />
other virtualization Software.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.tgunkel.de Thorsten Gunkel]<br />
| rowspan=2 |<br />
<br />
I switched my small private Debian Linux-server to VServer. <br />
Now I have lots of small Linux-VServer installations with only <br />
a minimum number of packages installed. <br />
<br />
IMHO it's easier to maintain, I have no noticeable performance loss, <br />
extra security if one of the systems is breached and since I <br />
started to use it (end of 2004) no problems with Linux-VServer ever <br />
(now it's 2006)! If you're interested in my Linux-VServer I try to <br />
document its current state on my website: <br />
[http://www.tgunkel.de/it/software/doc/linux_server.en Linux Server with VServer].<br />
<br />
P.S.: Support in the IRC channel and the mailinglist has been <br />
always very helpful, thanks!<br />
|-<br />
| Germany<br />
|-<br />
! ''Unknown''<br />
| rowspan=2 |<br />
I've installed Linux-VServer at my university for internal use, <br />
for university courses of operating systems and for other <br />
didactical purposes. <br />
<br />
It works greatly, and I'm really happy of that :)<br />
<br />
But above all, IRC support on #vserver is always kind and effective! <br />
Thanks to everyone in the community.<br />
|-<br />
|<br />
|-<br />
! [http://www.powersource.cx PowerSource]<br />
| rowspan=2 |<br />
I've been using Linux-VServer since 2004, and have been happy about it ever since. Using it to separate services from the host system's software and being able to move around services (so vservers) from one host to the other without too much trouble<br />
<br />
The IRC support is more than fabulous, thanks to the entire team!<br />
|-<br />
| Belgium<br />
|-<br />
! [http://www.phyxia.net Phyxia Networks]<br />
| rowspan=2 |<br />
Using vserver to be able to offer services which need to be separated from the host, and to cut back on some machines which would take up space and power but can just as well run virtualized.<br />
|-<br />
| Belgium<br />
|-<br />
! [http://emssupport.calumet.purdue.edu Purdue University Calumet]<br />
| rowspan=2 |<br />
We have been using Linux-VServer within the Department of Engineering, Math, and Science at Purdue Calumet since Dec 2005. I am absolutely amazed at how resource friendly vserver is. We are currently running 8 production and 3 development guest os's on 1 host. The host and the guest os's are all Gentoo except for 1, which is Arch Linux. The other Windows admins are really impressed at how well Linux vserver runs. It's even helped move some current and future services to Linux instead of Windows.<br />
One of the guests is even running a [http://www.cs.wisc.edu/condor Condor] master server for the [http://www.nwicgrid.org NorthWest Indiana Computing Grid] project.<br />
<br />
Thank you very much to all of the developers who are putting so much effort into this project.<br />
|-<br />
| Hammond, Indiana USA<br />
|-<br />
<!-- Start your copy here for a template --><br />
<!-- Website followed by Link text --><br />
! [http://www.businessconnect.nl Business Connect Internet Services]<br />
| rowspan=2 |<br />
<!-- Start description --><br />
We are using vserver to split up our public services and to minimize downtime while upgrading the systems. Thanks a lot and keep up the great work!!<br />
<!-- End description --><br />
|-<br />
<!-- Your location --><br />
| The Netherlands<br />
<!-- End location --><br />
|-<br />
<!-- End copy here for template --><br />
<!-- Start your copy here for a template --><br />
<!-- Website followed by Link text --><br />
! [http://softwarelibre.udc.es Free Software Office - UDC]<br />
| rowspan=2 |<br />
<!-- Start description --><br />
The Free Software Office of the University of A Coruña uses the great Linux-VServer<br />
technology to deliver free, bullet-proof, high quality services to the universitary<br />
community since April 2007. We currently use about a dozen guest virtual machines<br />
distributed in two hosts in order to provide a number of services, including Subversion<br />
repositories, internal FTP for university staff, Jabber messaging... and of course our<br />
own website. We geared towards VServer after testing other alternatives because of its<br />
performance, ease of administration and the fact that VServer is officially supported<br />
the GNU/Linux distribution we have chosen (Gentoo). We are grateful for the existence of<br />
such a nice piece of software.<br />
<!-- End description --><br />
|-<br />
<!-- Your location --><br />
| Spain<br />
<!-- End location --><br />
|-<br />
<!-- End copy here for template --><br />
<!-- Start your copy here for a template --><br />
<!-- Website followed by Link text --><br />
! [http://www.integra-ev.de INTEGRA e.V.]<br />
| rowspan=2 |<br />
<!-- Start description --><br />
Currently we are running two virtual servers. One of them contains a webserver, a mailserver and other special software to support our work as student consultants. The second virtual server is used for software development and testing.<br />
<br />
Thank you very much for your great work!<br />
<!-- End description --><br />
|-<br />
<!-- Your location --><br />
| Germany<br />
<!-- End location --><br />
|-<br />
<!-- End copy here for template --><br />
<br />
<!-- Start your copy here for a template --><br />
<!-- Website followed by Link text --><br />
! [http://lihas.de LiHAS - Adrian Reyer]<br />
| rowspan=2 |<br />
<!-- Start description --><br />
We are maintaining several dozen of virtual servers, mainly as high availabiltiy clusters in combination with Heartbeat and DRBD on LVM2.<br />
<!-- End description --><br />
|-<br />
<!-- Your location --><br />
| Germany<br />
<!-- End location --><br />
|-<br />
<!-- End copy here for template --><br />
<br />
<!-- Start your copy here for a template --><br />
<!-- Website followed by Link text --><br />
! [http://savannah.gnu.org/ GNU Savannah]<br />
| rowspan=2 |<br />
<!-- Start description --><br />
Savannah offers developer services (CVS/SVN/Git, bug trackers, download area...), and runs exclusively on Free Software.<br />
<br />
Everything is served from a single box, but architectured in maintainable independent vservers since 9/2006.<br />
The latest Debian upgrade (Etch) could be run remotely and step-by-step, with almost no downtime.<br />
Different level of security can be provided at once on the same box, adapted to each service (restricted shell for VCSes, full read/write without local access for SFTP, etc.).<br />
<!-- End description --><br />
|-<br />
<!-- Your location --><br />
| USA<br />
<!-- End location --><br />
|-<br />
<!-- End copy here for template --><br />
<br />
|}</div>82.238.35.175http://wiki.linux-vserver.org/Frequently_Asked_QuestionsFrequently Asked Questions2007-02-18T19:30:02Z<p>82.238.35.175: What is the inital PATH?</p>
<hr />
<div><div style="margin: 2em auto 2em auto; padding: 10px; background-color: #F9ECCD; border: 1px solid #004433; text-align: center;"><br />
[[Image:Icon-Caution.png|left]]<br />
We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the [[Wiki Team]] page for instructions how to help or look at the [http://oldwiki.linux-vserver.org old wiki] to find the information not migrated yet.<br />
<br />
'''To ease migration we created a [[List of old Documentation pages]].'''<br />
</div><br />
<br />
CURRENTLY THE CONTENT OF THE OLD WIKI FAQ (AND MORE) IS BEING MIGRATED TO THIS PAGE (TASK: DERJOHN)<br />
<br />
<br />
__TOC__<br />
<br />
{{Question|Question=What is a 'Guest'?||Details=To talk about stuff, we need some naming. The physical machine is called 'Host' and the 'main' context running the Host Distro is called 'Host Context'. The virtual machine/distro is called 'Guest' and basically is a Distribution (Userspace) running inside a 'Guest Context'.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=What kind of Operating System (OS) can I run as guest?||Details=<br />
A: With VServer you can only run Linux guests. The trick is that a guest does not run a kernel on its own (as XEN and UML do), it merely uses a virtualized host kernel-interface. VServer offers so called security contexts which make it possible to seperate one guest from each other, i.e. they cannot get data from each other. Imagine it as a chroot environment with much more security and features.|Signature=derjohn}}<br />
<br />
{{Question|Question=Which distributions did you test?||Details=<br />
A: Some. Check out the wiki for ready-made guest images. But you can easily build own guest images, e.g. with Debian's debootstrap. Checkout ((Building Guest Systems)) how to do that.|Signature=derjohn}}<br />
<br />
{{Question|Question=Is VServer comparable to XEN/UML/QEMU?||Details=<br />
A: Nope. XEN/UML/QEMU and VServer are just good friends. Because you ask, you probably know what XEN/UML/QEMU are. VServer in contrary to XEN/UML/QEMU not "emulate" any hardware you run a kernel on. You can run a VServer kernel in a XEN/UML/QEMU guest. This is confirmed to work at least with Linux 2.6/vs2.0.|Signature=derjohn}}<br />
<br />
{{Question|Question=Is VServer secure?||Details=<br />
A: We hope so. It should be as least as secure as Linux is. We consider it much much more secure though.|Signature=derjohn}}<br />
<br />
{{Question|Question=Performance?||Details=<br />
A: For a single guest, we basically have native performance. Some tests showed insignificant overhead (about 1-2%) others ran faster than on an unpatched kernel. This is IMVHO significantly less than other solutions waste, especially if you have more than a single guest (because of the resource sharing).|Signature=derjohn}}<br />
<br />
{{Question|Question=Is SMP Supported?||Details=<br />
A: Yes, on all SMP capable kernel architectures.|Signature=derjohn}}<br />
<br />
{{Question|Question=Resource sharing?||Details=<br />
A: Yes ....<br />
* memory: Dynamically.<br />
* CPU usage: Dynamically (token bucket)|Signature=derjohn}}<br />
<br />
{{Question|Question=Resource limiting?||Details=<br />
A: Yes, you can set maximum limits per guest, but you can only offer guaranteed resource availability with some ticks at the time. There is the possibility to ulimit and to rlimit. Rlimit is a new feature of kernel 2.6/vs2.0.|Signature=derjohn}}<br />
<br />
{{Question|Question=Disk I/O limiting? Is that possible?||Details=<br />
A: Well, since vs2.1.1 Linux-VServer supports a mechanism called 'I/O scheduling', which appeared in the 2.6 mainline some time ago. The mainline kernel offers several I/O schedulers:<br />
<br />
<pre><br />
# cat /sys/block/hdc/queue/scheduler<br />
noop [anticipatory] deadline cfq<br />
</pre><br />
<br />
The default is anticipatory a.k.a. "AS". When running several guests on a host you probably want the I/O performance shared in a fair way among the different guests. The kernel comes with a "completely fair queueing" scheduler, CFQ, which can do that. (More on schedulers can be found at http://lwn.net/Articles/114770/)<br />
<br />
This is how to set the scheduler to "cfq" manually:<br />
<pre><br />
root# echo "cfq" > /sys/block/hdc/queue/scheduler<br />
root# cat /sys/block/hdc/queue/scheduler<br />
noop anticipatory deadline [cfq]<br />
</pre><br />
<br />
Keep in mind that you have to do it on all physical discs. So if you run an md-softraid, do it to all physical /dev/hdXYZ discs!<br />
<br />
If you run Debian there is a predefined way to set the /sys values at boot-time:<br />
<br />
<pre><br />
# apt-get install sysfsutils<br />
[...]<br />
<br />
# cat /etc/sysfs.conf | grep cfq<br />
block/sda/queue/scheduler = cfq<br />
block/sdc/queue/scheduler = cfq<br />
<br />
# /etc/init.d/sysfsutils restart<br />
</pre><br />
<br />
For non-vserver processes and CFQ you can set by which key the kernel decides about the fairness:<br />
<br />
<pre><br />
cat /sys/block/hdc/queue/iosched/key_type<br />
pgid [tgid] uid gid<br />
</pre><br />
Hint: The 'key_type'-feature has been removed in the mainline kernel recently. Don't look for it any longer :(<br />
<br />
The default is tgid, which means to share fairly among process groups. Think every guest is treated like a own process group. It's not possible to set a scheduler strategy within a guest. All processes belonging to the same guest are treated like "noop" within the guest. So: If you run apache and some ftp-server within the _same_ guest, there is no fair scheduling between them, but there is fair scheduling between the whole guest and all other guests.<br />
<br />
And: It's possible to tune the scheduler parameters in several ways. Have a look at /sys/block/hdc/queue/....|Signature=derjohn}}<br />
<br />
{{Question|Question=Why isn't there a device /dev/xyz within a guest?||Details=<br />
A: Device nodes allow userspace to access hardware (or virtual resources). Creating a device node inside the guest's namespace will give access to that device, so for security reasons, the number of 'given' devices is small.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is unification (vunify)?||Details=<br />
A: Unification is Hard Links on Steroids. Guests can 'share' common files (usually binaries and libraries) in a secure way, by creating hard links with special properties (immutable but unlinkable (removable)). The tool to identify common files and to unify them is called vunify.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is vhashify?||Details=<br />
A: The successor of vunify, a tool which does unification based on hash values (which allows to find common files in arbitrary paths.)<br />
<br />
It creates hardlinks to files named after a hash of the content of the file. If you have a recent version of the vserver patch (2.2+), with CONFIG_VSERVER_COWBL enabled, you can even modify the hardlinked files inside the vservers and the links will be broken automatically.<br />
<br />
There seems to be a catch when a hashified file has multiple hardlinks inside a guest, or when another internal hardlink is added after hashification. Link breaking will remove all the internal hardlinks too, so the guest will end up with different copies of the original file. The correct solution would be to not hashify files that have multiple links prior to hashification, and to break the link to the hashified version when a new internal hardlink is created. Apparently, this is not implemented yet (?).<br />
<br />
|Signature=Guy-}}<br />
<br />
{{Question|Question=How do I manage a multi-guest setup with vhashify?||Details=<br />
A: For 'vhashify', just do these once:<br />
<br />
<pre><br />
mkdir /etc/vservers/.defaults/apps/vunify/hash /vservers/.hash<br />
ln -s /vservers/.hash /etc/vservers/.defaults/apps/vunify/hash/root<br />
</pre><br />
<br />
Then, do this one line per vserver:<br />
<br />
<pre><br />
mkdir /etc/vservers/<vservername>/apps/vunify # vhashify reuses vunify configuration<br />
</pre><br />
<br />
To hashify a running vserver, do (possibly from a cronjob):<br />
<br />
<pre><br />
vserver name-of-guest hashify<br />
</pre><br />
<br />
The guest needs to be running because vhashify tries to figure out what files not to hashify by calling the package manager of the guest via <tt>vserver enter</tt>.<br />
<br />
In order for the OS cache to benefit from the hardlinking, you'll have to restart the vservers.<br />
<br />
To clean up hashified files that are no longer referenced by any vserver, do (possibly from a cronjob):<br />
<br />
<pre><br />
find /vservers/.hash -type f -links 1 -print0 | xargs -0 rm<br />
</pre><br />
<br />
Until you do this, the files still take up place even though no vservers need them.<br />
<br />
|Signature=Guy-}}<br />
<br />
{{Question|Question=With which version should I begin?||Details=<br />
A: If you are new to VServer I recommend to try the latest stable kernel patch, and the latest util-vserver "alpha" release.|Signature=derjohn}}<br />
<br />
{{Question|Question=Is there a way to implement "user/group quota" per VServer?||Details=<br />
A: Yes, but not on a shared partition for now. You need to put the guest on a separate partition, setup a vroot device (to make the quota access secure), copy that into the guest, and adjust the mtab line inside the guest.|Signature=derjohn}}<br />
<br />
{{Question|Question=What about "Quota" for a context?||Details=<br />
A: Context quotas are now called Disk Limits (so that we can tell them apart from the user/group quotas :). They are supported out of the box (with vs2.0+) for all major filesystems (ext2/3, ReiserFS, JFS)|Signature=derjohn}}<br />
<br />
{{Question|Question=Does it support IPv6?||Details=<br />
A: Currently it requires an additional patch, but the functionality should be available in 2.3+ soon. ((IPv6)) has more information.|Signature=derjohn}}<br />
<br />
{{Question|Question=I can't do all I want with the network interfaces inside the guest?||Details=<br />
A: For now the networking is 'Host Business' -- the host is a router, and each guest is a server. You can set the capability ICMP_RAW in the context of the guest, or even the capability CAP_NET_RAW (which would even allow to sniff interfaces of other guests!). Likely to change with ngnet. |Signature=derjohn}}<br />
<br />
{{Question|Question=Is there a web-based interface for vserver that will allow creation/deletion/configuration etc. of vserver guests?||Details=<br />
A. http://OpenVPS.org which is a set of scripts with a web-interface for webhosters/ISPs. http://Openvcp.org which is a distributed system (agent!) with a web-interface, with which you can build/remove guests. http://vsmon.revolutionlinux.com/ is a distributed monitoring-only solution that allows you to search for a particular vserver in your park. |Signature=derjohn}}<br />
<br />
{{Question|Question=What is old-style and new-style config?||Details=<br />
A. Old-style config refers to a single text-file that contains all the configuration settings. With new-style config the configuration is split into several directories and files. You should probably go for new-style config if you are asking.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is the "great flower page"?||Details=<br />
A. Well, [http://www.nongnu.org/util-vserver/doc/conf/configuration.html this page] contains all configuration options for util-vserver. The name of the page is derived from the stylesheet(s) it contains.|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I add several IPs to a vserver? ||Details=<br />
A: First of all a single guest vserver only supports up to 16 IPs (There is a 64-IP patch available, which is in "derjohn's kernel").<br />
Here is a little helper-script that adds a list of IPs defined in a text file, one per line.<br />
<pre><br />
#!/bin/bash<br />
j=1<br />
for i in `cat myiplist`; do<br />
j=$(($j+1))<br />
mkdir $j<br />
echo $i > $j/ip<br />
echo "24" > $j/prefix<br />
done<br />
</pre>|Signature=derjohn}}<br />
<br />
{{Question|Question=If my host has only one a single public IP, can I use RFC1918 IP (e.g. 192.168.foo.bar) for the guest vservers?||Details=<br />
A: Yes, use iptables with SNAT to masquerade it. <br />
<pre><br />
iptables -t nat -I POSTROUTING -s $VSERVER_NETZ ! -d $VSERVER_NETZ -j SNAT --to $EXT_IP<br />
</pre><br />
See: [[HowtoPrivateNetworking]] and <br />
http://www.tgunkel.de/it/software/doc/linux_server.en#h3-VServer_Masquerading_SNAT (THX, [MUPPETS]Gonzo)|Signature=derjohn}}<br />
<br />
{{Question|Question=If I shut down my vserver guest, the whole Internet interface ethX on the host is shut down. What happened? ||Details=<br />
A: When you shut down a guest (''i.e. vserver foo stop''), the IP is brought down on the host also. If this IP happens to be the primary IP of the host, the kernel will not only bring down the primary IP, but also all secondary IP addresses. But in very recent kernels, there is an option ''settable'' which prevents that nasty feature. It's called "alias promotion". You may set it via sysctl by adding ''net.ipv4.conf.all.promote_secondaries=1'' in /etc/sysctl.conf or via sysctl command line.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=I run a Debian host and want to build an Ubuntu guest. Howto?||Details=<br />
A: Simple ;) Assume you want to build a breezy guest on a sid host with IP 192.168.0.2 and hostname vubuntu, then do:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu<br />
</pre><br />
<br />
[UPDATE] Currently there are problems in building breezy under unclear circumstances, which seems to have to do with udev. If the above didnt work, try:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu -- --exclude=udev<br />
</pre><br />
In very recent versions of the utils, the problem should not occur anymore (it has to do with the 'secure-mount' if you look in the MLs)<br />
<br />
Well, sid's debootstrap knows how to bootstrap Ubuntu linux. Make sure to have a current debootstrap package: <br />
<pre><br />
apt-get update<br />
apt-get install debootstrap<br />
</pre><br />
The knowledge how to build ubuntu 'breezy badger' (which you probably want to be your guest at the time of writing) has been added recently.|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I make a vserver guest start by default?||Details=<br />
A: At least on Debian, I can tell you how to do it with the new-style config. If your guest is called "derjohn" and you want it to be started somewhere at the of your bootstrap process, then do:<br />
<pre><br />
echo "default" > /etc/vservers/derjohn/apps/init/mark<br />
</pre><br />
If you want to start it earlier, please read the init script "/etc/init.d/vserver-default" to find out how to do it. In most cases you don't need to change this. On Debian the vservers are started at "90", so after most other stuff is up (networking etc.).<br />
<br />
Besides that I created a small helper script for managing the autostart foo: ((vserver-autostart))|Signature=derjohn}}<br />
<br />
{{Question|Question=My host works, but when I start a guest it says that it has a problem with chbind.||Details=<br />
A: You are probably using util-vserver <= 0.30.209, which does use dynamic network contexts internally (With 0.30.210 this fact changed). So if you compiled your kernel without dynamic contexts, you may start guests, but you can't use the network context.The solution is either to switch to .210 util (or Hollow's toolset) or compile the kernel with dynamic network contexts.<br />
SE Keyword: invalid option `nid' testme.sh|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=When I try to ssh to the guest, I log into the host, even if I installed sshd on the guest. What's wrong here?||Details=<br />
A: Look at /etc/ssh/sshd_config of the host:<br />
<br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
#ListenAddress ::<br />
</pre><br />
<br />
And now change the setting to <br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
ListenAddress your.hosts.ip.here # not the guests IP! <br />
</pre><br />
<br />
Then '/etc/init.d/ssh restart' on the host, after that on the guest (if you did apt-get install ssh on the guest already.)<br />
<br />
Do I have to explain more? If the hosts sshd binds all available IP addresses on port 22 (The hosts 'sees' even all addresses of the guests!). So if the guest starts its sshd, it can't bind to port 22 any more. You need to change that setting only on the host. <br />
(BTW: A similar approach has to be done for a lot of daemons, e.g. Apache. If the daemon does not support an explicit bind, you may use the chbind command to 'hide' IP addresses from the daemon before starting.)|Signature=derjohn}}<br />
<br />
{{Question|Question=I did everything right, but the application foo does not start. What's up there?||Details=<br />
A: Before asking on the IRC channel, please check out the 'problematic programs' page:<br />
[[Problematic Programs]]|Signature=derjohn}}<br />
<br />
{{Question|Question=Bind9 does not like to start in my guest.||Details=<br />
A: Check out the ((ProblematicPrograms)) page and/or get my [http://linux-vserver.derjohn.de/bind9-packages/bind9-capacheck_9.3.2-2_i386.deb vserver-guest-ready Debian package] for Debian Sid guests and check out the [http://linux-vserver.derjohn.de/bind9-packages/README.txt readme]. (Hint: This is fresh stuff. Please give me feedback)<br />
<br />
[UPDATE] Since VServer Devel 2.1.1-rc18 you do not need to patch the userland tools anymore. The capabilities are masked.|Signature=derjohn}}<br />
<br />
{{Question|Question=Which guest vservers are running?||Details=<br />
A: Use vserver-stat to find out. Example output:<br />
<pre><br />
CTX PROC VSZ RSS userTIME sysTIME UPTIME NAME<br />
0 77 965.1M 334.6M 14m14s18 2m28s69 1h33m46 root server<br />
49152 7 14M 5.2M 0m00s40 0m00s30 1h30m15 chiffon<br />
</pre>|Signature=derjohn}}<br />
<br />
<br />
<br />
{{Question|Question=How can I reboot/halt guests?||Details=<br />
A: It depends. <br />
For legacy Linux-VServer (i.e. 1.2.x), you have to replace /sbin/halt in the guests with vreboot and start rebootmgr in the host. You also need to have a <guest>.conf file in /etc/vservers for each guest. Please have a look at /etc/init.d/rebootmgr.<br />
For Linux-VServer 2.0+, sys_reboot has been virtualized to do the right thing. No changes are needed in guests.|Signature=derjohn}}<br />
<br />
{{Question|Question=Do I really need the legacy-interfaces? What are these legacy-interfaces?||Details=<br />
A: Since Linux-VServer is an ongoing project, new features might replace old ones, some might require a development version. Legacy-interfaces are available for backward compability (which might be removed someday) with Linux-VServer 1.2.x.|Signature=derjohn}}<br />
<br />
{{Question|Question=I have a vserver running on a Linux kernel with preemption. Is VServer "preempt" safe?||Details=<br />
A: There are no known issues about running vserver on a preemption enabled kernel. I would like to add, that the vserver kernelhackers would probably exclude that option in 'make menuconfig' if there would be an incompatibility. Just my $.02 :)|Signature=derjohn}}<br />
<br />
{{Question|Question=Is this a new project? When was it started?||Details=<br />
A: The first public occurrence of Linux-VServer was Oct 2001. The initial mail can be found here: http://www.cs.helsinki.fi/linux/linux-kernel/2001-40/1065.html<br />
So you can expect a mature software product which does its magic quite well (And hey, we have a version > 2.0!)|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=Can I run an OpenVPN Server in a guest?||Details=<br />
A: Yes. I don't want to provide an in-depth OpenVPN tutorial, but want to show how I made OpenVPN work in a guest as server.<br />
<br />
First of all you have to prepare the host with a persistent tuntap interface in tap-mode. The tools we need come from the uml-utilities.<br />
Then you need to create a device /dev/net/tun, which the OpenVPN userspace daemon reads. We'll assume 10.10.10.100 is the server IP, and 10.10.10.101 is the client IP - to be cool be choose a /31 netmask (255.255.255.254), so we have a net without broadcast and don't waste IPs :)<br />
<br />
On the host do: <br />
<pre><br />
# apt-get install uml-utilities<br />
# cd /var/lib/vserver/<myopenvpnserver>/dev/<br />
# ./MAKEDEV tun<br />
(creates the dev/net/tun device accessible by te guest - even a tap interface need /dev/net/tun !)<br />
# tunctl -t tap0<br />
(creates the network device 'tap0' persistently)<br />
</pre><br />
<br />
Then add the ip to the guest:<br />
<pre><br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/ip<br />
10.10.10.100<br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/prefix<br />
31<br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/dev<br />
tap0<br />
(This kind of config brings the ip when the vserver is started - only the tap0 interface has to exist already, see above!)<br />
</pre><br />
<br />
Here is a sample config for the guest (which is acting as a server):<br />
<br />
Install OpenVPN package on server and client, in the Debian case:<br />
<pre><br />
# apt-get install openvpn<br />
</pre><br />
<br />
The server's conf looks like that:<br />
<pre><br />
# port and interface specs<br />
<br />
# behave like a ssl-webserver<br />
port 443<br />
proto tcp-server<br />
<br />
# tap device? (keep in mind you need /dev/net/tun !)<br />
dev tap0<br />
<br />
# now the ips we will use for the tunnel<br />
ifconfig 10.10.10.100 255.255.255.254<br />
ifconfig-noexec<br />
<br />
# the server part<br />
<br />
# Keep VPN connections, even if the client IP changes<br />
float<br />
<br />
# use compression (may also even obfuscate content filters)<br />
comp-lzo<br />
<br />
# use a static key - create it with 'openvpn --genkey --secret static.key'<br />
secret static.key<br />
<br />
# dont reload the key after a SIGUSR1<br />
persist-key<br />
<br />
# check alive all 10 secs<br />
keepalive 10 60<br />
<br />
# verbosity level (from 1 to 9, 9 is max log level)<br />
verb 4<br />
status openvpn-status.log<br />
</pre><br />
<br />
The client's conf may look like that (This example even makes the tunnel the clients default address):<br />
<pre><br />
# cat /etc/openvpn/client.conf<br />
# port and interface specs<br />
<br />
# the following is not necessary, if you bring up openvpn via Debian's init script:<br />
daemon ovpn-my-clients-name<br />
<br />
# behave like a ssl-webserver<br />
port 443<br />
proto tcp-client<br />
remote %%%<insert-the-guest-primary-public-ip-here>%%%%<br />
# what device tun ot tap?<br />
dev tap<br />
<br />
# now the ips we will use for the tunnel<br />
ifconfig 10.10.10.101 255.255.255.254<br />
<br />
# Keep VPN connections, even if the client IP changes<br />
float<br />
mssfix<br />
<br />
# use compression (may also even obfuscate content filters)<br />
comp-lzo<br />
<br />
# use a static key<br />
secret static.key<br />
<br />
# dont reload the key after a SIGUSR1<br />
persist-key<br />
<br />
# check alive all 10 secs<br />
keepalive 10 60<br />
<br />
# verbosity level (from 1 to 9, 9 is max log level)<br />
verb 4<br />
<br />
# set the default route<br />
route-gateway 10.10.10.100<br />
redirect-gateway def1<br />
# to add special routes you can do it wihtin the openvpn client conf:<br />
# route <dest> <mask> <gateway><br />
<br />
# if you need to connect via proxy (like squid)<br />
# http-proxy s p [up] [auth] : Connect to remote host through an HTTP proxy at<br />
# address s and port p. If proxy authentication is required,<br />
# up is a file containing username/password on 2 lines, or<br />
# 'stdin' to prompt from console. Add auth='ntlm' if<br />
# the proxy requires NTLM authentication.<br />
<br />
# http-proxy s p [up] [auth]<br />
<br />
<br />
# http-proxy-option type [parm] : Set extended HTTP proxy options.<br />
# Repeat to set multiple options.<br />
# VERSION version (default=1.0)<br />
# AGENT user-agent<br />
<br />
# http-proxy-option type [parm]<br />
</pre><br />
<br />
In the next lesson I will talk about OpenVPN's server mode, which can deal with with multiple clients connecting to one IP and one port (i.e. you only need one guest for tons of 'road warriors'), TLS connections and PKI.<br />
<br />
Contributions welcome. :)|Signature=derjohn}}<br />
<br />
{{Question|Question=32 vs 64 Bit? What should I take?||Details=<br />
A: If you have the choice make the host a 64 bit one. You can run a guest as 32 bit or as 64 bit on a 64 bit host. To run it as 32 bit, you need to compile the x86_64 (a.k.a. AMD64) with the following options:<br />
<br />
<pre><br />
[*] Kernel support for ELF binaries<br />
<M> Kernel support for MISC binaries<br />
[*] IA32 Emulation <---- without that, the entire 32bit API is not present<br />
<M> IA32 a.out support <br />
</pre><br />
<br />
You can force the guest to behave like a 32 environment like this:<br />
<pre><br />
echo linux_32bit > /etc/vservers/$NAME/personality<br />
echo i686 > /etc/vservers/$NAME/uts/machine<br />
</pre><br />
(thanks cehteh for the hint!)<br />
<br />
But you can force debootstrap to put 32 bit binaries into the guest by 'export ARCH=i386';<br />
<pre><br />
export ARCH=i386 ; vserver build .... <br />
</pre>|Signature=derjohn}}<br />
<br />
{{Question|Question=I want to (re)mount a partition in a running guest ... but the guest has no rights (capability) to (re)mount?||Details=<br />
A: I'll explain. I take as example your /tmp partition within the guest is too small, what will be likely the case if you stay with the 16MB default (vserver build mounts /tmp as 16 MB tmpfs!).<br />
<pre><br />
# vnamespace -e XID mount -t tmpfs -o remount,size=256m,mode=1777 none /var/lib/vservers/<guest>/tmp/<br />
</pre><br />
Be warned that the guest will not recognize the change, as the /etc/mtab file is not updated when you mount like this. To permanently change the mount, edit /etc/vserver/<guest>/fstab on the host.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=How do I limit a guests RAM? I want to prevent OOM situations on the host!||Details=<br />
A: First you can read [http://linux-vserver.org/Memory+Allocation] and [[Memory Limits]].<br />
<br />
If you want a recipe, do this:<br />
1. Check the size of memory pages. On x86 and x86_64 is usually 4 KB per page.<br />
2. Create /etc/vserver/<guest>/rlimits/<br />
3. Check your physical memory size on the host, e.g. with "free -m". maxram = kilobytes/pagesize.<br />
4. Limit the guests physical RAM to value smaller then maxram:<br />
<br />
<pre><br />
echo %%insertYourPagesHereSmallerThanMaxram%% > /etc/vserver/<guest>/rlimits/rss<br />
</pre><br />
<br />
5. Check your swapspace, e.g. with 'swapon -s'. maxswap = swapkilobytes/pagesize.<br />
6. Limit the guest's maximum number of as pages to a value smaller than (maxram+maxswap):<br />
<br />
<pre><br />
echo %%desiredvalue%% > /etc/vserver/<guest>/rlimits/as<br />
</pre><br />
<br />
It should be clear this can still lead to OOM situations. Example: You have two guests and your as limit per guest is greater than 50% of (maxram+maxswap). If both guests request their maximum at the same point in time, there will be not enough mem .....|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=Were can I get newer versions of VServer as ready made packages for Debian?||Details=<br />
A: Here you go: http://linux-vserver.derjohn.de/ . There is also some stuff on backports.org, but my kernels are always 'devel' branch.|Signature=derjohn}}<br />
<br />
{{Question|Question=Can I use iptables ?||Details=<br />
Yes but right now only on the host (rootserver). Please realize that all traffic is local and will not touch the forward chain.|Signature=BeginnerFAQ}}<br />
<br />
{{Question|Question=Trying to connect to a vserver from the host or another vserver on the same host fails||Details=<br />
strace shows<br />
<pre> <br />
sin_addr=inet_addr("xx.xx.xx.xx")}, yy) = -1 EINVAL (Invalid argument)<br />
</pre><br />
A: The host/guest cannot communicate with another guest on same host.<br />
* check all netmasks on all interfaces (do they overlap) ?<br />
* check policy routing (disable it temporary) ?<br />
* check that lo is up (Networking within a host/guest always uses lo interface)<br />
|Signature=CommonProblems}}<br />
<br />
{{Question|Question=#1 ERROR: capset(): Operation not permitted||Details=capabilities are not enabled in kernel-setup<br />
please check that CONFIG_SECURITY_CAPABILITIES is loaded or included in the kernel. ( check with "cat /path_to_kernel/.config | grep -i cap ")<br />
(2.6.11.5-vs-1.9.5 + 0.30-205)|Signature=IrcQuestions}}<br />
<br />
{{Question|Question=How can I make 'vserver start' mount the root filesystem?||Details=<br />
Mount it via /etc/vservers/vserver-name/fstab, make sure to set the option 'dev' e.g.:<br />
<pre>/dev/drbd0 / xfs rw,dev 0 0</pre><br />
|Signature=AdrianReyer}}<br />
<br />
{{Question|Question=How do I tag a guest's directory with xid?||Details=<br />
Tagging the guest's files gives you serveral advantages, e.g. the accoutung will work properly.<br />
Filesystem XID tagging only works on supported filesystem. Those are currently: ext2/3, reiserfs/reiser3, xfs and jfs.<br />
To activate the XID tagging you have to mount the filesystem with "-o tagxid". Attention: It's _not_ possible to "-o remount,tagxid", you have to mount it freshly. The guests will tag their files automatiaclly. If you copy files in from the host, you have to tag them manually like this:<br />
<pre>chxid -c xid -R /var/lib/vservers/<guest></pre><br />
Note: Context 0 and 1 will see all files, guests will only be able to acess untagged files and their own XID. They can see other XID files but no information about the file, e.g. no owner, no group, no permissions.<br />
|Signature=derjohn_and_gonzo_and_are}}<br />
<br />
More FAQs to be merged;<br />
[http://www.linux-vserver.org/Frequently_Asked_Questions_scratch]<br />
<br />
{{Question|Question=My mysqld running in a guest behaves strangely and is awfully slow/locks up||Details=<br />
This can be related to /tmp being too small. mysqld stores temporary tables in /tmp and as such, if a lot of queries happen and /tmp runs full this can cause one query to lock up whilst creating the tmp table and all other queries waiting to acquire the lock. There are two possible solutions to that problem: a.) Modify /etc/vservers/vserver-name/fstab and assign more memory to the tmpfs of /tmp and b.) remove the /tmp entry from /etc/vservers/vserver-name/fstab completly. Especially on database servers with a rather high load the second one might be the preferred method.|Signature=sp}}<br />
<br />
<br />
{{Question|Question=I deleted a guest's directory without shutting it down. Now I have a "ghost" running. Is there any possibility to get it out of proc without rebooting?||Details=vkill --xid <xid> -s 15; sleep 2; vkill --xid <xid> -s 9|Signature=daniel_hozac}}<br />
<br />
{{Question|Question=When using nice and su (for example, in the updatedb cron job), I get: su: Permission denied. What does it mean?||Details=A guest cannot lower its nice value - and that's what 'su' does through pam_limits which sets a nice value of 0. You can see it through strace:<br />
$ strace nice su nobody<br />
[...]<br />
setpriority(PRIO_PROCESS, 0, 0) = -1 EACCES (Permission denied)<br />
You can use 'su nobody -c nice some_cmd' instead.<br />
(Now there's the question of why a guest process cannot lower its nice value.)<br />
|Signature=daniel_hozac&Beuc}}<br />
<br />
{{Question|Question=What is the initial PATH?||Details=By default, vserver uses the 'sysv' startup style, which mimics the init process by running the 3rd runlevel through '/etc/init.d/rc 3' (or '/etc/rc.d/rc 3'). Usually this 'rc' script uses a hard-coded PATH. In the case it doesn't, util-vserver also mimics init's default PATH through /etc/vservers/.defaults/apps/init/environment, or if not present /usr/local/lib/util-vserver/defaults/environment. Beware that all those default PATH usually do not include /usr/local.|Signature=daniel_hozac&Beuc}}<br />
<br />
== Upgrade from 2.0 to 2.2 ==<br />
<br />
{{Question|Question=I now get errors like "ncontext: vc_net_create(): Invalid argument; dynamic contexts disabled." on startup. Vservers are not started||Details=Dynamic context are disabled by default and are deprecated. For example, tagxid and network checks won't be useable with dynamic ids. Now you should manually assign a explicit context to your vservers, like<br />
echo 101 > /etc/vservers/myvserv/context<br />
|Signature=daniel_hozac&Beuc}}</div>82.238.35.175http://wiki.linux-vserver.org/Frequently_Asked_QuestionsFrequently Asked Questions2007-02-18T19:22:36Z<p>82.238.35.175: su: Permission denied</p>
<hr />
<div><div style="margin: 2em auto 2em auto; padding: 10px; background-color: #F9ECCD; border: 1px solid #004433; text-align: center;"><br />
[[Image:Icon-Caution.png|left]]<br />
We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the [[Wiki Team]] page for instructions how to help or look at the [http://oldwiki.linux-vserver.org old wiki] to find the information not migrated yet.<br />
<br />
'''To ease migration we created a [[List of old Documentation pages]].'''<br />
</div><br />
<br />
CURRENTLY THE CONTENT OF THE OLD WIKI FAQ (AND MORE) IS BEING MIGRATED TO THIS PAGE (TASK: DERJOHN)<br />
<br />
<br />
__TOC__<br />
<br />
{{Question|Question=What is a 'Guest'?||Details=To talk about stuff, we need some naming. The physical machine is called 'Host' and the 'main' context running the Host Distro is called 'Host Context'. The virtual machine/distro is called 'Guest' and basically is a Distribution (Userspace) running inside a 'Guest Context'.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=What kind of Operating System (OS) can I run as guest?||Details=<br />
A: With VServer you can only run Linux guests. The trick is that a guest does not run a kernel on its own (as XEN and UML do), it merely uses a virtualized host kernel-interface. VServer offers so called security contexts which make it possible to seperate one guest from each other, i.e. they cannot get data from each other. Imagine it as a chroot environment with much more security and features.|Signature=derjohn}}<br />
<br />
{{Question|Question=Which distributions did you test?||Details=<br />
A: Some. Check out the wiki for ready-made guest images. But you can easily build own guest images, e.g. with Debian's debootstrap. Checkout ((Building Guest Systems)) how to do that.|Signature=derjohn}}<br />
<br />
{{Question|Question=Is VServer comparable to XEN/UML/QEMU?||Details=<br />
A: Nope. XEN/UML/QEMU and VServer are just good friends. Because you ask, you probably know what XEN/UML/QEMU are. VServer in contrary to XEN/UML/QEMU not "emulate" any hardware you run a kernel on. You can run a VServer kernel in a XEN/UML/QEMU guest. This is confirmed to work at least with Linux 2.6/vs2.0.|Signature=derjohn}}<br />
<br />
{{Question|Question=Is VServer secure?||Details=<br />
A: We hope so. It should be as least as secure as Linux is. We consider it much much more secure though.|Signature=derjohn}}<br />
<br />
{{Question|Question=Performance?||Details=<br />
A: For a single guest, we basically have native performance. Some tests showed insignificant overhead (about 1-2%) others ran faster than on an unpatched kernel. This is IMVHO significantly less than other solutions waste, especially if you have more than a single guest (because of the resource sharing).|Signature=derjohn}}<br />
<br />
{{Question|Question=Is SMP Supported?||Details=<br />
A: Yes, on all SMP capable kernel architectures.|Signature=derjohn}}<br />
<br />
{{Question|Question=Resource sharing?||Details=<br />
A: Yes ....<br />
* memory: Dynamically.<br />
* CPU usage: Dynamically (token bucket)|Signature=derjohn}}<br />
<br />
{{Question|Question=Resource limiting?||Details=<br />
A: Yes, you can set maximum limits per guest, but you can only offer guaranteed resource availability with some ticks at the time. There is the possibility to ulimit and to rlimit. Rlimit is a new feature of kernel 2.6/vs2.0.|Signature=derjohn}}<br />
<br />
{{Question|Question=Disk I/O limiting? Is that possible?||Details=<br />
A: Well, since vs2.1.1 Linux-VServer supports a mechanism called 'I/O scheduling', which appeared in the 2.6 mainline some time ago. The mainline kernel offers several I/O schedulers:<br />
<br />
<pre><br />
# cat /sys/block/hdc/queue/scheduler<br />
noop [anticipatory] deadline cfq<br />
</pre><br />
<br />
The default is anticipatory a.k.a. "AS". When running several guests on a host you probably want the I/O performance shared in a fair way among the different guests. The kernel comes with a "completely fair queueing" scheduler, CFQ, which can do that. (More on schedulers can be found at http://lwn.net/Articles/114770/)<br />
<br />
This is how to set the scheduler to "cfq" manually:<br />
<pre><br />
root# echo "cfq" > /sys/block/hdc/queue/scheduler<br />
root# cat /sys/block/hdc/queue/scheduler<br />
noop anticipatory deadline [cfq]<br />
</pre><br />
<br />
Keep in mind that you have to do it on all physical discs. So if you run an md-softraid, do it to all physical /dev/hdXYZ discs!<br />
<br />
If you run Debian there is a predefined way to set the /sys values at boot-time:<br />
<br />
<pre><br />
# apt-get install sysfsutils<br />
[...]<br />
<br />
# cat /etc/sysfs.conf | grep cfq<br />
block/sda/queue/scheduler = cfq<br />
block/sdc/queue/scheduler = cfq<br />
<br />
# /etc/init.d/sysfsutils restart<br />
</pre><br />
<br />
For non-vserver processes and CFQ you can set by which key the kernel decides about the fairness:<br />
<br />
<pre><br />
cat /sys/block/hdc/queue/iosched/key_type<br />
pgid [tgid] uid gid<br />
</pre><br />
Hint: The 'key_type'-feature has been removed in the mainline kernel recently. Don't look for it any longer :(<br />
<br />
The default is tgid, which means to share fairly among process groups. Think every guest is treated like a own process group. It's not possible to set a scheduler strategy within a guest. All processes belonging to the same guest are treated like "noop" within the guest. So: If you run apache and some ftp-server within the _same_ guest, there is no fair scheduling between them, but there is fair scheduling between the whole guest and all other guests.<br />
<br />
And: It's possible to tune the scheduler parameters in several ways. Have a look at /sys/block/hdc/queue/....|Signature=derjohn}}<br />
<br />
{{Question|Question=Why isn't there a device /dev/xyz within a guest?||Details=<br />
A: Device nodes allow userspace to access hardware (or virtual resources). Creating a device node inside the guest's namespace will give access to that device, so for security reasons, the number of 'given' devices is small.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is unification (vunify)?||Details=<br />
A: Unification is Hard Links on Steroids. Guests can 'share' common files (usually binaries and libraries) in a secure way, by creating hard links with special properties (immutable but unlinkable (removable)). The tool to identify common files and to unify them is called vunify.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is vhashify?||Details=<br />
A: The successor of vunify, a tool which does unification based on hash values (which allows to find common files in arbitrary paths.)<br />
<br />
It creates hardlinks to files named after a hash of the content of the file. If you have a recent version of the vserver patch (2.2+), with CONFIG_VSERVER_COWBL enabled, you can even modify the hardlinked files inside the vservers and the links will be broken automatically.<br />
<br />
There seems to be a catch when a hashified file has multiple hardlinks inside a guest, or when another internal hardlink is added after hashification. Link breaking will remove all the internal hardlinks too, so the guest will end up with different copies of the original file. The correct solution would be to not hashify files that have multiple links prior to hashification, and to break the link to the hashified version when a new internal hardlink is created. Apparently, this is not implemented yet (?).<br />
<br />
|Signature=Guy-}}<br />
<br />
{{Question|Question=How do I manage a multi-guest setup with vhashify?||Details=<br />
A: For 'vhashify', just do these once:<br />
<br />
<pre><br />
mkdir /etc/vservers/.defaults/apps/vunify/hash /vservers/.hash<br />
ln -s /vservers/.hash /etc/vservers/.defaults/apps/vunify/hash/root<br />
</pre><br />
<br />
Then, do this one line per vserver:<br />
<br />
<pre><br />
mkdir /etc/vservers/<vservername>/apps/vunify # vhashify reuses vunify configuration<br />
</pre><br />
<br />
To hashify a running vserver, do (possibly from a cronjob):<br />
<br />
<pre><br />
vserver name-of-guest hashify<br />
</pre><br />
<br />
The guest needs to be running because vhashify tries to figure out what files not to hashify by calling the package manager of the guest via <tt>vserver enter</tt>.<br />
<br />
In order for the OS cache to benefit from the hardlinking, you'll have to restart the vservers.<br />
<br />
To clean up hashified files that are no longer referenced by any vserver, do (possibly from a cronjob):<br />
<br />
<pre><br />
find /vservers/.hash -type f -links 1 -print0 | xargs -0 rm<br />
</pre><br />
<br />
Until you do this, the files still take up place even though no vservers need them.<br />
<br />
|Signature=Guy-}}<br />
<br />
{{Question|Question=With which version should I begin?||Details=<br />
A: If you are new to VServer I recommend to try the latest stable kernel patch, and the latest util-vserver "alpha" release.|Signature=derjohn}}<br />
<br />
{{Question|Question=Is there a way to implement "user/group quota" per VServer?||Details=<br />
A: Yes, but not on a shared partition for now. You need to put the guest on a separate partition, setup a vroot device (to make the quota access secure), copy that into the guest, and adjust the mtab line inside the guest.|Signature=derjohn}}<br />
<br />
{{Question|Question=What about "Quota" for a context?||Details=<br />
A: Context quotas are now called Disk Limits (so that we can tell them apart from the user/group quotas :). They are supported out of the box (with vs2.0+) for all major filesystems (ext2/3, ReiserFS, JFS)|Signature=derjohn}}<br />
<br />
{{Question|Question=Does it support IPv6?||Details=<br />
A: Currently it requires an additional patch, but the functionality should be available in 2.3+ soon. ((IPv6)) has more information.|Signature=derjohn}}<br />
<br />
{{Question|Question=I can't do all I want with the network interfaces inside the guest?||Details=<br />
A: For now the networking is 'Host Business' -- the host is a router, and each guest is a server. You can set the capability ICMP_RAW in the context of the guest, or even the capability CAP_NET_RAW (which would even allow to sniff interfaces of other guests!). Likely to change with ngnet. |Signature=derjohn}}<br />
<br />
{{Question|Question=Is there a web-based interface for vserver that will allow creation/deletion/configuration etc. of vserver guests?||Details=<br />
A. http://OpenVPS.org which is a set of scripts with a web-interface for webhosters/ISPs. http://Openvcp.org which is a distributed system (agent!) with a web-interface, with which you can build/remove guests. http://vsmon.revolutionlinux.com/ is a distributed monitoring-only solution that allows you to search for a particular vserver in your park. |Signature=derjohn}}<br />
<br />
{{Question|Question=What is old-style and new-style config?||Details=<br />
A. Old-style config refers to a single text-file that contains all the configuration settings. With new-style config the configuration is split into several directories and files. You should probably go for new-style config if you are asking.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is the "great flower page"?||Details=<br />
A. Well, [http://www.nongnu.org/util-vserver/doc/conf/configuration.html this page] contains all configuration options for util-vserver. The name of the page is derived from the stylesheet(s) it contains.|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I add several IPs to a vserver? ||Details=<br />
A: First of all a single guest vserver only supports up to 16 IPs (There is a 64-IP patch available, which is in "derjohn's kernel").<br />
Here is a little helper-script that adds a list of IPs defined in a text file, one per line.<br />
<pre><br />
#!/bin/bash<br />
j=1<br />
for i in `cat myiplist`; do<br />
j=$(($j+1))<br />
mkdir $j<br />
echo $i > $j/ip<br />
echo "24" > $j/prefix<br />
done<br />
</pre>|Signature=derjohn}}<br />
<br />
{{Question|Question=If my host has only one a single public IP, can I use RFC1918 IP (e.g. 192.168.foo.bar) for the guest vservers?||Details=<br />
A: Yes, use iptables with SNAT to masquerade it. <br />
<pre><br />
iptables -t nat -I POSTROUTING -s $VSERVER_NETZ ! -d $VSERVER_NETZ -j SNAT --to $EXT_IP<br />
</pre><br />
See: [[HowtoPrivateNetworking]] and <br />
http://www.tgunkel.de/it/software/doc/linux_server.en#h3-VServer_Masquerading_SNAT (THX, [MUPPETS]Gonzo)|Signature=derjohn}}<br />
<br />
{{Question|Question=If I shut down my vserver guest, the whole Internet interface ethX on the host is shut down. What happened? ||Details=<br />
A: When you shut down a guest (''i.e. vserver foo stop''), the IP is brought down on the host also. If this IP happens to be the primary IP of the host, the kernel will not only bring down the primary IP, but also all secondary IP addresses. But in very recent kernels, there is an option ''settable'' which prevents that nasty feature. It's called "alias promotion". You may set it via sysctl by adding ''net.ipv4.conf.all.promote_secondaries=1'' in /etc/sysctl.conf or via sysctl command line.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=I run a Debian host and want to build an Ubuntu guest. Howto?||Details=<br />
A: Simple ;) Assume you want to build a breezy guest on a sid host with IP 192.168.0.2 and hostname vubuntu, then do:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu<br />
</pre><br />
<br />
[UPDATE] Currently there are problems in building breezy under unclear circumstances, which seems to have to do with udev. If the above didnt work, try:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu -- --exclude=udev<br />
</pre><br />
In very recent versions of the utils, the problem should not occur anymore (it has to do with the 'secure-mount' if you look in the MLs)<br />
<br />
Well, sid's debootstrap knows how to bootstrap Ubuntu linux. Make sure to have a current debootstrap package: <br />
<pre><br />
apt-get update<br />
apt-get install debootstrap<br />
</pre><br />
The knowledge how to build ubuntu 'breezy badger' (which you probably want to be your guest at the time of writing) has been added recently.|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I make a vserver guest start by default?||Details=<br />
A: At least on Debian, I can tell you how to do it with the new-style config. If your guest is called "derjohn" and you want it to be started somewhere at the of your bootstrap process, then do:<br />
<pre><br />
echo "default" > /etc/vservers/derjohn/apps/init/mark<br />
</pre><br />
If you want to start it earlier, please read the init script "/etc/init.d/vserver-default" to find out how to do it. In most cases you don't need to change this. On Debian the vservers are started at "90", so after most other stuff is up (networking etc.).<br />
<br />
Besides that I created a small helper script for managing the autostart foo: ((vserver-autostart))|Signature=derjohn}}<br />
<br />
{{Question|Question=My host works, but when I start a guest it says that it has a problem with chbind.||Details=<br />
A: You are probably using util-vserver <= 0.30.209, which does use dynamic network contexts internally (With 0.30.210 this fact changed). So if you compiled your kernel without dynamic contexts, you may start guests, but you can't use the network context.The solution is either to switch to .210 util (or Hollow's toolset) or compile the kernel with dynamic network contexts.<br />
SE Keyword: invalid option `nid' testme.sh|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=When I try to ssh to the guest, I log into the host, even if I installed sshd on the guest. What's wrong here?||Details=<br />
A: Look at /etc/ssh/sshd_config of the host:<br />
<br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
#ListenAddress ::<br />
</pre><br />
<br />
And now change the setting to <br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
ListenAddress your.hosts.ip.here # not the guests IP! <br />
</pre><br />
<br />
Then '/etc/init.d/ssh restart' on the host, after that on the guest (if you did apt-get install ssh on the guest already.)<br />
<br />
Do I have to explain more? If the hosts sshd binds all available IP addresses on port 22 (The hosts 'sees' even all addresses of the guests!). So if the guest starts its sshd, it can't bind to port 22 any more. You need to change that setting only on the host. <br />
(BTW: A similar approach has to be done for a lot of daemons, e.g. Apache. If the daemon does not support an explicit bind, you may use the chbind command to 'hide' IP addresses from the daemon before starting.)|Signature=derjohn}}<br />
<br />
{{Question|Question=I did everything right, but the application foo does not start. What's up there?||Details=<br />
A: Before asking on the IRC channel, please check out the 'problematic programs' page:<br />
[[Problematic Programs]]|Signature=derjohn}}<br />
<br />
{{Question|Question=Bind9 does not like to start in my guest.||Details=<br />
A: Check out the ((ProblematicPrograms)) page and/or get my [http://linux-vserver.derjohn.de/bind9-packages/bind9-capacheck_9.3.2-2_i386.deb vserver-guest-ready Debian package] for Debian Sid guests and check out the [http://linux-vserver.derjohn.de/bind9-packages/README.txt readme]. (Hint: This is fresh stuff. Please give me feedback)<br />
<br />
[UPDATE] Since VServer Devel 2.1.1-rc18 you do not need to patch the userland tools anymore. The capabilities are masked.|Signature=derjohn}}<br />
<br />
{{Question|Question=Which guest vservers are running?||Details=<br />
A: Use vserver-stat to find out. Example output:<br />
<pre><br />
CTX PROC VSZ RSS userTIME sysTIME UPTIME NAME<br />
0 77 965.1M 334.6M 14m14s18 2m28s69 1h33m46 root server<br />
49152 7 14M 5.2M 0m00s40 0m00s30 1h30m15 chiffon<br />
</pre>|Signature=derjohn}}<br />
<br />
<br />
<br />
{{Question|Question=How can I reboot/halt guests?||Details=<br />
A: It depends. <br />
For legacy Linux-VServer (i.e. 1.2.x), you have to replace /sbin/halt in the guests with vreboot and start rebootmgr in the host. You also need to have a <guest>.conf file in /etc/vservers for each guest. Please have a look at /etc/init.d/rebootmgr.<br />
For Linux-VServer 2.0+, sys_reboot has been virtualized to do the right thing. No changes are needed in guests.|Signature=derjohn}}<br />
<br />
{{Question|Question=Do I really need the legacy-interfaces? What are these legacy-interfaces?||Details=<br />
A: Since Linux-VServer is an ongoing project, new features might replace old ones, some might require a development version. Legacy-interfaces are available for backward compability (which might be removed someday) with Linux-VServer 1.2.x.|Signature=derjohn}}<br />
<br />
{{Question|Question=I have a vserver running on a Linux kernel with preemption. Is VServer "preempt" safe?||Details=<br />
A: There are no known issues about running vserver on a preemption enabled kernel. I would like to add, that the vserver kernelhackers would probably exclude that option in 'make menuconfig' if there would be an incompatibility. Just my $.02 :)|Signature=derjohn}}<br />
<br />
{{Question|Question=Is this a new project? When was it started?||Details=<br />
A: The first public occurrence of Linux-VServer was Oct 2001. The initial mail can be found here: http://www.cs.helsinki.fi/linux/linux-kernel/2001-40/1065.html<br />
So you can expect a mature software product which does its magic quite well (And hey, we have a version > 2.0!)|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=Can I run an OpenVPN Server in a guest?||Details=<br />
A: Yes. I don't want to provide an in-depth OpenVPN tutorial, but want to show how I made OpenVPN work in a guest as server.<br />
<br />
First of all you have to prepare the host with a persistent tuntap interface in tap-mode. The tools we need come from the uml-utilities.<br />
Then you need to create a device /dev/net/tun, which the OpenVPN userspace daemon reads. We'll assume 10.10.10.100 is the server IP, and 10.10.10.101 is the client IP - to be cool be choose a /31 netmask (255.255.255.254), so we have a net without broadcast and don't waste IPs :)<br />
<br />
On the host do: <br />
<pre><br />
# apt-get install uml-utilities<br />
# cd /var/lib/vserver/<myopenvpnserver>/dev/<br />
# ./MAKEDEV tun<br />
(creates the dev/net/tun device accessible by te guest - even a tap interface need /dev/net/tun !)<br />
# tunctl -t tap0<br />
(creates the network device 'tap0' persistently)<br />
</pre><br />
<br />
Then add the ip to the guest:<br />
<pre><br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/ip<br />
10.10.10.100<br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/prefix<br />
31<br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/dev<br />
tap0<br />
(This kind of config brings the ip when the vserver is started - only the tap0 interface has to exist already, see above!)<br />
</pre><br />
<br />
Here is a sample config for the guest (which is acting as a server):<br />
<br />
Install OpenVPN package on server and client, in the Debian case:<br />
<pre><br />
# apt-get install openvpn<br />
</pre><br />
<br />
The server's conf looks like that:<br />
<pre><br />
# port and interface specs<br />
<br />
# behave like a ssl-webserver<br />
port 443<br />
proto tcp-server<br />
<br />
# tap device? (keep in mind you need /dev/net/tun !)<br />
dev tap0<br />
<br />
# now the ips we will use for the tunnel<br />
ifconfig 10.10.10.100 255.255.255.254<br />
ifconfig-noexec<br />
<br />
# the server part<br />
<br />
# Keep VPN connections, even if the client IP changes<br />
float<br />
<br />
# use compression (may also even obfuscate content filters)<br />
comp-lzo<br />
<br />
# use a static key - create it with 'openvpn --genkey --secret static.key'<br />
secret static.key<br />
<br />
# dont reload the key after a SIGUSR1<br />
persist-key<br />
<br />
# check alive all 10 secs<br />
keepalive 10 60<br />
<br />
# verbosity level (from 1 to 9, 9 is max log level)<br />
verb 4<br />
status openvpn-status.log<br />
</pre><br />
<br />
The client's conf may look like that (This example even makes the tunnel the clients default address):<br />
<pre><br />
# cat /etc/openvpn/client.conf<br />
# port and interface specs<br />
<br />
# the following is not necessary, if you bring up openvpn via Debian's init script:<br />
daemon ovpn-my-clients-name<br />
<br />
# behave like a ssl-webserver<br />
port 443<br />
proto tcp-client<br />
remote %%%<insert-the-guest-primary-public-ip-here>%%%%<br />
# what device tun ot tap?<br />
dev tap<br />
<br />
# now the ips we will use for the tunnel<br />
ifconfig 10.10.10.101 255.255.255.254<br />
<br />
# Keep VPN connections, even if the client IP changes<br />
float<br />
mssfix<br />
<br />
# use compression (may also even obfuscate content filters)<br />
comp-lzo<br />
<br />
# use a static key<br />
secret static.key<br />
<br />
# dont reload the key after a SIGUSR1<br />
persist-key<br />
<br />
# check alive all 10 secs<br />
keepalive 10 60<br />
<br />
# verbosity level (from 1 to 9, 9 is max log level)<br />
verb 4<br />
<br />
# set the default route<br />
route-gateway 10.10.10.100<br />
redirect-gateway def1<br />
# to add special routes you can do it wihtin the openvpn client conf:<br />
# route <dest> <mask> <gateway><br />
<br />
# if you need to connect via proxy (like squid)<br />
# http-proxy s p [up] [auth] : Connect to remote host through an HTTP proxy at<br />
# address s and port p. If proxy authentication is required,<br />
# up is a file containing username/password on 2 lines, or<br />
# 'stdin' to prompt from console. Add auth='ntlm' if<br />
# the proxy requires NTLM authentication.<br />
<br />
# http-proxy s p [up] [auth]<br />
<br />
<br />
# http-proxy-option type [parm] : Set extended HTTP proxy options.<br />
# Repeat to set multiple options.<br />
# VERSION version (default=1.0)<br />
# AGENT user-agent<br />
<br />
# http-proxy-option type [parm]<br />
</pre><br />
<br />
In the next lesson I will talk about OpenVPN's server mode, which can deal with with multiple clients connecting to one IP and one port (i.e. you only need one guest for tons of 'road warriors'), TLS connections and PKI.<br />
<br />
Contributions welcome. :)|Signature=derjohn}}<br />
<br />
{{Question|Question=32 vs 64 Bit? What should I take?||Details=<br />
A: If you have the choice make the host a 64 bit one. You can run a guest as 32 bit or as 64 bit on a 64 bit host. To run it as 32 bit, you need to compile the x86_64 (a.k.a. AMD64) with the following options:<br />
<br />
<pre><br />
[*] Kernel support for ELF binaries<br />
<M> Kernel support for MISC binaries<br />
[*] IA32 Emulation <---- without that, the entire 32bit API is not present<br />
<M> IA32 a.out support <br />
</pre><br />
<br />
You can force the guest to behave like a 32 environment like this:<br />
<pre><br />
echo linux_32bit > /etc/vservers/$NAME/personality<br />
echo i686 > /etc/vservers/$NAME/uts/machine<br />
</pre><br />
(thanks cehteh for the hint!)<br />
<br />
But you can force debootstrap to put 32 bit binaries into the guest by 'export ARCH=i386';<br />
<pre><br />
export ARCH=i386 ; vserver build .... <br />
</pre>|Signature=derjohn}}<br />
<br />
{{Question|Question=I want to (re)mount a partition in a running guest ... but the guest has no rights (capability) to (re)mount?||Details=<br />
A: I'll explain. I take as example your /tmp partition within the guest is too small, what will be likely the case if you stay with the 16MB default (vserver build mounts /tmp as 16 MB tmpfs!).<br />
<pre><br />
# vnamespace -e XID mount -t tmpfs -o remount,size=256m,mode=1777 none /var/lib/vservers/<guest>/tmp/<br />
</pre><br />
Be warned that the guest will not recognize the change, as the /etc/mtab file is not updated when you mount like this. To permanently change the mount, edit /etc/vserver/<guest>/fstab on the host.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=How do I limit a guests RAM? I want to prevent OOM situations on the host!||Details=<br />
A: First you can read [http://linux-vserver.org/Memory+Allocation] and [[Memory Limits]].<br />
<br />
If you want a recipe, do this:<br />
1. Check the size of memory pages. On x86 and x86_64 is usually 4 KB per page.<br />
2. Create /etc/vserver/<guest>/rlimits/<br />
3. Check your physical memory size on the host, e.g. with "free -m". maxram = kilobytes/pagesize.<br />
4. Limit the guests physical RAM to value smaller then maxram:<br />
<br />
<pre><br />
echo %%insertYourPagesHereSmallerThanMaxram%% > /etc/vserver/<guest>/rlimits/rss<br />
</pre><br />
<br />
5. Check your swapspace, e.g. with 'swapon -s'. maxswap = swapkilobytes/pagesize.<br />
6. Limit the guest's maximum number of as pages to a value smaller than (maxram+maxswap):<br />
<br />
<pre><br />
echo %%desiredvalue%% > /etc/vserver/<guest>/rlimits/as<br />
</pre><br />
<br />
It should be clear this can still lead to OOM situations. Example: You have two guests and your as limit per guest is greater than 50% of (maxram+maxswap). If both guests request their maximum at the same point in time, there will be not enough mem .....|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=Were can I get newer versions of VServer as ready made packages for Debian?||Details=<br />
A: Here you go: http://linux-vserver.derjohn.de/ . There is also some stuff on backports.org, but my kernels are always 'devel' branch.|Signature=derjohn}}<br />
<br />
{{Question|Question=Can I use iptables ?||Details=<br />
Yes but right now only on the host (rootserver). Please realize that all traffic is local and will not touch the forward chain.|Signature=BeginnerFAQ}}<br />
<br />
{{Question|Question=Trying to connect to a vserver from the host or another vserver on the same host fails||Details=<br />
strace shows<br />
<pre> <br />
sin_addr=inet_addr("xx.xx.xx.xx")}, yy) = -1 EINVAL (Invalid argument)<br />
</pre><br />
A: The host/guest cannot communicate with another guest on same host.<br />
* check all netmasks on all interfaces (do they overlap) ?<br />
* check policy routing (disable it temporary) ?<br />
* check that lo is up (Networking within a host/guest always uses lo interface)<br />
|Signature=CommonProblems}}<br />
<br />
{{Question|Question=#1 ERROR: capset(): Operation not permitted||Details=capabilities are not enabled in kernel-setup<br />
please check that CONFIG_SECURITY_CAPABILITIES is loaded or included in the kernel. ( check with "cat /path_to_kernel/.config | grep -i cap ")<br />
(2.6.11.5-vs-1.9.5 + 0.30-205)|Signature=IrcQuestions}}<br />
<br />
{{Question|Question=How can I make 'vserver start' mount the root filesystem?||Details=<br />
Mount it via /etc/vservers/vserver-name/fstab, make sure to set the option 'dev' e.g.:<br />
<pre>/dev/drbd0 / xfs rw,dev 0 0</pre><br />
|Signature=AdrianReyer}}<br />
<br />
{{Question|Question=How do I tag a guest's directory with xid?||Details=<br />
Tagging the guest's files gives you serveral advantages, e.g. the accoutung will work properly.<br />
Filesystem XID tagging only works on supported filesystem. Those are currently: ext2/3, reiserfs/reiser3, xfs and jfs.<br />
To activate the XID tagging you have to mount the filesystem with "-o tagxid". Attention: It's _not_ possible to "-o remount,tagxid", you have to mount it freshly. The guests will tag their files automatiaclly. If you copy files in from the host, you have to tag them manually like this:<br />
<pre>chxid -c xid -R /var/lib/vservers/<guest></pre><br />
Note: Context 0 and 1 will see all files, guests will only be able to acess untagged files and their own XID. They can see other XID files but no information about the file, e.g. no owner, no group, no permissions.<br />
|Signature=derjohn_and_gonzo_and_are}}<br />
<br />
More FAQs to be merged;<br />
[http://www.linux-vserver.org/Frequently_Asked_Questions_scratch]<br />
<br />
{{Question|Question=My mysqld running in a guest behaves strangely and is awfully slow/locks up||Details=<br />
This can be related to /tmp being too small. mysqld stores temporary tables in /tmp and as such, if a lot of queries happen and /tmp runs full this can cause one query to lock up whilst creating the tmp table and all other queries waiting to acquire the lock. There are two possible solutions to that problem: a.) Modify /etc/vservers/vserver-name/fstab and assign more memory to the tmpfs of /tmp and b.) remove the /tmp entry from /etc/vservers/vserver-name/fstab completly. Especially on database servers with a rather high load the second one might be the preferred method.|Signature=sp}}<br />
<br />
<br />
{{Question|Question=I deleted a guest's directory without shutting it down. Now I have a "ghost" running. Is there any possibility to get it out of proc without rebooting?||Details=vkill --xid <xid> -s 15; sleep 2; vkill --xid <xid> -s 9|Signature=daniel_hozac}}<br />
<br />
{{Question|Question=When using nice and su (for example, in the updatedb cron job), I get: su: Permission denied. What does it mean?||Details=A guest cannot lower its nice value - and that's what 'su' does through pam_limits which sets a nice value of 0. You can see it through strace:<br />
$ strace nice su nobody<br />
[...]<br />
setpriority(PRIO_PROCESS, 0, 0) = -1 EACCES (Permission denied)<br />
You can use 'su nobody -c nice some_cmd' instead.<br />
(Now there's the question of why a guest process cannot lower its nice value.)<br />
|Signature=daniel_hozac&Beuc}}<br />
<br />
== Upgrade from 2.0 to 2.2 ==<br />
<br />
{{Question|Question=I now get errors like "ncontext: vc_net_create(): Invalid argument; dynamic contexts disabled." on startup. Vservers are not started||Details=Dynamic context are disabled by default and are deprecated. For example, tagxid and network checks won't be useable with dynamic ids. Now you should manually assign a explicit context to your vservers, like<br />
echo 101 > /etc/vservers/myvserv/context<br />
|Signature=daniel_hozac&Beuc}}</div>82.238.35.175http://wiki.linux-vserver.org/Frequently_Asked_QuestionsFrequently Asked Questions2007-01-20T13:37:41Z<p>82.238.35.175: dynamic context ids are deprecated in 2.1+</p>
<hr />
<div><div style="margin: 2em auto 2em auto; padding: 10px; background-color: #F9ECCD; border: 1px solid #004433; text-align: center;"><br />
[[Image:Icon-Caution.png|left]]<br />
We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the [[Wiki Team]] page for instructions how to help or look at the [http://oldwiki.linux-vserver.org old wiki] to find the information not migrated yet.<br />
<br />
'''To ease migration we created a [[List of old Documentation pages]].'''<br />
</div><br />
<br />
CURRENTLY THE CONTENT OF THE OLD WIKI FAQ (AND MORE) IS BEING MIGRATED TO THIS PAGE (TASK: DERJOHN)<br />
<br />
<br />
__TOC__<br />
<br />
{{Question|Question=What is a 'Guest'?||Details=To talk about stuff, we need some naming. The physical machine is called 'Host' and the 'main' context running the Host Distro is called 'Host Context'. The virtual machine/distro is called 'Guest' and basically is a Distribution (Userspace) running inside a 'Guest Context'.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=What kind of Operating System (OS) can I run as guest?||Details=<br />
A: With VServer you can only run Linux guests. The trick is that a guest does not run a kernel on its own (as XEN and UML do), it merely uses a virtualized host kernel-interface. VServer offers so called security contexts which make it possible to seperate one guest from each other, i.e. they cannot get data from each other. Imagine it as a chroot environment with much more security and features.|Signature=derjohn}}<br />
<br />
{{Question|Question=Which distributions did you test?||Details=<br />
A: Some. Check out the wiki for ready-made guest images. But you can easily build own guest images, e.g. with Debian's debootstrap. Checkout ((step-by-step Guide 2.6)) how to do that.|Signature=derjohn}}<br />
<br />
{{Question|Question=Is VServer comparable to XEN/UML/QEMU?||Details=<br />
A: Nope. XEN/UML/QEMU and VServer are just good friends. Because you ask, you probably know what XEN/UML/QEMU are. VServer in contrary to XEN/UML/QEMU not "emulate" any hardware you run a kernel on. You can run a VServer kernel in a XEN/UML/QEMU guest. This is confirmed to work at least with Linux 2.6/vs2.0.|Signature=derjohn}}<br />
<br />
{{Question|Question=Is VServer secure?||Details=<br />
A: We hope so. It should be as least as secure as Linux is. We consider it much much more secure though.|Signature=derjohn}}<br />
<br />
{{Question|Question=Performance?||Details=<br />
A: For a single guest, we basically have native performance. Some tests showed insignificant overhead (about 1-2%) others ran faster than on an unpatched kernel. This is IMVHO significantly less than other solutions waste, especially if you have more than a single guest (because of the resource sharing).|Signature=derjohn}}<br />
<br />
{{Question|Question=Is SMP Supported?||Details=<br />
A: Yes, on all SMP capable kernel architectures.|Signature=derjohn}}<br />
<br />
{{Question|Question=Resource sharing?||Details=<br />
A: Yes ....<br />
* memory: Dynamically.<br />
* CPU usage: Dynamically (token bucket)|Signature=derjohn}}<br />
<br />
{{Question|Question=Resource limiting?||Details=<br />
A: Yes, you can set maximum limits per guest, but you can only offer guaranteed resource availability with some ticks at the time. There is the possibility to ulimit and to rlimit. Rlimit is a new feature of kernel 2.6/vs2.0.|Signature=derjohn}}<br />
<br />
{{Question|Question=Disk I/O limiting? Is that possible?||Details=<br />
A: Well, since vs2.1.1 linux-vserver supports a mechanism called 'I/O scheduling', which appeared in the 2.6 mainline some time ago. The mainline kernel offers several I/O schedulers:<br />
<br />
<pre><br />
# cat /sys/block/hdc/queue/scheduler<br />
noop [anticipatory] deadline cfq<br />
</pre><br />
<br />
The default is anticipatory a.k.a. "AS". When running several guests on a host you probably want the I/O performance shared in a fair way among the different guests. The kernel comes with a "completely fair queueing" scheduler, CFQ, which can do that. (More on schedulers can be found at http://lwn.net/Articles/114770/)<br />
<br />
This is how to set the scheduler to "cfq" manually:<br />
<pre><br />
root# echo "cfq" > /sys/block/hdc/queue/scheduler<br />
root# cat /sys/block/hdc/queue/scheduler<br />
noop anticipatory deadline [cfq]<br />
</pre><br />
<br />
Keep in mind that you have to do it on all physical discs. So if you run an md-softraid, do it to all physical /dev/hdXYZ discs!<br />
<br />
If you run Debian there is a predefined way to set the /sys values at boot-time:<br />
<br />
<pre><br />
# apt-get install sysfsutils<br />
[...]<br />
<br />
# cat /etc/sysfs.conf | grep cfq<br />
block/sda/queue/scheduler = cfq<br />
block/sdc/queue/scheduler = cfq<br />
<br />
# /etc/init.d/sysfsutils restart<br />
</pre><br />
<br />
For non-vserver processes and CFQ you can set by which key the kernel decides about the fairness:<br />
<br />
<pre><br />
cat /sys/block/hdc/queue/iosched/key_type<br />
pgid [tgid] uid gid<br />
</pre><br />
Hint: The 'key_type'-feature has been removed in the mainline kernel recently. Don't look for it any longer :(<br />
<br />
The default is tgid, which means to share fairly among process groups. Think every guest is treated like a own process group. It's not possible to set a scheduler strategy within a guest. All processes belonging to the same guest are treated like "noop" within the guest. So: If you run apache and some ftp-server within the _same_ guest, there is no fair scheduling between them, but there is fair scheduling between the whole guest and all other guests.<br />
<br />
And: It's possible to tune the scheduler parameters in several ways. Have a look at /sys/block/hdc/queue/....<br />
<br />
You need a very recent Version of VS devel, e.g. the 2.1.1-rc18 can do it. Some older version have that feature too, then it got lost and was reinvented. So: Go and get a rc18 - only in 'devel', not stable!|Signature=derjohn}}<br />
<br />
{{Question|Question=Why isn't there a device /dev/bla? within a guest||Details=<br />
A: Device nodes allow Userspace to access hardware (or virtual resources). Creating a device node inside the guest's namespace will give access to that device, so for security reasons, the number of 'given' devices is small.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is Unification (vunify)?||Details=<br />
A: Unification is Hard Links on Steroids. Guests can 'share' common files (usually binaries and libraries) in a secure way, by creating hard links with special properties (immutable but unlinkable (removable)). The tool to identify common files and to unify them is called vunify.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is vhashify?||Details=<br />
A: The successor of vunify, a tool which does unification based on hash values (which allows to find common files in arbitrary paths.)|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I manage a multi-guest setup with vhashify?||Details=<br />
A: For 'vhashify', just do these once:<br />
<br />
<pre><br />
mkdir /etc/vservers/.defaults/apps/vunify/hash /vservers/.hash<br />
ln -0s /vservers/.hash /etc/vservers/.defaults/apps/vunify/hash/root<br />
</pre><br />
<br />
Then, do this one line per vserver:<br />
<br />
<pre><br />
mkdir /etc/vservers/<vservername>/apps/vunify # vhashify reuses vunify configuration<br />
</pre><br />
<br />
<br />
The command 'ln' creates a link between two files. "ln -s" creates a symbolic link -- two files are linked by name. "ln -0s" uses a Vserver extention to create a unified link.|Signature=derjohn}}<br />
<br />
{{Question|Question=With which VS version should I begin?||Details=<br />
A: If you are new to VServer I recommend to try 2.0.+. Take "alpha utils" Version 0.30.210. In Debian Sid there appeared well running version of it recently. (It's a .210 at the time of writing).|Signature=derjohn}}<br />
<br />
{{Question|Question=is there a way to implement "user/group quota" per VServer?||Details=<br />
A: Yes, but not on a shared partition for now. You need to put the guest on a separate partition, setup a vroot device (to make the quota access secure), copy that into the guest, and adjust the mtab line inside the guest.|Signature=derjohn}}<br />
<br />
{{Question|Question=what about "Quota" for a context?||Details=<br />
A: Context quotas are now called Disk Limits (so that we can tell them apart from the user/group quotas :). They are supported out of the box (with vs2.0) for all major filesystems (Ext2/3, ReiserFS, XFS, JFS)|Signature=derjohn}}<br />
<br />
{{Question|Question=Does it support IPv6?||Details=<br />
A: Currently not. Some developer has to move his ... to reimplement this functionality from the V4 code (I read that on the ML ;)). Will probably be superseded by the ngnet (next generation networking) soon. There is a Wiki page regarding this: http://linux-vserver.org/IPv6|Signature=derjohn}}<br />
<br />
{{Question|Question=I can't do all I want with the network interfaces inside the guest?||Details=<br />
A: For now the networking is 'Host Business' -- the host is a router, and each guest is a server. You can set the capability ICMP_RAW in the context of the guest, or even the capability CAP_NET_RAW (which would even allow to sniff interfaces of other guests!). Likely to change with ngnet. |Signature=derjohn}}<br />
<br />
{{Question|Question=Is there a web-based interface for vserver that will allow creation/deletion/configuration etc. of vserver guests?||Details=<br />
A. http://OpenVPS.org which is a set of scripts with a web-interface for webhosters/ISPs. http://Openvcp.org which is a distributed system (agent!) with a web-interface, with which you can build/remove guests. http://vsmon.revolutionlinux.com/ is a distributed monitoring-only solution that allows you to search for a particular vserver in your park. |Signature=derjohn}}<br />
<br />
{{Question|Question=What is old-style and new-style config?||Details=<br />
A. Old-style config refers to a single text-file that contains all the configuration settings. With new-style config the configuration is split into several directories and files. You should probably go for new-style config if you are asking.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is the "great flower page"?||Details=<br />
A. Well, this page contains all configation options for vserver in version > 1.9 (I think .. I joined Linux-VServer in version 2, so I don't know for sure). The name of the page is derivived from the stylesheet(s) it contains: It displays background pictures of a very great flower, so regard it as highly optimized. It was designed by a non-designer, who asks us to create a better one. I played with the thought of creating a complete new theme for that page - but actually we all got used to the name "great flower page", so we stick to it. If you are unable to read it clearly, feel invited to join the IRC channel #vserver, we may tell you how to ;)|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I add several IPs to a vserver? ||Details=<br />
A: First of all a single guest vserver only supports up to 16 IPs (There is a 64-IP patch available, which is in "derjohn's kernel", you need extra util-vserver anyway).<br />
Here is a little helper-script that adds a list of IPs defined in a text file, one per line.<br />
<pre><br />
#!/bin/bash<br />
j=1<br />
for i in `cat myiplist`; do<br />
j=$(($j+1))<br />
mkdir $j<br />
echo $i > $j/ip<br />
echo $i > $j/ip-old<br />
echo "24" > $j/prefix<br />
done<br />
</pre>|Signature=derjohn}}<br />
<br />
{{Question|Question=If my host has only one a single public IP, can I use RFC1918 IP (e.g. 192.168.foo.bar) for the guest vservers?||Details=<br />
A: Yes, use iptables with SNAT to masquerade it. <br />
<pre><br />
iptables -t nat -I POSTROUTING -s $VSERVER_NETZ ! -d $VSERVER_NETZ -j SNAT --to $EXT_IP<br />
</pre><br />
See: HowtoPrivateNetworking and <br />
http://www.tgunkel.de/it/software/doc/linux_server.en#h3-VServer_Masquerading_SNAT (THX, [MUPPETS]Gonzo)|Signature=derjohn}}<br />
<br />
{{Question|Question=If I shut down my vserver guest, the whole Internet interface ethX on the host is shut down. What happened? ||Details=<br />
A: When you shut down a guest (''i.e. vserver foo stop''), the IP is brought down on the host also. If this IP happens to be the primary IP of the host, the kernel will not only bring down the primary IP, but also all secondary IP addresses. But in very recent kernels, there is an option ''settable'' which prevents that nasty feature. It's called "alias promotion". You may set it via sysctl by adding ''net.ipv4.conf.all.promote_secondaries=1'' in /etc/sysctl.conf or via sysctl command line.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=On Debian Sarge (stable) only util-vserver is 0.30-204 available, which has been reported to be buggy (I didnt check the version for longer time) How do I compile a local version of alpha util-vserver .210 on Debian?||Details=<br />
A:<br />
<pre><br />
apt-get build-dep util-vserver<br />
<br />
./configure --prefix=/usr/local/ --enable-release \<br />
--mandir=/usr/local/share/man \<br />
--infodir=/usr/local/share/info \<br />
--sysconfdir=/etc --enable-dietlibc \<br />
--localstatedir=/var \<br />
--with-vrootdir=/var/lib/vservers<br />
<br />
make<br />
<br />
make install-distribution<br />
(Which does a make install + setting a symlink ln -s /usr/local/lib/util-vserver/vshelper /sbin/vshelper )<br />
<br />
</pre><br />
<br />
To test which version you are running:<br />
<pre><br />
# which vserver<br />
/usr/local/sbin/vserver<br />
<br />
</pre><br />
<br />
This should point to ..local...<br />
<br />
If you dont want to build it yourself: On www.backports.org there are backported (for sarge) linux-images (2.6.16) with vserver-patch enabled and a updated util-vserver package as well.<br />
|Signature=derjohn}}<br />
<br />
{{Question|Question=I use derjohn's kernel or a differnet kernel with a more-than-16-IPs-per-guest-patch and can't use more than 16 IPs. Why?||Details=<br />
A: You need to patch util-vserver, too. So you obviously need to recompile util-vserver (see above). In the util-vserver directory there are header files in the ./kernel/ directory. Patch like this:<br />
<br />
<pre><br />
kernel/network.h:#define NB_IPV4ROOT 64<br />
</pre><br />
<br />
BTW: The initial patches can be found here: http://vserver.13thfloor.at/Experimental/VARIOUS/util-vserver-0.30.196-net64.diff.bz2 and http://vserver.13thfloor.at/Experimental/VARIOUS/delta-2.6.9-vs1.9.3-net64.diff<br />
|Signature=unknown}}<br />
<br />
{{Question|Question=I run a Debian host and want to build an Ubuntu guest. Howto?||Details=<br />
A: Simple ;) Assume you want to build a breezy guest on a sid host with IP 192.168.0.2 and hostname vubuntu, then do:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu<br />
</pre><br />
<br />
[UPDATE] Currently there are problems in building breezy under unclear circumstances, which seems to have to do with udev. If the above didnt work, try:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu -- --exclude=udev<br />
</pre><br />
In very recent versions of the utils, the problem should not occur anymore (it has to do with the 'secure-mount' if you look in the MLs)<br />
<br />
Well, sid's debootstrap knows how to bootstrap Ubuntu linux. Make sure to have a current debootstrap package: <br />
<pre><br />
apt-get update<br />
apt-get install debootstrap<br />
</pre><br />
The knowledge how to build ubuntu 'breezy badger' (which you probably want to be your guest at the time of writing) has been added recently.|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I make a vserver guest start by default?||Details=<br />
A: At least on Debian, I can tell you how to do it with the new-style config. If your guest is called "derjohn" and you want it to be started somewhere at the of your bootstrap process, then do:<br />
<pre><br />
echo "default" > /etc/vservers/derjohn/apps/init/mark<br />
</pre><br />
If you want to start it earlier, please read the init script "/etc/init.d/vserver-default" to find out how to do it. In most cases you don't need to change this. On Debian the vservers are started at "90", so after most other stuff is up (networking etc.).<br />
<br />
Besides that I created a small helper script for managing the autostart foo: ((vserver-autostart))|Signature=derjohn}}<br />
<br />
{{Question|Question=My host works, but when I start a guest it says that it has a problem with chbind.||Details=<br />
A: You are probably using util-vserver <= 0.30.209, which does use dynamic network contexts internally (With 0.30.210 this fact changed). So if you compiled your kernel without dynamic contexts, you may start guests, but you can't use the network context.The solution is either to switch to .210 util (or Hollow's toolset) or compile the kernel with dynamic network contexts.<br />
SE Keyword: invalid option `nid' testme.sh|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=When I try to ssh to the guest, I log into the host, even if I installed sshd on the guest. What's wrong here?||Details=<br />
A: Look at /etc/ssh/sshd_config of the host:<br />
<br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
#ListenAddress ::<br />
</pre><br />
<br />
And now change the setting to <br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
ListenAddress your.hosts.ip.here # not the guests IP! <br />
</pre><br />
<br />
Then '/etc/init.d/ssh restart' on the host, after that on the guest (if you did apt-get install ssh on the guest already.)<br />
<br />
Do I have to explain more? If the hosts sshd binds all available IP addresses on port 22 (The hosts 'sees' even all addresses of the guests!). So if the guest starts its sshd, it cant bind to port 22 any more. You need to change that setting only on the host. <br />
(BTW: A similar approach has to be done for a lot of daemons, e.g. Apache. If the daemon does not support an explicit bind, you may use the chbind command to 'hide' IP addresses from the daemon before starting.)|Signature=derjohn}}<br />
<br />
{{Question|Question=I did everything right, but the application foo does not start. What's up there?||Details=<br />
A: Before asking on the IRC channel, please check out the 'problematic programs' page:<br />
[[Problematic Programs]]|Signature=derjohn}}<br />
<br />
{{Question|Question=Bind9 does not like to start in my guest.||Details=<br />
A: Check out the 'problematic programs' page:<br />
((ProblematicPrograms)) and/or get my [((ProblematicPrograms)) and/or get my [http://linux-vserver.derjohn.de/bind9-packages/bind9-capacheck_9.3.2-2_i386.deb vserver-guest-ready Debian package] for Debian Sid guests from that URL: http://linux-vserver.derjohn.de/bind9-packages/bind9-capacheck_9.3.2-2_i386.deb and check out the [http://linux-vserver.derjohn.de/bind9-packages/README.txt readme]. (Hint: This is fresh stuff. The give me Feedback)<br />
<br />
[UPDATE] Since VServer Devel 2.1.1-rc18 you do not need to patch the userland tools anymore. The capabilities are masked.|Signature=derjohn}}<br />
<br />
{{Question|Question=Which guest vservers are running?||Details=<br />
A: {{vserver-stat}}. Example output:<br />
<pre><br />
CTX PROC VSZ RSS userTIME sysTIME UPTIME NAME<br />
0 77 965.1M 334.6M 14m14s18 2m28s69 1h33m46 root server<br />
49152 7 14M 5.2M 0m00s40 0m00s30 1h30m15 chiffon<br />
</pre>|Signature=derjohn}}<br />
<br />
<br />
<br />
{{Question|Question=How can I reboot/halt guests?||Details=<br />
A: It depends. <br />
For vserver with legacy-interfaces support, you have to replace {{/sbin/halt}} in guests with vreboot and start rebootmgr in host. You also need to have a dummy <guest>.conf file in /etc/vservers for each guest. Please have a look at /etc/init.d/rebootmgr.<br />
Vserver with native interface utilizes /dev/initctl. No changes are needed in guests. Just make sure that REBOOT capability is adjusted in guests.|Signature=derjohn}}<br />
<br />
{{Question|Question=Do I really need the legacy-interfaces? What are these legacy-interfaces?||Details=<br />
A: Since vserver is an ongoing project, new features might replace old ones, some might still on development. Legacy-interfaces are available for backward compability (which might be removed someday). See Q: How can I reboot/halt guests?|Signature=derjohn}}<br />
<br />
{{Question|Question= I have a vserver running on a Linux kernel with preemption. Is VServer "preempt" safe?||Details=<br />
A: There are no known issues about running vserver on a preemption enabled kernel. I would like to add, that the vserver kernelhackers would probably exclude that option in 'make menuconfig' if there would be an incompatibility. Just my $.02 :)|Signature=derjohn}}<br />
<br />
{{Question|Question=Is this a new project? When was it started?||Details=<br />
A: The first public occurance of linux-vserver was Oct 2001. The initial mail can be found here: http://www.cs.helsinki.fi/linux/linux-kernel/2001-40/1065.html<br />
So you can expect a mature software product wich does it's magic quite well (And hey, we have a version > 2.0 ! )|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=Can I run an OpenVPN Server in a guest?||Details=<br />
A: Yes. I don't want to provide an in-depth OpenVPN tutorial, but want to show how I made OpenVPN work in a guest as server. I was not able to run it with a tun devive, due to a buglet in util-vserver and kernel when it comes to settings a an ip address a point to point link: If you add "ip addr add <ip> peer <mypeer> dev tun0" there is no way to map the tun0 interface into a guest, even not with a 'nodev' option. (bug confirmed to be reproducible by daniel_hoczac)<br />
<br />
First of all you have to prepare the host with a persistent tuntap interface in tap-mode. The tools we need come from the uml-utilities.<br />
Then you need to create a device /dev/net/tun, which the OpenVPN userspace daemon reads. Well assume 10.10.10.100 is the server IP, and 10.10.10.101 is the client ip - to be cool be choose a /31 netmask (255.255.255.254), so we have a net without broadcast and don't waste IPs :)<br />
<br />
On the host do: <br />
<pre><br />
# apt-get install uml-utilities<br />
# cd /var/lib/vserver/<myopenvpnserver>/dev/<br />
# ./MAKEDEV tun<br />
(creates the dev/net/tun device accessible by te guest - even a tap interface need /dev/net/tun !)<br />
# tunctl -t tap0<br />
(creates the network device 'tap0' persistently)<br />
</pre><br />
<br />
Then add the ip to the guest:<br />
<pre><br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/ip<br />
10.10.10.100<br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/prefix<br />
31<br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/dev<br />
tap0<br />
(This kind of config brings the ip when the vserver is started - only the tap0 interface has to exist already, see above!)<br />
</pre><br />
<br />
Here is a sample config for the guest (which is acting as a server):<br />
<br />
Install OpenVPN package on server and client, in the Debian case:<br />
<pre><br />
# apt-get install openvpn<br />
</pre><br />
<br />
The server's conf looks like that:<br />
<pre><br />
# port and interface specs<br />
<br />
# behave like a ssl-webserver<br />
port 443<br />
proto tcp-server<br />
<br />
# tap device? (keep in mind you need /dev/net/tun !)<br />
dev tap0<br />
<br />
# now the ips we will use for the tunnel<br />
ifconfig 10.10.10.100 255.255.255.254<br />
ifconfig-noexec<br />
<br />
# the server part<br />
<br />
# Keep VPN connections, even if the client IP changes<br />
float<br />
<br />
# use compression (may also even obfuscate content filters)<br />
comp-lzo<br />
<br />
# use a static key - create it with 'openvpn --genkey --secret static.key'<br />
secret static.key<br />
<br />
# dont reload the key after a SIGUSR1<br />
persist-key<br />
<br />
# check alive all 10 secs<br />
keepalive 10 60<br />
<br />
# verbosity level (from 1 to 9, 9 is max log level)<br />
verb 4<br />
status openvpn-status.log<br />
</pre><br />
<br />
The client's conf may look like that (This example even makes the tunnel the clients default address):<br />
<pre><br />
# cat /etc/openvpn/client.conf<br />
# port and interface specs<br />
<br />
# the following is not necessary, if you bring up openvpn via Debian's init script:<br />
daemon ovpn-my-clients-name<br />
<br />
# behave like a ssl-webserver<br />
port 443<br />
proto tcp-client<br />
remote %%%<insert-the-guest-primary-public-ip-here>%%%%<br />
# what device tun ot tap?<br />
dev tap<br />
<br />
# now the ips we will use for the tunnel<br />
ifconfig 10.10.10.101 255.255.255.254<br />
<br />
# Keep VPN connections, even if the client IP changes<br />
float<br />
mssfix<br />
<br />
# use compression (may also even obfuscate content filters)<br />
comp-lzo<br />
<br />
# use a static key<br />
secret static.key<br />
<br />
# dont reload the key after a SIGUSR1<br />
persist-key<br />
<br />
# check alive all 10 secs<br />
keepalive 10 60<br />
<br />
# verbosity level (from 1 to 9, 9 is max log level)<br />
verb 4<br />
<br />
# set the default route<br />
route-gateway 10.10.10.100<br />
redirect-gateway def1<br />
# to add special routes you can do it wihtin the openvpn client conf:<br />
# route <dest> <mask> <gateway><br />
<br />
# if you need to connect via proxy (like squid)<br />
# http-proxy s p [up] [auth] : Connect to remote host through an HTTP proxy at<br />
# address s and port p. If proxy authentication is required,<br />
# up is a file containing username/password on 2 lines, or<br />
# 'stdin' to prompt from console. Add auth='ntlm' if<br />
# the proxy requires NTLM authentication.<br />
<br />
# http-proxy s p [up] [auth]<br />
<br />
<br />
# http-proxy-option type [parm] : Set extended HTTP proxy options.<br />
# Repeat to set multiple options.<br />
# VERSION version (default=1.0)<br />
# AGENT user-agent<br />
<br />
# http-proxy-option type [parm]<br />
</pre><br />
<br />
In the next lesson I will talk about OpenVPN's server mode, which can deal with with multiple clients connecting to one ip and one port (i.e. you only need one guest for tons or 'roadwarriros'), tls connections and pki.<br />
<br />
Contributions welcome. :)|Signature=derjohn}}<br />
<br />
{{Question|Question=32 vs 64 Bit? What should I take?||Details=<br />
A: If you have the choice make the host a 64 bit one. You can run a guest as 32 bit or as 64 bit on a 64 bit host. To run it as 32 bit, you need to compile the x86_64 (a.k.a. AMD64) with the following options:<br />
<br />
<pre><br />
[*] Kernel support for ELF binaries<br />
<M> Kernel support for MISC binaries<br />
[*] IA32 Emulation <---- without that, the entire 32bit API is not present<br />
<M> IA32 a.out support <br />
</pre><br />
<br />
You can force the guest to behave like a 32 environment like this:<br />
<pre><br />
echo linux_32bit > /etc/vservers/$NAME/personality<br />
echo i686 > /etc/vservers/$NAME/uts/machine<br />
</pre><br />
(thanks cehteh for the hint!)<br />
<br />
But you can force debootstrap to but 32 bit binaries into the guest by 'export ARCH=i386';<br />
<pre><br />
export ARCH=i386 ; vserver build .... <br />
</pre>|Signature=derjohn}}<br />
<br />
{{Question|Question=I want to (re)mount a partition in a running guest ... but the guest has no rights (capability) to (re)mount?||Details=<br />
A: I'll explain. I take as example your /tmp partition within the guest is too small, what will be likely the case if you stay with the 16MB default (vserver build mounts /tmp as 16 MB tempfs!).<br />
<pre><br />
# vnamespace -e XID mount -t tmpfs -o remount,size=256m,mode=1777 none /var/lib/vservers/<guest>/tmp/<br />
</pre><br />
Be warned that the guest will not recognize the change, as the /etc/mtab file is not updated when you mount like this. To permanently change the mount, edit /etc/vserver/<guest>/fstab on the host.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=How do I limit a guests RAM? I want to prevent OOM situations on the host!||Details=<br />
A: First you can read [http://linux-vserver.org/Memory+Allocation] and [[Memory Limits]].<br />
<br />
If you want a recipe, do that:<br />
1. Check the size of memory pages. On x86 and x86_64 is usually 4 KB per page.<br />
2. Create /etc/vserver/<guest>/rlimits/<br />
3. Check your physical memory size on the host, e.g. with "free -m". maxram = kilobytes/pagesize.<br />
4. Limit the guests physical RAM to value smaller then maxram:<br />
<br />
<pre><br />
echo %%insertYourPagesHereSmallerThanMaxram%% > /etc/vserver/<guest>/rlimits/rss<br />
</pre><br />
<br />
5. Check your swapspace, e.g. with 'swapon -s'. maxswap = swapkilobytes/pagesize.<br />
6. Limit the guest's maximum number of as pages to a value smaller than (maxram+maxswap):<br />
<br />
<pre><br />
echo %%desiredvalue%% > /etc/vserver/<guest>/rlimits/as<br />
</pre><br />
<br />
It should be clear this can still lead to OOM situations. Example: You have two guests and your as limit per guest is greater than 50% of (maxram+maxswap). If both guests request their maximum at the same point in time, there will be not enough mem .....|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=Were can I get newer versions of VServer as ready made packages for Debian?||Details=<br />
A: Here you go: http://linux-vserver.derjohn.de/ . There is also some stuff on backports.org, but my kernels are always 'devel' branch.|Signature=derjohn}}<br />
<br />
{{Question|Question=Can I use iptables ?||Details=<br />
Yes but right now only on the host (rootserver). Please realize that all traffic is local and will not touch the forward chain.|Signature=BeginnerFAQ}}<br />
<br />
{{Question|Question=Trying to connect to a vserver from the host or another vserver on the same host fails||Details=<br />
strace shows<br />
<pre> <br />
sin_addr=inet_addr("xx.xx.xx.xx")}, yy) = -1 EINVAL (Invalid argument)<br />
</pre><br />
A: The host/guest cannot communicate with another guest on same host.<br />
* check all netmasks on all interfaces (do they overlap) ?<br />
* check policy routing (disable it temporary) ?<br />
* check that lo is up (Networking within a host/guest always uses lo interface)<br />
|Signature=CommonProblems}}<br />
<br />
{{Question|Question=#1 ERROR: capset(): Operation not permitted||Details=capabilities are not enabled in kernel-setup<br />
please check that CONFIG_SECURITY_CAPABILITIES is loaded or included in the kernel. ( check with "cat /path_to_kernel/.config | grep -i cap ")<br />
(2.6.11.5-vs-1.9.5 + 0.30-205)|Signature=IrcQuestions}}<br />
<br />
{{Question|Question=How can I make 'vserver start' mount the root filesystem||Details=<br />
mount it via /etc/vservers/vserver-name/fstab, make sure to set the option 'dev' e.g.:<br />
<pre>/dev/drbd0 / xfs rw,dev 0 0</pre><br />
util-vserver 210 won't be able to find some scripts for the reboot, add into /etc/vservers/vserver-name/apps/init/cmd.stop<br />
<pre>/etc/init.d/rc<br />
6</pre><br />
|Signature=AdrianReyer}}<br />
<br />
{{Question|Question=How do I tag a guest's directory with xid?||Details=<br />
Tagging the guest's files gives you serveral advantages, e.g. the accoutung will work properly.<br />
Filesystem XID tagging only works on supported filesystem. Those are currently: ext2/3, reiserfs/reiser3, xfs and jfs.<br />
To activate the XID tagging you have to mount the filesystem with "-o tagxid". Attention: It's _not_ possible to "-o remount,tagxid", you have to mount it freshly. The guests will tag their files automatiaclly. If you copy files in from the host, you have to tag them manually like this:<br />
<pre>chxid -c xid -R /var/lib/vservers/<guest></pre><br />
Note: Context 0 and 1 will see all files, guests will only be able to acess untagged files and their own XID. They can see other XID files but no information about the file, e.g. no owner, no group, no permissions.<br />
|Signature=derjohn_and_gonzo_and_are}}<br />
<br />
More FAQs to be merged;<br />
[http://www.linux-vserver.org/Frequently_Asked_Questions_scratch]<br />
<br />
{{Question|Question=My mysqld running in a guest behaves strangely and is awfully slow/locks up||Details=<br />
This can be related to /tmp being too small. mysqld stores temporary tables in /tmp and as such, if a lot of queries happen and /tmp runs full this can cause one query to lock up whilst creating the tmp table and all other queries waiting to acquire the lock. There are two possible solutions to that problem: a.) Modify /etc/vservers/vserver-name/fstab and assign more memory to the tmpfs of /tmp and b.) remove the /tmp entry from /etc/vservers/vserver-name/fstab completly. Especially on database servers with a rather high load the second one might be the preferred method.|Signature=sp}}<br />
<br />
<br />
{{Question|Question="I deleted a guest's directory without shutting it down. Now I have a "ghost" running. Is there any possibility to get it out of proc without rebooting?||Details=vkill --xid <xid> -s 15; sleep 2; vkill --xid <xid> -s 9|Signature=daniel_hozac}}<br />
<br />
== Upgrade from 2.0 to 2.2 ==<br />
<br />
{{Question|Question=I now get errors like "ncontext: vc_net_create(): Invalid argument; dynamic contexts disabled." on startup. Vservers are not started||Details=Dynamic context are disabled by default and are deprecated. For example, tagxid and network checks won't be useable with dynamic ids. Now you should manually assign a explicit context to your vservers, like<br />
echo 101 > /etc/vservers/myvserv/context<br />
|Signature=daniel_hozac&Beuc}}</div>82.238.35.175