Tag Info

Hot answers tagged

23

No matter the fancy name used here, both are solutions to a specific problem: A better segregation solution than classic Unix chroot. Operating system-level virtualization, containers, zones, or even "chroot with steriods" are names or commercial titles that defines the same concept of userspace separation, but with different features. Chroot was introduced ...


11

Starting the process inside a network namespace that can only see the desired IP address can accomplish something similar. For instance, supposed I only wanted localhost available to a particular program. First, I create the network namespace: ip netns add limitednet Namespaces have a loopback interface by default, so next I just need to bring it up: ...


9

I had to create the /data folder in the local container before the mount would work properly. I also used this fstab entry: /mnt/ssd/solr_data /var/lib/lxc/Solr4StandAlone/rootfs/data none bind 0 0


9

Since the release of 0.9 Docker has dropped LXC and uses its own execution environment, libcontainer. Your question's a bit old but I guess my answer still applies the version you are using. Quick Answer: To understand the permissions of volumes, you can take the analogy of mount --bind Host-Dir Container-Dir. So to fulfill your requirement you can use any ...


8

To create the directory automatically in the container, you can also add the create=dir option in the fstab : /mnt/ssd/solr_data /var/lib/lxc/Solr4StandAlone/rootfs/data none bind,create=dir Edit : this is specific to LXC. See this thread Just like we already had "optional", this adds two new LXC-specific mount flags: create=dir ...


8

The traditional answer is to run the program as another user and use iptables -m owner. That way, the network configuration is shared. However, with the advent of namespaces, there is an easier way. With namespaces, you unshare the network, then create a virtual network link if you need limited network access. To share unix domain sockets, all you need is ...


8

Running unprivileged containers is the safest way to run containers in a production environment. Containers get bad publicity when it comes to security and one of the reasons is because some users have found that if a user gets root in a container then there is a possibility of gaining root on the host as well. Basically what an unprivileged container does ...


7

This is pretty much right—though you're missing a line like this: lxc.network.ipv4.gateway = X.X.X.X I have an LXC guest running on Debian. First, you set up the host bridge (the easy way), in /etc/network/interfaces: auto wan iface wan inet static address 72.X.X.X netmask 255.255.255.0 gateway 72.X.X.1 bridge_ports ...


7

I disagree with accepted answer. First, you should design your containers with separation of state in mind (in the MySQL case this means that at least /var/lib/mysql goes in its own volume). Secondly, you should determine a strategy for upgrades; state-of-the-art would be to create versioned images for each set of apt packages upgrade and have them tested ...


7

Unprivileged LXC containers are the ones making use of user namespaces (userns). I.e. of a kernel feature that allows to map a range of UIDs on the host into a namespace inside of which a user with UID 0 can exist again. Contrary to my initial perception of unprivileged LXC containers for a while, this does not mean that the container has to be owned by an ...


6

You may want to try xpra or NX, VNC, etc Also take a look at VirtualGL if you want GL acceleration. If you can share a directory with the host, you could then use mmap with xpra (would probably require a trivial path change unless it is /tmp/) which provides very significant performance improvements.


6

You can run older Linux programs on newer kernels. Linux maintains backward compatibility (at least for all documented interfaces), for the benefit of people who are running old binaries for one reason or another (because they don't want to bother recompiling, because they've lost the source, because this is commercial software for which they don't have the ...


5

You didn't write why you choose LXC as it's not the most secure virtualization solution. I'm heavy user of KVM/XEN and also LXC and I can say this one thing that when it comes to security I never go with Linux containers (no matter if LXC / OpenVZ / VServer). It's just easier (and more reliable) with KVM/XEN. If it's about performance or hardware ...


5

At some point over the past couple of months, the upstart script in the tutorial was changed to remove the loop to wait for docker to start. I removed the loop from my upstart scripts and my containers now restart correctly after a reboot. My /etc/init/service-name.conf script now looks like this: description "service description" ...


4

Best Disk I/O: LXC > KVM > UML. No overhead to speak of with LXC, KVM adds a layer of indirection so it will be slower (but you could also use it with raw disks), UML will be much slower. Least CPU overhead: LXC > KVM > UML. No overhead to speak of with LXC, small overhead with KVM, bigger overhead with UML. Strict separation and security: UML > KVM > LXC. ...


4

Have you tried lxc-attach instead? According the documentation, lxc-attach - start a process inside a running container. Example to list all folders inside home of the container lxc-attach -n myContainer -- ls -lh /home If no process is defined, it creates a new shell inside the container.


4

TL;DR: If you don't build it in yourself, it's not going to happen. The effective way to do this is to simply write a custom start script for your container specified by CMD in your Dockerfile. In this file, run an apt-get update && apt-get upgrade -qqy before starting whatever you're running. You then have a couple way of ensuring updates get to ...


4

With Docker you can do this very easily. docker pull ubuntu docker run -t -i ubuntu /bin/bash # make your changes and then log out docker commit $(docker ps -a -q | head -n 1) sandbox cat > /usr/local/bin/sandbox <<EOF #!/bin/sh exec docker run -t -i --rm=true sandbox /bin/bash EOF chmod a+x /usr/local/bin/sandbox echo /usr/local/bin/sandbox ...


4

First, cgroups are not used to isolate an application from others on a system. They are used to manage resource usage and device access. It's the various namespaces (PID, UTS, mount, user...) that provide some (limited) isolation. Moreover, a process launched inside a Docker container will probably not be able to manage the AppArmor profile it is running ...


4

LXC is a little bit better because it can run containers as unpriveleged users. This is possible with systemd-nspawn, but only for scenarios where you only need one user (instead of multiple), which can be difficult or less secure for multi process in container scenarios. If you want to know why docker, lxc, and systemd-nspawn are inherently not a solid ...


4

They are very valuable tools for testing, sandboxing and encapsulation. Want a webserver to be safely locked in its own working environment, unable to access sensitive private files? Use a container. You have an application that requires old versions of libraries, and specific configuration files, incompatible with other applications? Also a container. It's ...


3

From the errors you're getting it looks like the 2nd host is missing the network bridge lxcbr0. Other things to consider: Also what steps did you follow to "move" the container? Did you copy both the container's file and .conf files? Did you use a command like this to recreate this host's container on the 2nd host? $ lxc-create -t TEMPLATE -f lxc.conf ...


3

Firejail is a Linux namespaces sandbox program that can jail Firefox or any other GUI software. It should work on any Linux computer.


3

Give this Howto a look. It's a little dated but should have the general steps you need to setup a Git server. The howto is titled: How To Install A Public Git Repository On A Debian Server. General steps Install git + gitweb $ sudo apt-get install git-core gitweb Setup gitweb directories $ sudo mkdir /var/www/git $ [ -d "/var/cache/git" ] || sudo mkdir ...


3

It should work, as long the interface is still up ifconfig eth0 | grep UP UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 the bridge is a "switch" and it doesn't need to have one IP. But please check if you have firewall rules in eth0: iptables -l -vnx if rp_filter is off cat /proc/sys/net/ipv4/conf/eth1/rp_filter 0 and if all fails, try ...


3

I haven't gotten fully into LXC, but i have setup multiple containers with there own static ip's in lan which provide internet services for some of my websites... Maybe this can help, on what you want for yours. I run multiple containers, like so, ON HOST MACHINE I Edited The Host's File, Adding Each Container & Host Machine: vi /etc/hosts lxc ...


3

From ip man page for network name space ip netns - process network namespace management A network namespace is logically another copy of the network stack, with it's own routes, firewall rules, and network devices. By convention a named network namespace is an object at /var/run/netns/NAME that can be opened. The ...


3

If you look at the LXC homepage, you'll notice liblxc referred to, implying there's an ABI, and if you look further down, you'll notice a link to the C API documentation. That page looks empty at first because it has been done (rather lazily, I think) with doxygen. However, if you start clicking around you'll find stuff. Just keep in mind, again, that ...


3

Okay, your main problem doesn't appear to be the way you execute this. That's relatively easy with ForceCommand inside a Match block of sshd_config. In order to do what you want to achieve, i.e. a throw-away container that "self-destructs" after use, you can use lxc-start-ephemeral. That's to say your use-case has already been considered in the set of LXC ...


3

There are different ways to achieve your goal. If the guests share a virtual network (i.e. are not just bridged to the physical interface) it's easy. Just tell your services to listen on that interface - or create a new guest and let that one host the service. If the guests are bridged to ethX, you might still want to consider creating a virtual ...



Only top voted, non community-wiki answers of a minimum length are eligible