Tag Info

Hot answers tagged

35

No matter the fancy name used here, both are solutions to a specific problem: A better segregation solution than classic Unix chroot. Operating system-level virtualization, containers, zones, or even "chroot with steroids" are names or commercial titles that define the same concept of userspace separation, but with different features. Chroot was introduced ...


14

Since the release of 0.9 Docker has dropped LXC and uses its own execution environment, libcontainer. Your question's a bit old but I guess my answer still applies the version you are using. Quick Answer: To understand the permissions of volumes, you can take the analogy of mount --bind Host-Dir Container-Dir. So to fulfill your requirement you can use any ...


11

Starting the process inside a network namespace that can only see the desired IP address can accomplish something similar. For instance, supposed I only wanted localhost available to a particular program. First, I create the network namespace: ip netns add limitednet Namespaces have a loopback interface by default, so next I just need to bring it up: ...


10

This is pretty much right—though you're missing a line like this: lxc.network.ipv4.gateway = X.X.X.X I have an LXC guest running on Debian. First, you set up the host bridge (the easy way), in /etc/network/interfaces: auto wan iface wan inet static address 72.X.X.X netmask 255.255.255.0 gateway 72.X.X.1 bridge_ports ...


10

I disagree with accepted answer. First, you should design your containers with separation of state in mind (in the MySQL case this means that at least /var/lib/mysql goes in its own volume). Secondly, you should determine a strategy for upgrades; state-of-the-art would be to create versioned images for each set of apt packages upgrade and have them tested ...


9

To create the directory automatically in the container, you can also add the create=dir option in the fstab : /mnt/ssd/solr_data /var/lib/lxc/Solr4StandAlone/rootfs/data none bind,create=dir Edit : this is specific to LXC. See this thread Just like we already had "optional", this adds two new LXC-specific mount flags: create=dir ...


9

I had to create the /data folder in the local container before the mount would work properly. I also used this fstab entry: /mnt/ssd/solr_data /var/lib/lxc/Solr4StandAlone/rootfs/data none bind 0 0


9

Unprivileged LXC containers are the ones making use of user namespaces (userns). I.e. of a kernel feature that allows to map a range of UIDs on the host into a namespace inside of which a user with UID 0 can exist again. Contrary to my initial perception of unprivileged LXC containers for a while, this does not mean that the container has to be owned by an ...


8

The traditional answer is to run the program as another user and use iptables -m owner. That way, the network configuration is shared. However, with the advent of namespaces, there is an easier way. With namespaces, you unshare the network, then create a virtual network link if you need limited network access. To share unix domain sockets, all you need is ...


8

Have you tried lxc-attach instead? According the documentation, lxc-attach - start a process inside a running container. Example to list all folders inside home of the container lxc-attach -n myContainer -- ls -lh /home If no process is defined, it creates a new shell inside the container.


8

Running unprivileged containers is the safest way to run containers in a production environment. Containers get bad publicity when it comes to security and one of the reasons is because some users have found that if a user gets root in a container then there is a possibility of gaining root on the host as well. Basically what an unprivileged container does ...


7

You may want to try xpra or NX, VNC, etc Also take a look at VirtualGL if you want GL acceleration. If you can share a directory with the host, you could then use mmap with xpra (would probably require a trivial path change unless it is /tmp/) which provides very significant performance improvements.


6

At some point over the past couple of months, the upstart script in the tutorial was changed to remove the loop to wait for docker to start. I removed the loop from my upstart scripts and my containers now restart correctly after a reboot. My /etc/init/service-name.conf script now looks like this: description "service description" ...


6

You can run older Linux programs on newer kernels. Linux maintains backward compatibility (at least for all documented interfaces), for the benefit of people who are running old binaries for one reason or another (because they don't want to bother recompiling, because they've lost the source, because this is commercial software for which they don't have the ...


6

LXC is a little bit better because it can run containers as unpriveleged users. This is possible with systemd-nspawn, but only for scenarios where you only need one user (instead of multiple), which can be difficult or less secure for multi process in container scenarios. If you want to know why docker, lxc, and systemd-nspawn are inherently not a solid ...


5

You didn't write why you choose LXC as it's not the most secure virtualization solution. I'm heavy user of KVM/XEN and also LXC and I can say this one thing that when it comes to security I never go with Linux containers (no matter if LXC / OpenVZ / VServer). It's just easier (and more reliable) with KVM/XEN. If it's about performance or hardware ...


4

For future readers, I wrote this email to some colleagues of mine who are working with me on configuring LXC and figuring out the bridging. Well, I spent most of the day today fussing with networking in LXC, and now things are a lot clearer, so I thought I’d pass on what I learned. First is a couple of definitions so we know what we’re looking at (I ...


4

From the errors you're getting it looks like the 2nd host is missing the network bridge lxcbr0. Other things to consider: Also what steps did you follow to "move" the container? Did you copy both the container's file and .conf files? Did you use a command like this to recreate this host's container on the 2nd host? $ lxc-create -t TEMPLATE -f lxc.conf ...


4

Firejail is a Linux namespaces sandbox program that can jail Firefox or any other GUI software. It should work on any Linux computer.


4

Give this Howto a look. It's a little dated but should have the general steps you need to setup a Git server. The howto is titled: How To Install A Public Git Repository On A Debian Server. General steps Install git + gitweb $ sudo apt-get install git-core gitweb Setup gitweb directories $ sudo mkdir /var/www/git $ [ -d "/var/cache/git" ] || sudo mkdir ...


4

TL;DR: If you don't build it in yourself, it's not going to happen. The effective way to do this is to simply write a custom start script for your container specified by CMD in your Dockerfile. In this file, run an apt-get update && apt-get upgrade -qqy before starting whatever you're running. You then have a couple way of ensuring updates get to ...


4

With Docker you can do this very easily. docker pull ubuntu docker run -t -i ubuntu /bin/bash # make your changes and then log out docker commit $(docker ps -a -q | head -n 1) sandbox cat > /usr/local/bin/sandbox <<EOF #!/bin/sh exec docker run -t -i --rm=true sandbox /bin/bash EOF chmod a+x /usr/local/bin/sandbox echo /usr/local/bin/sandbox ...


4

First, cgroups are not used to isolate an application from others on a system. They are used to manage resource usage and device access. It's the various namespaces (PID, UTS, mount, user...) that provide some (limited) isolation. Moreover, a process launched inside a Docker container will probably not be able to manage the AppArmor profile it is running ...


4

LXC (or other uses of the cgroups facility) requires the cgroups filesystem to be mounted (see §2.1 in the cgroups kernel documentation). It seems that as of Debian wheezy, this doesn't happen automatically. Add the following line to /etc/fstab: cgroup /sys/fs/cgroup cgroup defaults For a one-time thing, mount it manually: mount -t cgroup cgroup ...


4

They are very valuable tools for testing, sandboxing and encapsulation. Want a webserver to be safely locked in its own working environment, unable to access sensitive private files? Use a container. You have an application that requires old versions of libraries, and specific configuration files, incompatible with other applications? Also a container. It's ...


3

Best Disk I/O: LXC > KVM > UML. No overhead to speak of with LXC, KVM adds a layer of indirection so it will be slower (but you could also use it with raw disks), UML will be much slower. Least CPU overhead: LXC > KVM > UML. No overhead to speak of with LXC, small overhead with KVM, bigger overhead with UML. Strict separation and security: UML > KVM > LXC. ...


3

It should work, as long the interface is still up ifconfig eth0 | grep UP UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 the bridge is a "switch" and it doesn't need to have one IP. But please check if you have firewall rules in eth0: iptables -l -vnx if rp_filter is off cat /proc/sys/net/ipv4/conf/eth1/rp_filter 0 and if all fails, try ...


3

I haven't gotten fully into LXC, but i have setup multiple containers with there own static ip's in lan which provide internet services for some of my websites... Maybe this can help, on what you want for yours. I run multiple containers, like so, ON HOST MACHINE I Edited The Host's File, Adding Each Container & Host Machine: vi /etc/hosts lxc ...


3

From ip man page for network name space ip netns - process network namespace management A network namespace is logically another copy of the network stack, with it's own routes, firewall rules, and network devices. By convention a named network namespace is an object at /var/run/netns/NAME that can be opened. The ...


3

If you look at the LXC homepage, you'll notice liblxc referred to, implying there's an ABI, and if you look further down, you'll notice a link to the C API documentation. That page looks empty at first because it has been done (rather lazily, I think) with doxygen. However, if you start clicking around you'll find stuff. Just keep in mind, again, that ...



Only top voted, non community-wiki answers of a minimum length are eligible