Tag Info

Hot answers tagged

7

The traditional answer is to run the program as another user and use iptables -m owner. That way, the network configuration is shared. However, with the advent of namespaces, there is an easier way. With namespaces, you unshare the network, then create a virtual network link if you need limited network access. To share unix domain sockets, all you need is ...


5

To create the directory automatically in the container, you can also add the create=dir option in the fstab : /mnt/ssd/solr_data /var/lib/lxc/Solr4StandAlone/rootfs/data none bind,create=dir Edit : this is specific to LXC. See this thread Just like we already had "optional", this adds two new LXC-specific mount flags: create=dir ...


5

I had to create the /data folder in the local container before the mount would work properly. I also used this fstab entry: /mnt/ssd/solr_data /var/lib/lxc/Solr4StandAlone/rootfs/data none bind 0 0


4

This is pretty much right—though you're missing a line like this: lxc.network.ipv4.gateway = X.X.X.X I have an LXC guest running on Debian. First, you set up the host bridge (the easy way), in /etc/network/interfaces: auto wan iface wan inet static address 72.X.X.X netmask 255.255.255.0 gateway 72.X.X.1 bridge_ports ...


4

You may want to try xpra or NX, VNC, etc Also take a look at VirtualGL if you want GL acceleration. If you can share a directory with the host, you could then use mmap with xpra (would probably require a trivial path change unless it is /tmp/) which provides very significant performance improvements.


4

You didn't write why you choose LXC as it's not the most secure virtualization solution. I'm heavy user of KVM/XEN and also LXC and I can say this one thing that when it comes to security I never go with Linux containers (no matter if LXC / OpenVZ / VServer). It's just easier (and more reliable) with KVM/XEN. If it's about performance or hardware ...


4

You can run older Linux programs on newer kernels. Linux maintains backward compatibility (at least for all documented interfaces), for the benefit of people who are running old binaries for one reason or another (because they don't want to bother recompiling, because they've lost the source, because this is commercial software for which they don't have the ...


3

If you look at the LXC homepage, you'll notice liblxc referred to, implying there's an ABI, and if you look further down, you'll notice a link to the C API documentation. That page looks empty at first because it has been done (rather lazily, I think) with doxygen. However, if you start clicking around you'll find stuff. Just keep in mind, again, that ...


3

From ip man page for network name space ip netns - process network namespace management A network namespace is logically another copy of the network stack, with it's own routes, firewall rules, and network devices. By convention a named network namespace is an object at /var/run/netns/NAME that can be opened. The ...


3

Give this Howto a look. It's a little dated but should have the general steps you need to setup a Git server. The howto is titled: How To Install A Public Git Repository On A Debian Server. General steps Install git + gitweb $ sudo apt-get install git-core gitweb Setup gitweb directories $ sudo mkdir /var/www/git $ [ -d "/var/cache/git" ] || sudo mkdir ...


3

It should work, as long the interface is still up ifconfig eth0 | grep UP UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 the bridge is a "switch" and it doesn't need to have one IP. But please check if you have firewall rules in eth0: iptables -l -vnx if rp_filter is off cat /proc/sys/net/ipv4/conf/eth1/rp_filter 0 and if all fails, try ...


3

TL;DR: If you don't build it in yourself, it's not going to happen. The effective way to do this is to simply write a custom start script for your container specified by CMD in your Dockerfile. In this file, run an apt-get update && apt-get upgrade -qqy before starting whatever you're running. You then have a couple way of ensuring updates get to ...


3

With Docker you can do this very easily. docker pull ubuntu docker run -t -i ubuntu /bin/bash # make your changes and then log out docker commit $(docker ps -a -q | head -n 1) sandbox cat > /usr/local/bin/sandbox <<EOF #!/bin/sh exec docker run -t -i --rm=true sandbox /bin/bash EOF chmod a+x /usr/local/bin/sandbox echo /usr/local/bin/sandbox ...


2

A big thanks to Red Hat, I finally tracked down the reference documentation I was looking for in their documentation. I expect that there's no difference between Red Hat and other distros on this point. https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Resource_Management_Guide/ch-Subsystems_and_Tunable_Parameters.html


2

cgroups is still quite in flux in the Linux kernel. Probably the best documentation is LWN's coverage, perhaps H-online or Kernelnewbies have something to say. Currently systemd is the most prolific user.


2

I haven't gotten fully into LXC, but i have setup multiple containers with there own static ip's in lan which provide internet services for some of my websites... Maybe this can help, on what you want for yours. I run multiple containers, like so, ON HOST MACHINE I Edited The Host's File, Adding Each Container & Host Machine: vi /etc/hosts lxc ...


2

For future readers, I wrote this email to some colleagues of mine who are working with me on configuring LXC and figuring out the bridging. Well, I spent most of the day today fussing with networking in LXC, and now things are a lot clearer, so I thought I’d pass on what I learned. First is a couple of definitions so we know what we’re looking at (I ...


2

The command is systemctl to control the services under systemd to disable the service from running next time: systemctl disable udevd.service to stop the service currently running : systemctl stop udevd.service Go through these doc links from the author of systemd http://0pointer.de/blog/projects/systemd.html ...


2

Firejail is a Linux namespaces sandbox program that can jail Firefox or any other GUI software. It should work on any Linux computer.


2

What desktop manager you are running does not matter; all that matters is that you provide the container with access to the Xwindows socket, the XAUTHORITY environment variable, and the file it points to.


2

You can't use a bridge interface to forward traffic between subnets. Bridges are meant for joining two layer 2 networks, not 2 subnets (which are layer 3). You have to route traffic between the networks instead. Well, technically you could bridge them, but it requires you to add a routing rule to every single host on both subnets letting them know that they ...


2

Have you tried lxc-attach instead? According the documentation, lxc-attach - start a process inside a running container. Example to list all folders inside home of the container lxc-attach -n myContainer -- ls -lh /home If no process is defined, it creates a new shell inside the container.


2

Best Disk I/O: LXC > KVM > UML. No overhead to speak of with LXC, KVM adds a layer of indirection so it will be slower (but you could also use it with raw disks), UML will be much slower. Least CPU overhead: LXC > KVM > UML. No overhead to speak of with LXC, small overhead with KVM, bigger overhead with UML. Strict separation and security: UML > KVM > LXC. ...


2

At some point over the past couple of months, the upstart script in the tutorial was changed to remove the loop to wait for docker to start. I removed the loop from my upstart scripts and my containers now restart correctly after a reboot. My /etc/init/service-name.conf script now looks like this: description "service description" ...


2

Okay, your main problem doesn't appear to be the way you execute this. That's relatively easy with ForceCommand inside a Match block of sshd_config. In order to do what you want to achieve, i.e. a throw-away container that "self-destructs" after use, you can use lxc-start-ephemeral. That's to say your use-case has already been considered in the set of LXC ...


2

Evidently, Phusion packages their own Ubuntu 12.04 Vagrant boxes which run the required 3.8 kernel to make it easier to use Docker. They also provide the memory and swap accounting kernel init parameters to make these features available to LXC. To use these boxes, simply update the box name and URL in your Vagrantfile: # ... ...


2

No matter the fancy name used here, both are solutions to a specific problem: A better segregation solution than classic Unix chroot. Operating system-level virtualization, containers, zones, or even "chroot with steriods" are names or commercial titles that defines the same concept of userspace separation, but with different features. Chroot was introduced ...


2

The answer is very likely: no. The Ubuntu Server guide topic LXC discusses pretty much your exact question and makes the following statement: Programs in a container cannot be further confined - for instance, MySQL runs under the container profile (protecting the host) but will not be able to enter the MySQL profile (to protect the container). A ...


2

There are different ways to achieve your goal. If the guests share a virtual network (i.e. are not just bridged to the physical interface) it's easy. Just tell your services to listen on that interface - or create a new guest and let that one host the service. If the guests are bridged to ethX, you might still want to consider creating a virtual ...


2

Looking at the code for /proc/loadavg - yes, it's the same. The load average is read out from global variables. seq_printf(m, "%lu.%02lu %lu.%02lu %lu.%02lu %ld/%d %d\n", LOAD_INT(avnrun[0]), LOAD_FRAC(avnrun[0]), LOAD_INT(avnrun[1]), LOAD_FRAC(avnrun[1]), LOAD_INT(avnrun[2]), LOAD_FRAC(avnrun[2]), ...



Only top voted, non community-wiki answers of a minimum length are eligible