Hot answers tagged

50

No matter the fancy name used here, both are solutions to a specific problem: A better segregation solution than classic Unix chroot. Operating system-level virtualization, containers, zones, or even "chroot with steroids" are names or commercial titles that define the same concept of userspace separation, but with different features. Chroot was introduced ...


16

Since the release of 0.9 Docker has dropped LXC and uses its own execution environment, libcontainer. Your question's a bit old but I guess my answer still applies the version you are using. Quick Answer: To understand the permissions of volumes, you can take the analogy of mount --bind Host-Dir Container-Dir. So to fulfill your requirement you can use any ...


14

Unprivileged LXC containers are the ones making use of user namespaces (userns). I.e. of a kernel feature that allows to map a range of UIDs on the host into a namespace inside of which a user with UID 0 can exist again. Contrary to my initial perception of unprivileged LXC containers for a while, this does not mean that the container has to be owned by an ...


11

This is pretty much right—though you're missing a line like this: lxc.network.ipv4.gateway = X.X.X.X I have an LXC guest running on Debian. First, you set up the host bridge (the easy way), in /etc/network/interfaces: auto wan iface wan inet static address 72.X.X.X netmask 255.255.255.0 gateway 72.X.X.1 bridge_ports ...


11

I disagree with accepted answer. First, you should design your containers with separation of state in mind (in the MySQL case this means that at least /var/lib/mysql goes in its own volume). Secondly, you should determine a strategy for upgrades; state-of-the-art would be to create versioned images for each set of apt packages upgrade and have them tested ...


11

Starting the process inside a network namespace that can only see the desired IP address can accomplish something similar. For instance, supposed I only wanted localhost available to a particular program. First, I create the network namespace: ip netns add limitednet Namespaces have a loopback interface by default, so next I just need to bring it up: ...


10

To create the directory automatically in the container, you can also add the create=dir option in the fstab : /mnt/ssd/solr_data /var/lib/lxc/Solr4StandAlone/rootfs/data none bind,create=dir Edit : this is specific to LXC. See this thread Just like we already had "optional", this adds two new LXC-specific mount flags: create=dir ...


9

I had to create the /data folder in the local container before the mount would work properly. I also used this fstab entry: /mnt/ssd/solr_data /var/lib/lxc/Solr4StandAlone/rootfs/data none bind 0 0


9

Running unprivileged containers is the safest way to run containers in a production environment. Containers get bad publicity when it comes to security and one of the reasons is because some users have found that if a user gets root in a container then there is a possibility of gaining root on the host as well. Basically what an unprivileged container does ...


8

The traditional answer is to run the program as another user and use iptables -m owner. That way, the network configuration is shared. However, with the advent of namespaces, there is an easier way. With namespaces, you unshare the network, then create a virtual network link if you need limited network access. To share unix domain sockets, all you need is ...


8

Have you tried lxc-attach instead? According the documentation, lxc-attach - start a process inside a running container. Example to list all folders inside home of the container lxc-attach -n myContainer -- ls -lh /home If no process is defined, it creates a new shell inside the container.


7

You may want to try xpra or NX, VNC, etc Also take a look at VirtualGL if you want GL acceleration. If you can share a directory with the host, you could then use mmap with xpra (would probably require a trivial path change unless it is /tmp/) which provides very significant performance improvements.


7

LXC is a little bit better because it can run containers as unpriveleged users. This is possible with systemd-nspawn, but only for scenarios where you only need one user (instead of multiple), which can be difficult or less secure for multi process in container scenarios. If you want to know why docker, lxc, and systemd-nspawn are inherently not a solid ...


6

At some point over the past couple of months, the upstart script in the tutorial was changed to remove the loop to wait for docker to start. I removed the loop from my upstart scripts and my containers now restart correctly after a reboot. My /etc/init/service-name.conf script now looks like this: description "service description" ...


6

With Docker you can do this very easily. docker pull ubuntu docker run -t -i ubuntu /bin/bash # make your changes and then log out docker commit $(docker ps -a -q | head -n 1) sandbox cat > /usr/local/bin/sandbox <<EOF #!/bin/sh exec docker run -t -i --rm=true sandbox /bin/bash EOF chmod a+x /usr/local/bin/sandbox echo /usr/local/bin/sandbox ...


6

First, cgroups are not used to isolate an application from others on a system. They are used to manage resource usage and device access. It's the various namespaces (PID, UTS, mount, user...) that provide some (limited) isolation. Moreover, a process launched inside a Docker container will probably not be able to manage the AppArmor profile it is running ...


6

You can run older Linux programs on newer kernels. Linux maintains backward compatibility (at least for all documented interfaces), for the benefit of people who are running old binaries for one reason or another (because they don't want to bother recompiling, because they've lost the source, because this is commercial software for which they don't have the ...


6

A better and safer solution is to install cgmanager and run it with systemctl start cgmanager (on a systemd-based distro). You can than have your root user, or if you have sudo rights on the host create cgroups for your unprivileged user in all controllers with: sudo cgm create all $USER sudo cgm chown all $USER $(id -u $USER) $(id -g $USER) Once they ...


6

Turns out, surprise surprise, this is a Ubuntu-specific thing. The cause The problem: although the kernel has cgroups enabled (check with grep CGROUP /boot/config-$(uname -r)) and cgmanager is running, there is no cgroup specific to my user. You can check that with: $ cat /proc/self/cgroup 11:hugetlb:/ 10:perf_event:/ 9:blkio:/ 8:freezer:/ 7:devices:/ ...


5

You didn't write why you choose LXC as it's not the most secure virtualization solution. I'm heavy user of KVM/XEN and also LXC and I can say this one thing that when it comes to security I never go with Linux containers (no matter if LXC / OpenVZ / VServer). It's just easier (and more reliable) with KVM/XEN. If it's about performance or hardware ...


5

For future readers, I wrote this email to some colleagues of mine who are working with me on configuring LXC and figuring out the bridging. Well, I spent most of the day today fussing with networking in LXC, and now things are a lot clearer, so I thought I’d pass on what I learned. First is a couple of definitions so we know what we’re looking at (I ...


5

I was just doing something very similar, moving KVM VMs into unprivileged LXC. I was using system containers for this (so they can be started automatically on boot), but with mapped UID/GIDs (user namespaces). edit /etc/subuid,subgid (I mapped uid/gids 10M-100M to root and use 100K per container) for first container, use u/gids 10000000-10099999 in ...


5

Debootstrap is in aur/debootstrap package. After installation process you will have to make a symlink in /usr/bin: cd /usr/bin ; ln -sf debootstrap qemu-debootstrap After that do what ouzmoutous suggests. Anyway I always advise to use downloaded templates. HTH


4

I haven't gotten fully into LXC, but i have setup multiple containers with there own static ip's in lan which provide internet services for some of my websites... Maybe this can help, on what you want for yours. I run multiple containers, like so, ON HOST MACHINE I Edited The Host's File, Adding Each Container & Host Machine: vi /etc/hosts lxc ...


4

Give this Howto a look. It's a little dated but should have the general steps you need to setup a Git server. The howto is titled: How To Install A Public Git Repository On A Debian Server. General steps Install git + gitweb $ sudo apt-get install git-core gitweb Setup gitweb directories $ sudo mkdir /var/www/git $ [ -d "/var/cache/git" ] || sudo mkdir ...


4

On your LXC host (I'm assuming Ubuntu here): Install the virtualbox-dkms, linux-headers-generic, build-essential packages and check the kernel modules are loaded: myhost$ sudo /etc/init.d/virtualbox status VirtualBox kernel modules are loaded. Get the VirtualBox device numbers (10, 55/56/57 in my case): myhost$ ls -la /dev | grep vbox crw------- 1 root ...


4

From the errors you're getting it looks like the 2nd host is missing the network bridge lxcbr0. Other things to consider: Also what steps did you follow to "move" the container? Did you copy both the container's file and .conf files? Did you use a command like this to recreate this host's container on the 2nd host? $ lxc-create -t TEMPLATE -f lxc.conf ...


4

Firejail is a Linux namespaces sandbox program that can jail Firefox or any other GUI software. It should work on any Linux computer.


4

Normally, chroot is about "limiting privileges", not granting users their own IF to play with... But in any case: if you feel like doing some work, you may start your chroot environment within a new network namespace. You find an introduction here. Then the last command, the one that places you into the new network namespace, which in the guide above is ...


4

TL;DR: If you don't build it in yourself, it's not going to happen. The effective way to do this is to simply write a custom start script for your container specified by CMD in your Dockerfile. In this file, run an apt-get update && apt-get upgrade -qqy before starting whatever you're running. You then have a couple way of ensuring updates get to ...



Only top voted, non community-wiki answers of a minimum length are eligible