Hot answers tagged

60

No matter the fancy name used here, both are solutions to a specific problem: A better segregation solution than classic Unix chroot. Operating system-level virtualization, containers, zones, or even "chroot with steroids" are names or commercial titles that define the same concept of userspace separation, but with different features. Chroot was introduced ...


17

Since the release of 0.9 Docker has dropped LXC and uses its own execution environment, libcontainer. Your question's a bit old but I guess my answer still applies the version you are using. Quick Answer: To understand the permissions of volumes, you can take the analogy of mount --bind Host-Dir Container-Dir. So to fulfill your requirement you can use any ...


16

Unprivileged LXC containers are the ones making use of user namespaces (userns). I.e. of a kernel feature that allows to map a range of UIDs on the host into a namespace inside of which a user with UID 0 can exist again. Contrary to my initial perception of unprivileged LXC containers for a while, this does not mean that the container has to be owned by an ...


12

This image can help you to understand the main difference between them: What all of them have in common, is that all these 3 technologies are related to containers. Containers are a lightweight virtualization mechanism that does not require you to set up a virtual machine on an emulation of physical hardware. In Linux, what they have in common are the ...


11

I disagree with accepted answer. First, you should design your containers with separation of state in mind (in the MySQL case this means that at least /var/lib/mysql goes in its own volume). Secondly, you should determine a strategy for upgrades; state-of-the-art would be to create versioned images for each set of apt packages upgrade and have them tested ...


11

Starting the process inside a network namespace that can only see the desired IP address can accomplish something similar. For instance, supposed I only wanted localhost available to a particular program. First, I create the network namespace: ip netns add limitednet Namespaces have a loopback interface by default, so next I just need to bring it up: ...


11

This is pretty much right—though you're missing a line like this: lxc.network.ipv4.gateway = X.X.X.X I have an LXC guest running on Debian. First, you set up the host bridge (the easy way), in /etc/network/interfaces: auto wan iface wan inet static address 72.X.X.X netmask 255.255.255.0 gateway 72.X.X.1 bridge_ports ...


10

To create the directory automatically in the container, you can also add the create=dir option in the fstab : /mnt/ssd/solr_data /var/lib/lxc/Solr4StandAlone/rootfs/data none bind,create=dir Edit : this is specific to LXC. See this thread Just like we already had "optional", this adds two new LXC-specific mount flags: create=dir ...


10

Have you tried lxc-attach instead? According the documentation, lxc-attach - start a process inside a running container. Example to list all folders inside home of the container lxc-attach -n myContainer -- ls -lh /home If no process is defined, it creates a new shell inside the container.


9

I had to create the /data folder in the local container before the mount would work properly. I also used this fstab entry: /mnt/ssd/solr_data /var/lib/lxc/Solr4StandAlone/rootfs/data none bind 0 0


9

No, LXC, Docker, and LXD, are not quite the same. In short: LXC LinuX Containers (LXC) is an operating system-level virtualization method for running multiple isolated Linux systems (containers) on a single control host (LXC host) https://wiki.archlinux.org/index.php/Linux_Containers low level ... https://linuxcontainers.org/ Docker by ...


9

Running unprivileged containers is the safest way to run containers in a production environment. Containers get bad publicity when it comes to security and one of the reasons is because some users have found that if a user gets root in a container then there is a possibility of gaining root on the host as well. Basically what an unprivileged container does ...


8

The traditional answer is to run the program as another user and use iptables -m owner. That way, the network configuration is shared. However, with the advent of namespaces, there is an easier way. With namespaces, you unshare the network, then create a virtual network link if you need limited network access. To share unix domain sockets, all you need is ...


8

You may want to try xpra or NX, VNC, etc Also take a look at VirtualGL if you want GL acceleration. If you can share a directory with the host, you could then use mmap with xpra (would probably require a trivial path change unless it is /tmp/) which provides very significant performance improvements.


7

For future readers, I wrote this email to some colleagues of mine who are working with me on configuring LXC and figuring out the bridging. Well, I spent most of the day today fussing with networking in LXC, and now things are a lot clearer, so I thought I’d pass on what I learned. First is a couple of definitions so we know what we’re looking at (I ...


7

LXC is a little bit better because it can run containers as unpriveleged users. This is possible with systemd-nspawn, but only for scenarios where you only need one user (instead of multiple), which can be difficult or less secure for multi process in container scenarios. If you want to know why docker, lxc, and systemd-nspawn are inherently not a solid ...


7

A better and safer solution is to install cgmanager and run it with systemctl start cgmanager (on a systemd-based distro). You can than have your root user, or if you have sudo rights on the host create cgroups for your unprivileged user in all controllers with: sudo cgm create all $USER sudo cgm chown all $USER $(id -u $USER) $(id -g $USER) Once they ...


7

First, cgroups are not used to isolate an application from others on a system. They are used to manage resource usage and device access. It's the various namespaces (PID, UTS, mount, user...) that provide some (limited) isolation. Moreover, a process launched inside a Docker container will probably not be able to manage the AppArmor profile it is running ...


7

You can run older Linux programs on newer kernels. Linux maintains backward compatibility (at least for all documented interfaces), for the benefit of people who are running old binaries for one reason or another (because they don't want to bother recompiling, because they've lost the source, because this is commercial software for which they don't have the ...


6

Turns out, surprise surprise, this is a Ubuntu-specific thing. The cause The problem: although the kernel has cgroups enabled (check with grep CGROUP /boot/config-$(uname -r)) and cgmanager is running, there is no cgroup specific to my user. You can check that with: $ cat /proc/self/cgroup 11:hugetlb:/ 10:perf_event:/ 9:blkio:/ 8:freezer:/ 7:devices:/ ...


6

At some point over the past couple of months, the upstart script in the tutorial was changed to remove the loop to wait for docker to start. I removed the loop from my upstart scripts and my containers now restart correctly after a reboot. My /etc/init/service-name.conf script now looks like this: description "service description" ...


6

With Docker you can do this very easily. docker pull ubuntu docker run -t -i ubuntu /bin/bash # make your changes and then log out docker commit $(docker ps -a -q | head -n 1) sandbox cat > /usr/local/bin/sandbox <<EOF #!/bin/sh exec docker run -t -i --rm=true sandbox /bin/bash EOF chmod a+x /usr/local/bin/sandbox echo /usr/local/bin/sandbox ...


5

I was just doing something very similar, moving KVM VMs into unprivileged LXC. I was using system containers for this (so they can be started automatically on boot), but with mapped UID/GIDs (user namespaces). edit /etc/subuid,subgid (I mapped uid/gids 10M-100M to root and use 100K per container) for first container, use u/gids 10000000-10099999 in ...


5

A Virtual Machine (VM) is quite a generic term for many virtualisation technologies. There are a many variations on virtualisation technologies, but the main ones are: Hardware Level Virtualisation Operating System Level Virtualisation qemu-kvm and VMWare are examples of the first. They employ a hypervisor to manage the virtual environments in which ...


5

Debootstrap is in aur/debootstrap package. After installation process you will have to make a symlink in /usr/bin: cd /usr/bin ; ln -sf debootstrap qemu-debootstrap After that do what ouzmoutous suggests. Anyway I always advise to use downloaded templates. HTH


5

On your LXC host (I'm assuming Ubuntu here): Install the virtualbox-dkms, linux-headers-generic, build-essential packages and check the kernel modules are loaded: myhost$ sudo /etc/init.d/virtualbox status VirtualBox kernel modules are loaded. Get the VirtualBox device numbers (10, 55/56/57 in my case): myhost$ ls -la /dev | grep vbox crw------- 1 root ...


5

You didn't write why you choose LXC as it's not the most secure virtualization solution. I'm heavy user of KVM/XEN and also LXC and I can say this one thing that when it comes to security I never go with Linux containers (no matter if LXC / OpenVZ / VServer). It's just easier (and more reliable) with KVM/XEN. If it's about performance or hardware ...


5

In /var/lib/lxc/Solr4StandAlone/config add a line reading: lxc.mount.entry = /mnt/ssd/solr_data /var/lib/lxc/webserver/Solr4StandAlone/rootfs/data none bind 0 0 Then lxc-stop stop your container and lxc-start your container again. That is all that is needed. ref: reference link


4

I haven't gotten fully into LXC, but i have setup multiple containers with there own static ip's in lan which provide internet services for some of my websites... Maybe this can help, on what you want for yours. I run multiple containers, like so, ON HOST MACHINE I Edited The Host's File, Adding Each Container & Host Machine: vi /etc/hosts lxc ...


4

Normally, chroot is about "limiting privileges", not granting users their own IF to play with... But in any case: if you feel like doing some work, you may start your chroot environment within a new network namespace. You find an introduction here. Then the last command, the one that places you into the new network namespace, which in the guide above is ...



Only top voted, non community-wiki answers of a minimum length are eligible