Tag Info

Hot answers tagged

7

The traditional answer is to run the program as another user and use iptables -m owner. That way, the network configuration is shared. However, with the advent of namespaces, there is an easier way. With namespaces, you unshare the network, then create a virtual network link if you need limited network access. To share unix domain sockets, all you need is ...


4

This is pretty much right—though you're missing a line like this: lxc.network.ipv4.gateway = X.X.X.X I have an LXC guest running on Debian. First, you set up the host bridge (the easy way), in /etc/network/interfaces: auto wan iface wan inet static address 72.X.X.X netmask 255.255.255.0 gateway 72.X.X.1 bridge_ports ...


4

You may want to try xpra or NX, VNC, etc Also take a look at VirtualGL if you want GL acceleration. If you can share a directory with the host, you could then use mmap with xpra (would probably require a trivial path change unless it is /tmp/) which provides very significant performance improvements.


3

You didn't write why you choose LXC as it's not the most secure virtualization solution. I'm heavy user of KVM/XEN and also LXC and I can say this one thing that when it comes to security I never go with Linux containers (no matter if LXC / OpenVZ / VServer). It's just easier (and more reliable) with KVM/XEN. If it's about performance or hardware ...


3

If you look at the LXC homepage, you'll notice liblxc referred to, implying there's an ABI, and if you look further down, you'll notice a link to the C API documentation. That page looks empty at first because it has been done (rather lazily, I think) with doxygen. However, if you start clicking around you'll find stuff. Just keep in mind, again, that ...


3

It should work, as long the interface is still up ifconfig eth0 | grep UP UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 the bridge is a "switch" and it doesn't need to have one IP. But please check if you have firewall rules in eth0: iptables -l -vnx if rp_filter is off cat /proc/sys/net/ipv4/conf/eth1/rp_filter 0 and if all fails, try ...


2

The command is systemctl to control the services under systemd to disable the service from running next time: systemctl disable udevd.service to stop the service currently running : systemctl stop udevd.service Go through these doc links from the author of systemd http://0pointer.de/blog/projects/systemd.html ...


2

I haven't gotten fully into LXC, but i have setup multiple containers with there own static ip's in lan which provide internet services for some of my websites... Maybe this can help, on what you want for yours. I run multiple containers, like so, ON HOST MACHINE I Edited The Host's File, Adding Each Container & Host Machine: vi /etc/hosts lxc ...


2

A big thanks to Red Hat, I finally tracked down the reference documentation I was looking for in their documentation. I expect that there's no difference between Red Hat and other distros on this point. https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Resource_Management_Guide/ch-Subsystems_and_Tunable_Parameters.html


2

cgroups is still quite in flux in the Linux kernel. Probably the best documentation is LWN's coverage, perhaps H-online or Kernelnewbies have something to say. Currently systemd is the most prolific user.


2

For future readers, I wrote this email to some colleagues of mine who are working with me on configuring LXC and figuring out the bridging. Well, I spent most of the day today fussing with networking in LXC, and now things are a lot clearer, so I thought I’d pass on what I learned. First is a couple of definitions so we know what we’re looking at (I ...


2

Best Disk I/O: LXC > KVM > UML. No overhead to speak of with LXC, KVM adds a layer of indirection so it will be slower (but you could also use it with raw disks), UML will be much slower. Least CPU overhead: LXC > KVM > UML. No overhead to speak of with LXC, small overhead with KVM, bigger overhead with UML. Strict separation and security: UML > KVM > LXC. ...


2

Give this Howto a look. It's a little dated but should have the general steps you need to setup a Git server. The howto is titled: How To Install A Public Git Repository On A Debian Server. General steps Install git + gitweb $ sudo apt-get install git-core gitweb Setup gitweb directories $ sudo mkdir /var/www/git $ [ -d "/var/cache/git" ] || sudo mkdir ...


2

From ip man page for network name space ip netns - process network namespace management A network namespace is logically another copy of the network stack, with it's own routes, firewall rules, and network devices. By convention a named network namespace is an object at /var/run/netns/NAME that can be opened. The ...


2

You can't use a bridge interface to forward traffic between subnets. Bridges are meant for joining two layer 2 networks, not 2 subnets (which are layer 3). You have to route traffic between the networks instead. Well, technically you could bridge them, but it requires you to add a routing rule to every single host on both subnets letting them know that they ...


2

Have you tried lxc-attach instead? According the documentation, lxc-attach - start a process inside a running container. Example to list all folders inside home of the container lxc-attach -n myContainer -- ls -lh /home If no process is defined, it creates a new shell inside the container.


1

Evidently, Phusion packages their own Ubuntu 12.04 Vagrant boxes which run the required 3.8 kernel to make it easier to use Docker. They also provide the memory and swap accounting kernel init parameters to make these features available to LXC. To use these boxes, simply update the box name and URL in your Vagrantfile: # ... ...


1

From the errors you're getting it looks like the 2nd host is missing the network bridge lxcbr0. Other things to consider: Also what steps did you follow to "move" the container? Did you copy both the container's file and .conf files? Did you use a command like this to recreate this host's container on the 2nd host? $ lxc-create -t TEMPLATE -f lxc.conf ...


1

lxc-execute is designed to create and run and lxc container and execute the command. So it can not be used to execute a command currently setup and started one. Quotation from Serge E. Hallyn @ https://www.mail-archive.com/lxc-users@lists.sourceforge.net/msg00134.html Moving an existing process into an existing, populated namespace will likely never ...


1

Normally, chroot is about "limiting privileges", not granting users their own IF to play with... But in any case: if you feel like doing some work, you may start your chroot environment within a new network namespace. You find an introduction here. Then the last command, the one that places you into the new network namespace, which in the guide above is ...


1

The VirtualBox Linux kernel driver (vboxdrv) is either not loaded or there is a permission problem with /dev/vboxdrv. Re-setup the kernel module by executing '/etc/init.d/vboxdrv setup' as root. Users of Ubuntu or Fedora should install the DKMS package at first. This package keeps track of Linux kernel changes and recompiles the vboxdrv kernel module if ...


1

Yes it works. It depends on your operating system on how to configure such a network setup in a way that the bridge is up and running after a reboot in that constellation. From my experience: SLES10 SP4: Works - do not use yast2 SLES11 SP2: Works - use mv to rename the bridge to something useful after setup with yast2 Ubuntu 10.04 LTS: Works only ...


1

This might shed some light: Virtual Ethernet device. Might giving you something like this: Sure you do not have some configuration under /var/lib/lxc/ with lxc.network.type = veth ? grep -r 'veth' /var/lib/lxc/


1

NOTE: This approach is a bit of a hack. It also does not support copy and paste between host and guest - and is totally insecure! Add /tmp as an additional filesystem in the guest configuration, which passes through to /tmp on the host. Ensure that your X server is not configured to accept network connections of any kind, because the next step disables X ...



Only top voted, non community-wiki answers of a minimum length are eligible