Linux-VServer - User contributions [en]

Installation on Debian

2011-04-19T01:06:51Z

Daniel15: Add information about Debian deprecating Linux-vserver kernels

'''Note:''' Debian 6.0 is the final version to include precompiled Linux-Vserver kernels. In newer versions (including Debian Testing), you'll have to compile the kernel yourself or [http://linux-vserver.org/Frequently_Asked_Questions#Were_can_I_get_newer_versions_of_VServer_as_ready_made_packages_for_Debian.3F use a pre-packaged kernel]. [http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=574529]

This guide is written against Debian Etch (4.0) and works on Lenny (5.0) as well. Both releases include kernel '''linux-image-vserver-686''', so no manual patching is needed. Hence, Installation on Debian Etch/Lenny is pretty easy and straightforward.

If you need to compile your own kernel, you need to apply the vserver-version.patch. [http://www.kwu.hu/vserver.txt Details at 2007/May/04]

In lenny and etch the tools are for the 2.2 version of vservers, you can find on beng repository packages for the 2.3 version of util-vserver until it is integrated in debian. See
* [[util-vserver:Devdebianpackage]] - Info about debian v2.3 package from the community
* explanation on how to use this repository from: http://kernels.bristolwireless.net/ How to use the Debian Repository

== Packages installation ==
The packages required by Linux-VServer are:
* '''linux-image-vserver-686''' - This is the current kernel, use '''linux-image-vserver-amd64''' on 64-bit systems, you can still create 32-bit guests
* '''util-vserver''' - These are the utilities used to administer the guests
* '''ssh''' - This is probably already installed, but just in case it isn't

All the packages you need can be obtained via
<pre>aptitude install linux-image-vserver-686 util-vserver ssh</pre>
so run this as ''root'' and reboot.
To check out wherever everything went fine you may run
<pre>uname -r</pre>
and check that kernel version contains '''vserver''', e.g. '''2.6.18-4-vserver-686'''. That's it.

Now that the host system is ready, you can proceed with [[Building Guest Systems|building guests]].

=== Install util-vserver by source ===
Occasionally, Debian's util-vserver package can be too old. So, we'll need to compile from [http://people.linux-vserver.org/~dhozac/t/uv-testing/ source].

First, install the required packages for util-vserver to compile.
<pre>apt-get install vlan dietlibc-dev pkg-config libnss3-dev</pre>

Then, we configure util-vserver
<pre>./configure --prefix=/usr --enable-release --mandir=/usr/share/man \
--infodir=/usr/share/info --sysconfdir=/etc --enable-dietlibc \
--localstatedir=/var --with-vrootdir=/home</pre>
Note: You should change ''--with-vrootdir'' accordingly

Finally, we run make to finalise the installation
<pre>make && make install install-distribution</pre>

Running ''vserver-info'' will show you that the proper util-vserver is installed. :)

Debian likes to be funny, so we need to enable the following,
* echo /usr/lib/util-vserver/vshelper >| /proc/sys/kernel/vshelper
* echo kernel.vshelper = /usr/lib/util-vserver/vshelper >> /etc/sysctl.conf
* update-rc.d vprocunhide defaults
* update-rc.d vservers-default defaults

== Versions ==

Debian already contains vservers kernels, so no manual patching and compiling is needed.

{|class="wikitablenowrap"
!Debian release
!Kernel version
!VServer version
|-
| Squeeze
| 2.6.32
| 2.3.0.36.29.6
|-
| Lenny
| 2.6.26+17
| 2.3.0.35
|-
| Etch
| 2.6.18+6
| 2.0.2.2-rc9

|-
|}

The Vserver versions given above are not completely pure, they have additional patches to fix various issues.

Information on alternative Debian repositories with more functional packages is [[Frequently_Asked_Questions#Were_can_I_get_newer_versions_of_VServer_as_ready_made_packages_for_Debian.3F | contained in this section of the FAQ]].

== Issues with Squeeze's 2.6.32 Kernel and Util-vserver ==

None recorded so far.

== Issues with Lenny's 2.6.26 Kernel and Util-vserver ==

=== Hard CPU scheduling ===

This will not work in the Debian 'Lenny' Kernel, the patch used simply does not contain any of this functionality.

=== Problems due to Xattrs ===

There are two sets of issues within the Lenny kernel caused by the change in value of the Xattrs (extended attributes) applied to file in Vserver setups. The patch used in Debian Lenny uses Xattr flags which are set in positions which differ from the flags set by Debian kernels as well as most of the mainline Vserver patches. This result is that Xattrs of files in a non lenny system appear to have completely different flags in Lenny and vice versa. Since these flags are crucial to vserver hashification and chroot security, they can have devastating effects on Vserver guests and on host system security. If you have recently moved to or away from the stock Lenny Vserver kernel, have look at the symptoms below to see if any match your experiences, and apply the fixes/use another kernel as you see fit.

As of writing these issue has not been corrected within the Debian archive. These fixes must be applied whenever moving vserver guest '''from''' or '''to''' the Debian 'Lenny's vserver kernel. For more details and a more concise explanation see [http://irc.13thfloor.at/LOG/2009-05/LOG_2009-05-12.txt Bertls IRC explanation ].

==== Chroot Security Problems ====

Linux-Vserver uses file Xattrs to protect guest superusers from being able to view files above their root, preventing access to host file. This creates issues for anyone who:

* has created a guest with a Debian 2.6.26-*-vserver kernel and wishes to use it with another kernel.
* has created a guest with a different kernel and wishes to use it on a Debian 2.6.26-*-vserver kernel based host.

In effect, the barrier normally in place for guest servers is not recognised by the kernel (the chroot problem) in the situation above and/or immutable links will not function correctly (the unification problem)failing to break when overwritten) in a unified guest setup. Symptoms suffered may include:

* the possibility of vserver guest processes escaping their chroots and accessing other parts of the filesystem
* guest not starting

To fix the barrier flags for a current kernel, see [[Secure_chroot_Barrier#Solution:_Secure_Barrier | these instructions]]. Note that on some setups a barrier flags will appear on all directories under the guest hierarchy, and need to be unset in order to allow the servers to run. Use showattr to reveal the state of play for your guests and fix appropriately.

==== Unification Problems ====

There is a discrepancy between the immutable-unlink flag used for file unification, the process used in vhashify. This creates considerable issues for anyone who:

* has unified guests with a Debian 2.6.26-*-vserver kernel and wishes to use them with another kernel.
* has unified guests with a different kernel and wishes to then it on a Debian 2.6.26-*-vserver kernel based host.

Symptoms suffered may include:

* file that cannot be deleted
* any process involving the writing of files in guests not working
* files not being unlinked on write

To fix the problem each file must be unlinked then the unification re-applied, or one could try this script submitted to [http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508523 bugs.debian.org].

=== /proc/mounts issue ===

The vserver's /proc/mounts let appear the vserver path on the host. lsof (for example) is able to print it.

=== "Ghosts" guests ===

==== Issue ====
Sometimes a guests loose it's name in vserver-stats and is acting like a zombie. It's impossible to restart or kill it. Stopping all the guests with the util-vserver init.d script doesn't solve the issue. vkill --xid $CTX doesn't either.

==== Fix ====
echo 50 > /var/run/vservers/$vserver

Seems to fix the issue

== References ==
* Linux-VServer HOWTO by Daniel15: http://howtoforge.com/linux_vserver_debian_etch

Installation on Debian

2011-04-19T01:02:12Z

Daniel15:

'''Note:''' Debian 6.0 is the final version to include precompiled Linux-Vserver kernels. In newer versions (including Debian Testing), you'll have to compile the kernel yourself. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=574529

This guide is written against Debian Etch (4.0) and works on Lenny (5.0) as well. Both releases include kernel '''linux-image-vserver-686''', so no manual patching is needed. Hence, Installation on Debian Etch/Lenny is pretty easy and straightforward.

If you need to compile your own kernel, you need to apply the vserver-version.patch. [http://www.kwu.hu/vserver.txt Details at 2007/May/04]

In lenny and etch the tools are for the 2.2 version of vservers, you can find on beng repository packages for the 2.3 version of util-vserver until it is integrated in debian. See
* [[util-vserver:Devdebianpackage]] - Info about debian v2.3 package from the community
* explanation on how to use this repository from: http://kernels.bristolwireless.net/ How to use the Debian Repository

== Packages installation ==
The packages required by Linux-VServer are:
* '''linux-image-vserver-686''' - This is the current kernel, use '''linux-image-vserver-amd64''' on 64-bit systems, you can still create 32-bit guests
* '''util-vserver''' - These are the utilities used to administer the guests
* '''ssh''' - This is probably already installed, but just in case it isn't

All the packages you need can be obtained via
<pre>aptitude install linux-image-vserver-686 util-vserver ssh</pre>
so run this as ''root'' and reboot.
To check out wherever everything went fine you may run
<pre>uname -r</pre>
and check that kernel version contains '''vserver''', e.g. '''2.6.18-4-vserver-686'''. That's it.

Now that the host system is ready, you can proceed with [[Building Guest Systems|building guests]].

=== Install util-vserver by source ===
Occasionally, Debian's util-vserver package can be too old. So, we'll need to compile from [http://people.linux-vserver.org/~dhozac/t/uv-testing/ source].

First, install the required packages for util-vserver to compile.
<pre>apt-get install vlan dietlibc-dev pkg-config libnss3-dev</pre>

Then, we configure util-vserver
<pre>./configure --prefix=/usr --enable-release --mandir=/usr/share/man \
--infodir=/usr/share/info --sysconfdir=/etc --enable-dietlibc \
--localstatedir=/var --with-vrootdir=/home</pre>
Note: You should change ''--with-vrootdir'' accordingly

Finally, we run make to finalise the installation
<pre>make && make install install-distribution</pre>

Running ''vserver-info'' will show you that the proper util-vserver is installed. :)

Debian likes to be funny, so we need to enable the following,
* echo /usr/lib/util-vserver/vshelper >| /proc/sys/kernel/vshelper
* echo kernel.vshelper = /usr/lib/util-vserver/vshelper >> /etc/sysctl.conf
* update-rc.d vprocunhide defaults
* update-rc.d vservers-default defaults

== Versions ==

Debian already contains vservers kernels, so no manual patching and compiling is needed.

{|class="wikitablenowrap"
!Debian release
!Kernel version
!VServer version
|-
| Squeeze
| 2.6.32
| 2.3.0.36.29.6
|-
| Lenny
| 2.6.26+17
| 2.3.0.35
|-
| Etch
| 2.6.18+6
| 2.0.2.2-rc9

|-
|}

The Vserver versions given above are not completely pure, they have additional patches to fix various issues.

Information on alternative Debian repositories with more functional packages is [[Frequently_Asked_Questions#Were_can_I_get_newer_versions_of_VServer_as_ready_made_packages_for_Debian.3F | contained in this section of the FAQ]].

== Issues with Squeeze's 2.6.32 Kernel and Util-vserver ==

None recorded so far.

== Issues with Lenny's 2.6.26 Kernel and Util-vserver ==

=== Hard CPU scheduling ===

This will not work in the Debian 'Lenny' Kernel, the patch used simply does not contain any of this functionality.

=== Problems due to Xattrs ===

There are two sets of issues within the Lenny kernel caused by the change in value of the Xattrs (extended attributes) applied to file in Vserver setups. The patch used in Debian Lenny uses Xattr flags which are set in positions which differ from the flags set by Debian kernels as well as most of the mainline Vserver patches. This result is that Xattrs of files in a non lenny system appear to have completely different flags in Lenny and vice versa. Since these flags are crucial to vserver hashification and chroot security, they can have devastating effects on Vserver guests and on host system security. If you have recently moved to or away from the stock Lenny Vserver kernel, have look at the symptoms below to see if any match your experiences, and apply the fixes/use another kernel as you see fit.

As of writing these issue has not been corrected within the Debian archive. These fixes must be applied whenever moving vserver guest '''from''' or '''to''' the Debian 'Lenny's vserver kernel. For more details and a more concise explanation see [http://irc.13thfloor.at/LOG/2009-05/LOG_2009-05-12.txt Bertls IRC explanation ].

==== Chroot Security Problems ====

Linux-Vserver uses file Xattrs to protect guest superusers from being able to view files above their root, preventing access to host file. This creates issues for anyone who:

* has created a guest with a Debian 2.6.26-*-vserver kernel and wishes to use it with another kernel.
* has created a guest with a different kernel and wishes to use it on a Debian 2.6.26-*-vserver kernel based host.

In effect, the barrier normally in place for guest servers is not recognised by the kernel (the chroot problem) in the situation above and/or immutable links will not function correctly (the unification problem)failing to break when overwritten) in a unified guest setup. Symptoms suffered may include:

* the possibility of vserver guest processes escaping their chroots and accessing other parts of the filesystem
* guest not starting

To fix the barrier flags for a current kernel, see [[Secure_chroot_Barrier#Solution:_Secure_Barrier | these instructions]]. Note that on some setups a barrier flags will appear on all directories under the guest hierarchy, and need to be unset in order to allow the servers to run. Use showattr to reveal the state of play for your guests and fix appropriately.

==== Unification Problems ====

There is a discrepancy between the immutable-unlink flag used for file unification, the process used in vhashify. This creates considerable issues for anyone who:

* has unified guests with a Debian 2.6.26-*-vserver kernel and wishes to use them with another kernel.
* has unified guests with a different kernel and wishes to then it on a Debian 2.6.26-*-vserver kernel based host.

Symptoms suffered may include:

* file that cannot be deleted
* any process involving the writing of files in guests not working
* files not being unlinked on write

To fix the problem each file must be unlinked then the unification re-applied, or one could try this script submitted to [http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508523 bugs.debian.org].

=== /proc/mounts issue ===

The vserver's /proc/mounts let appear the vserver path on the host. lsof (for example) is able to print it.

=== "Ghosts" guests ===

==== Issue ====
Sometimes a guests loose it's name in vserver-stats and is acting like a zombie. It's impossible to restart or kill it. Stopping all the guests with the util-vserver init.d script doesn't solve the issue. vkill --xid $CTX doesn't either.

==== Fix ====
echo 50 > /var/run/vservers/$vserver

Seems to fix the issue

== References ==
* Linux-VServer HOWTO by Daniel15: http://howtoforge.com/linux_vserver_debian_etch

Talk:HowTo Read ProcFS

2009-04-04T07:43:01Z

Daniel15: New page: Isn't this redundant? I think all the information is in the ProcFS page already. —~~~~

Isn't this redundant? I think all the information is in the [[ProcFS]] page already. —[[User:Daniel15|Daniel15]] <big>(</big>[[User talk:Daniel15|Talk]]/[[Special:Contributions/Daniel15|Contribs]]<big>)</big> 09:43, 4 April 2009 (CEST)

HowTo Read ProcFS

2009-04-04T07:42:05Z

Daniel15: Updated, added "nsproxy"

==Information in /proc/virtual==
/proc/virtual
.../info

/proc/virtual/<pid>
.../info
.../status
.../sched
.../cvirt
.../cacct
.../limit

===/proc/virtual/info===
===/proc/virtual/<xid>===
This directory contains several files which can provide valuable information on the current context state and settings.
==== /proc/virtual/<xid>/info ====
ID: 1001
Info: 83c37000
Init: 0

this shows the context id, vx_info location and init pid
==== /proc/virtual/<xid>/status ====
UseCnt: 38
Tasks: 16
Flags: 0000000000000000
BCaps: 00000000d46c04ff
CCaps: 0000000000000000
Ticks: 0

this contains the usage count (references) and task count, as well as the context flags, capability boundary and context capabilities
==== /proc/virtual/<xid>/sched ====
Token: 0
FillRate: 1
Interval: 4
TokensMin: 6
TokensMax: 50
PrioBias: 0
VaVaVoom: 0
cpu 0: 0 0 0
shows the current amount of tokens, scheduler parameters (fill rate, interval, min/max), the priority bias and the calculated vavavoom (priority bonus)

==== /proc/virtual/<xid>/cacct ====
UNSPEC: 0/0 0/0 0/0
UNIX: 35/2375 35/2375 0/0
INET: 12/531 56/1937 57/1705
INET6: 0/0 0/0 0/0
OTHER: 0/0 0/0 0/0
forks: 0

this accounts socket messages for the listed protocols, as incoming messages/bytes and outgoing messages/bytes

====/proc/virtual/<xid>/cvirt ====
BiasUptime: 16.87
nr_threads: 119
nr_running: 0
nr_unintr: 0
nr_onhold: 0
load_updates: 383736593
loadavg: 0.00 0.02 0.02
total_forks: 3763748

this contains the uptime bias, the number of threads, thread stats (running, uninterruptible, on hold), the number of load updates, the load averages (1,5,15) and the number of forks

==== /proc/virtual/<xid>/nsproxy ====
NSProxy: f7d7a4f0 [f7c91280,f783e200,f7824dc0]
Namespace: f7c91280 [#3]
RootPath: /
SysName: Linux
NodeName: XXXX.test.org
Release: 2.6.26-1-vserver-686
Version: #1 SMP Sat Jan 10 21:26:14 UTC 2009
Machine: i686
DomainName: (none)
SEMS: 250 32000 32 128 123
MSG: 8192 16384 145
SHM: 33554432 2097152 4096 2556

This contains the utsname settings (sys, node, rel, vers, machine, domain)

==== /proc/virtual/<xid>/limit ====
PROC: 16 17 -1 0
VM: 14440 15331 -1 0
VML: 0 0 -1 0
RSS: 5478 5847 -1 0
ANON: 1516 1516 -1 0
FILES: 140 155 -1 0
OFD: 122 122 -1 0
LOCKS: 1 3 -1 0
SOCK: 9 9 -1 0
MSGQ: 0 0 -1 0
SHM: 0 0 -1 0

limit columns are:
# current
# max observed
# limit
# number of hits

limit rows are:
*processes,
*virtual memory,
*locked memory,
*resident set size,
*anonymous memory,
*number of files,
*filedescriptors,
*locks,
*sockets,
*message queues,
*shared memory

==Debug settings in /proc/sys/vserver==
/proc/sys/vserver
.../debug_switch
.../debug_xid
.../debug_cvirt
.../debug_limit
.../debug_dlim
.../debug_nid
.../debug_net

===/proc/sys/vserver/debug_switch===
===/proc/sys/vserver/debug_xid===
===/proc/sys/vserver/debug_cvirt===
===/proc/sys/vserver/debug_limit===
===/proc/sys/vserver/debug_dlim===
===/proc/sys/vserver/debug_nid===
===/proc/sys/vserver/debug_net===

[[Category:ProcFS]]

Downloads

2008-06-15T11:59:09Z

Daniel15: Protected "Downloads": Protected due to spamming [edit=autoconfirmed:move=autoconfirmed]

{{NeedCompletion}}

== Kernel Patches ==

The Linux- VServer project maintains several branches of the kernel patch. Since version 1.00 the versioning is similar to the kernel versioning scheme. Even numbered releases (a.X.z with even X) are stable, reasonably well tested and expected not to change feature-wise. Odd numbered (a.Y.z with odd Y) releases are development releases. The last digit/number (z) is a subversion identifier. Experimental versions and Release Candidates might add a fourth identifier to that scheme.

Basically the stable and development releases should be similar in functionality, but the development releases will include features and enhancements not present in the stable branch. Once those features mature (and get well tested), they will be incorporated by the stable branch.

For example the first stable release (1.00) uses two systemcalls as the previous releases did. However, the vserver system calls have been changed in the first development release (1.1.0). Linus assigned the vserver project a single system call, so a [[System Call Switch]] has been implemented. Running a development release usually requires using recent (latest) tools from the util-vserver development branch.

1.X.z and 1.Y.z releases are for the 2.4 kernels, while 1.9.x (obsoleted by now) and 2.X.y releases are for the 2.6 series.

{{CurrentPatchTableMatrix}}

All (previous) downloads are available in the [[Archives]]. Also take a look at the [[ChangeLogs]].

For an overview of available Features in each version take a look at [[Feature Matrix]]

Precompiled kernel packages are available for [http://packages.debian.org/search?keywords=linux+image+vserver+&searchon=names&suite=all&section=all debian]

== Userspace Utilities ==

In order to administrate your virtual private servers you need a set of userspace utilities. The following gives an overview of possible choices. For detailed instructions visit the respective project pages.

=== util-vserver ===

Created by Enrico Scholz util-vserver is the current "official" userspace implementation. Many distributions have added binary packages for util-vserver to their repositories.

{| class="wikitable" style="width: 60%;"
| The current version of util-vserver is:
| style="width: 20%;" | [http://ftp.linux-vserver.org/pub/utils/util-vserver/util-vserver-0.30.215.tar.bz2 0.30.215]
|}

* [https://savannah.nongnu.org/projects/util-vserver/ util-vserver project homepage]

=== VServer Control Daemon ===

Being still in development the VServer Control Daemon is another approach for virtual private server management. The concept is based on a client/server architecture using XMLRPC. Currently there are no releases, i.e. source code has to be obtained from SVN.

{| class="wikitable" style="width: 60%;"
| The current version of the VServer Control Daemon is:
| style="width: 20%;" | [http://svn.linux-vserver.org/svn/vcd SVN trunk]
|}

* [http://dev.croup.de/proj/vserver-utils/browser/trunk/doc/vcd.spec?format=raw VCD specification]

=== Testme.sh script ===

Useful for debugging linux-vserver problems.

* [http://vserver.13thfloor.at/Stuff/SCRIPT/testme.sh testme.sh]

=== Ancient vserver tools ===

Although not used much anymore the old tools by Jacques Gelinas are said to still work on current kernels.

{| class="wikitable" style="width: 60%;"
| The current version of the vserver tools is:
| style="width: 20%;" | [ftp://ftp.solucorp.qc.ca/pub/vserver/vserver-0.40.src.tar.gz 0.40]
|}

* [http://www.solucorp.qc.ca/miscprj/s_context.hc vserver tools project homepage]

== Guest images ==

Below is a list of third-party archives for VPS images

* http://mirrors.sandino.net/vserver/images/
* http://debian.marlow.dk/vserver/guest/
* http://lylix.net/vps+templates/func,select/id,1/
* http://distfiles.gentoo.org/experimental/x86/vserver/
* http://distfiles.gentoo.org/experimental/amd64/vserver/

== Chroot repositories ==

A collection of chroot trees suitable to bootstrap a vserver or to use with chroot

* http://packaging-farm.dachary.org/packaging-farm/ and rsync://packaging-farm.dachary.org/packaging-farm/

== 3rd-party applications ==

A collection of applications that support Linux-Vservers

* [http://munin.projects.linpro.no/ munin]: [http://muninexchange.projects.linpro.no/?search=&cid=32&os%5B4%5D=on&os%5B7%5D=on&os%5B3%5D=on&os%5B2%5D=on&os%5B5%5D=on&os%5B8%5D=on&os%5B1%5D=on&os%5B6%5D=on plugins]
* [http://dev.riseup.net/backupninja backupninja]
* [http://puppet.reductivelabs.com puppet]: [http://git.black.co.at/?p=manifests.git;a=shortlog;h=virtual virtual module]

Downloads

2008-06-14T12:00:15Z

Daniel15: rv spam

Talk:Overview

2007-12-24T09:52:33Z

Daniel15: Reverted edits by 216.129.105.10 (Talk); changed back to last version by Powerfox

== Emulation = Dynamic Recompilation??? ==

I'm no expert on this, but why in the world would this article claim that "dynamic compilation" is the same thing as "emulation"? I understand that dynamic compilation is sometimes used in an emulator, as opposed to a run-time interpreter, or a setup that pre-translates the text/data segments of a program before it's run, but the statement "The virtual machine simulates the complete hardware, allowing an unmodified OS for a completely different CPU to be run. This is also known as Dynamic Recompilation" is very misleading, especially for those new to virtualization. I'd suggest the second sentence be changed to "Emulators often use Dynamic Recompilation for efficiency purposes." - [[User:JustinWick|JustinWick]] 22:39, 3 January 2007 (CET)

Word.

Share a directory among multiple guests

2007-09-15T01:36:43Z

Daniel15: Added infoirmation on fstab.

How to share a directory, such as <code>/home</code>, among multiple vserver guests.
__TOC__
== Assumptions ==
Suppose you have multiple vserver guests at locations such as <code>/var/lib/vservers/<guest>/</code>.
You would like to share a directory, such as <code>/srv/common/home</code>, among multiple guests.
Each guest will be able to write to the directory.

== Command ==
The following command will mount this directory for all guests:
$ for guest in /var/lib/vservers/*; do mount --bind /srv/common/home ${guest}/home; done

== fstab ==
Alternatively, you may add an entry similar to the below one in <code>/etc/vservers/<guest>/fstab</code>:
/srv/common/home /home none bind 0 0

== See also ==
* <code>$ man mount</code>

Share a directory among multiple vserver guests

2007-09-15T01:33:47Z

Daniel15: Share a directory among multiple vserver guests moved to Share a directory among multiple guests: Having "vserver" in the page title is probably redundant.

#REDIRECT [[Share a directory among multiple guests]]

Share a directory among multiple guests

2007-09-15T01:33:47Z

Daniel15: Share a directory among multiple vserver guests moved to Share a directory among multiple guests: Having "vserver" in the page title is probably redundant.

Postfix local only problem

2007-08-24T03:33:24Z

Daniel15: Spelling and capitalisation fixes.

== Synopsis ==

When you are running multiples vservers on a same physical box, it may be useful to allow box daemons (like cron) to send mail for debugging purpose or just seeing if a problem occurs. Debian GNU/Linux provides a good way to configure packages like Postfix. You can use
# dpkg-reconfigure postfix
to start configuring (this script is also called when installing Postfix)

The problem is that, the local-only mode (which in this instance is the most useful) doesn't work 'out of the box' (Postfix starts without any messages, but doesn't appear in process list (ps)).

A few fixes are needed for Postfix to run properly:

== /etc/hosts additions ==
Add a line in /etc/hosts with:
nano /etc/hosts

ip.of.the.host nameofhost

You can also add:

ip.of.the.host localhost

(the "localhost" hostname is used by some other daemons and normally points to 127.0.0.1.)

== Modify postfix configuration ==

# nano /etc/postfix/main.cf

Replace
inet_interfaces = loopback-only
with
inet_interfaces = name_of_host_entered_in__etc_hosts
or
inet_interfaces = localhost

== Restart Postfix ==
Restart Postfix with
/etc/init.d/postfix restart
and check it run with "ps".

That's all folks ;)

Postfix local only problem

2007-08-24T03:31:53Z

Daniel15: Article cleanup :)

== Synopsys ==

When you are running multiples vservers on a same physical box, it may be useful to allow box daemons (like cron) to send mail for debugging purpose or just seeing if a problem occurs. Debian GNU/Linux provides a good way to configure packages like postfix. You can use
# dpkg-reconfigure postfix
to start configuring (this script is also called when installing postfix)

The problem is that, the local-only mode (which in this instance is the most useful) doesn't work 'out of the box' (Postfix starts without any messages, but doesn't appear in process list (ps)).

A few fixes are needed for Postfix to run properly:

== /etc/hosts additions ==
Add a line in /etc/hosts with:
nano /etc/hosts

ip.of.the.host nameofhost

You can also add:

ip.of.the.host localhost

(the "localhost" hostname is used by some other daemons and normally points to 127.0.0.1.)

== Modify postfix configuration ==

# nano /etc/postfix/main.cf

Replace
inet_interfaces = loopback-only
with
inet_interfaces = name_of_host_entered_in__etc_hosts
or
inet_interfaces = localhost

== Restart Postfix ==
Restart Postfix with
/etc/init.d/postfix restart
and check it run with "ps".

That's all folks ;)

Overview

2007-08-10T16:49:21Z

Daniel15: Reverted edits by 74.173.139.169 (Talk); changed back to last version by 91.18.202.93

Virtualization is a framework or methodology of dividing the resources of a computer into multiple execution environments. As a perceived "hot term", virtualization has been claimed by IT marketers to refer to everything from virtual machines to systems management software, so as to become nearly meaningless.

== Types of Virtualization ==

Some common applications of virtualization are listed below; this list reflects the extreme diversity that the term has come to encapsulate.

=== Emulation ===

A software emulator allows computer programs to run on a platform (computer architecture and/or operating system) other than the one for which they were originally written. Unlike simulation, which only attempts to reproduce a program's behavior, emulation attempts to model to various degrees the state of the device being emulated.
The virtual machine simulates the complete hardware, allowing an unmodified OS for a completely different CPU to be run. This is also known as ''Dynamic Recompilation''...

=== Paravirtualization ===

Paravirtualization is a virtualization technique that presents a software interface to virtual machines that is similar but not identical to that of the underlying hardware. This requires operating systems to be explicitly ported to run on top of the virtual machine monitor (VMM) but may enable the VMM itself to be simpler and for the virtual machines that run on it to achieve higher performance.

=== Native Virtualization ===

Native virtualization is a virtualization technique where the virtual machine monitor or hypervisor only partially simulates enough hardware to allow an unmodified Operating System to be run in isolation, but the guest Operating System must be designed for the same type of CPU.

=== Operating System-Level Virtualization ===

Operating System-level Virtualization is a server virtualization technology which virtualizes servers on a operating system (kernel) layer. It can be thought of as partitioning a single physical server into multiple small computational partitions. Each such partition looks and feels like a real server, from the point of view of its owner. On Unix systems, this technology can be thought of as an advanced extension of the standard chroot mechanism.

== The Linux-VServer approach ==

=== Abstract ===

The Linux-VServer technology is a soft partitioning concept based on ''Security Contexts'' which permits the creation of many independent ''Virtual Private Servers'' (VPS) that run simultaneously on a single physical server at full speed, efficiently sharing hardware resources.

A VPS provides an almost identical operating environment as a conventional Linux server. All services, such as ssh, mail, web and database servers can be started on such a VPS, without (or in special cases with only minimal) modification, just like on any real server.

Each VPS has its own user account database and root password and is isolated from other virtual servers, except for the fact that they share the same hardware resources.

=== Introduction ===

Over the years, computers have become sufficiently powerful to use virtualization to create the illusion of many smaller virtual machines, each running a separate operating system instance.

There are several kinds of ''Virtual Machines'' (VMs) which provide similar features, but differ in the degree of abstraction and the methods used for virtualization.

Most of them accomplish what they do by ''emulating'' some real or fictional hardware, which in turn requires ''real'' resources from the ''Host System'' (the machine running the VMs). This approach, used by most ''System Emulators'' (like [http://fabrice.bellard.free.fr/qemu/ QEMU] or [http://bochs.sourceforge.net/ Bochs]), allows the emulator to run an arbitrary ''Guest Operating System'', even for a different architecture (CPU and hardware). No modifications need to be made to the Guest OS because it isn't aware of the fact that it isn't running on real hardware.

Some System Emulators (including Paravirtualization) require small modifications or specialized drivers to be added to the Host or Guest system to improve performance and minimize the overhead required for the hardware emulation. Although this significantly improves efficiency, there are still large amounts of resources being wasted in caches and mediation between Guest and Host (examples for this approach are [http://user-mode-linux.sourceforge.net/ UML] and [http://www.cl.cam.ac.uk/research/srg/netos/xen/ Xen]).

But suppose you do not want to run many different Operating Systems simultaneously on a single box? Most applications running on a server do not require hardware access or kernel level code, and could easily share a machine with others, if they could be separated and secured...

=== Concept ===

At a basic level, a Linux server consists of three building blocks: hardware, kernel and applications. The hardware usually depends on the provider or system maintainer, and, while it has a big influence on the overall performance, it cannot be changed that easily, and will likely differ from one setup to another.

The main purpose of the kernel is to build an abstraction layer on top of the hardware to allow processes (applications) to work with and operate on resources (data) without knowing the details of the underlying hardware. Ideally, those processes would be completely hardware agnostic, by being written in an interpreted language and therefore not requiring any hardware-specific knowledge.

Given that a system has enough resources to drive ten times the number of applications a single Linux server would usually require, why not put ten servers on that box, which will then share the available resources in an efficient manner?

Most server applications (e.g. httpd) will assume that it is the only application providing a particular service, and usually will also assume a certain filesystem layout and environment. This dictates that similar or identical services running on the same physical server but differing only in their addresses (for example), must be coordinated. This typically requires a great deal of administrative work which can lead to reduced system stability and security.

The basic concept of the Linux-VServer solution is to separate the user-space environment into distinct units (Virtual Private Servers) in such a way that each VPS looks and feels like a real server to the processes contained within.

Although different Linux distributions use (sometimes heavily) patched kernels to provide special support for unusual hardware or extra functionality, most Linux distributions are not tied to a special kernel.

Linux-VServer uses this fact to allow several distributions, to be run simultaneously on a single, shared kernel, without direct access to the hardware, and share the resources in a very efficient way.

That said, you may have already figured out that Linux-VServer uses Operating System-level virtualization ;-)

== History ==

Jacques Gélinas created the VServer project a number of years back (see [http://www.solucorp.qc.ca/miscprj/s_context.hc Jack's Site]). He still does vserver development and the community can be glad to have him. He's a genius, without him, vserver would not exist. Three cheers for Jack.

But sometime during 2003 it became apparent that Jack didn't have the time to keep vserver development up to pace. So in November, Herbert Pötzl officially took charge of development. He now releases the vserver kernel patches, announcing them on the vserver mailing list and making them available for the public.

Additionally, Enrico Scholz decided to reimplement Jack's vserver tools in C. These are now distributed as util-vserver (See [[Downloads]]). They are backward compatible to Jack's tools as far as possible, but follow the kernel patch development more closely.

In 2005, Benedikt Böhm started another reimplementation of the userspace utilities, although with a completely different architecture in mind. This new implementation is known as VServer Control Daemon and is still in heavy development. A first final release is planned for end of 2006. See [[Downloads]].

== See also ==

* [[Usage Scenarios]]
* [[Related Projects]]
* [[Paper|Implementation Details]]

== External Links ==

* [http://en.wikipedia.org/wiki/Virtualization Wikipedia article about virtualization]
* [http://www.kernelthread.com/publications/virtualization/ An Introduction to Virtualization]

Some handy scripts

2007-07-30T05:59:15Z

Daniel15: Somehandyscripts moved to Some handy scripts: Moved page to "correct" name :)

= =
The motivation for creating this page was to publish some bash scripts that can be used in combination with util-vserver to make your host management simpler or more comfortable. The idea is, that you can cut&paste them from here to your shell or re-use them in your own managemnt scripts.

{{Question|Question=Show rlimits of all guests||Details=
<pre>
for i in $(ls /etc/vservers/); do echo -n "$i "; if [ -e /etc/vservers/$i/rlimits ]; then for j in $(ls /etc/vservers/$i/rlimits); do echo -en "$j=$(cat /etc/vservers/$i/rlimits/$j) "; done ; fi ; echo ""; done
</pre>

Creates an output like this:
<pre>
guest1 as=1048576 rss=131072
guest2
guest3 as=1048576 rss=131072
</pre>
|Signature=derjohn}}

{{Question|Question=Show next free context ID||Details=
<pre>
echo $(( $(sort /etc/vservers/*/context | tail -n 1) +1 ))
</pre>

Creates an output like this:
<pre>
666
</pre>
|Signature=derjohn}}

Somehandyscripts

2007-07-30T05:59:15Z

Daniel15: Somehandyscripts moved to Some handy scripts: Moved page to "correct" name :)

#REDIRECT [[Some handy scripts]]

Quotas

2007-07-25T06:27:57Z

Daniel15: The Standard non-shared quota page is probably the most relevant page at the moment... I could not find any other information on quotas...

#REDIRECT [[Standard non-shared quota]]

Standard non-shared quota

2007-07-25T06:24:24Z

Daniel15: Formatting changes and other fixes :)

Want to enable quotas from within a vserver, nothing special, just plain old and good quota support? Then this might help you!
First things first, you will need a vserver enabled kernel that you have made working and you need to add vroot support to it (In menuconfig it is in Device Drivers → Block Devices → Virtual Root device support).

After booting on the vroot enabled vserver kernel, you should have a directory '''/dev/vroot/''' with 8 vroot devices (0-7) you can use to set up your quota, if you don't, then you may make them by mknod /dev/vroot/n b 4 n (where n can be from 0 to 7). If your Linux distribution uses ''udev'', these will be at '''/dev/vroot[0-7]''' instead.

== Initial Setup ==
Use ''vrsetup'' to tell the kernel what block device you want to handle quota for:
vrsetup /dev/vroot/0 [partition]
Where [partition] is your /vservers partition. For example, this could be something like /dev/hda5 if you're just using standard partitioning, or something like /dev/lvm/vserver0 if you're using LVM.

== Setting Up Vservers For Quota ==
Setting up the vserver for quota is straight forward: (you need util-vserver 30.208 or newer)
1. Create a default mtab for the guest. To do this, add:
/dev/hdv1 / ufs rw,usrquota,grpquota 0 0
to '''/etc/vservers/<name>/apps/init/mtab'''

2. Add the quota capability to the guest vserver. Add:
quota_ctl
to '''/etc/vservers/<name>/ccapabilities'''

3. Copy the vroot device which we setup earlier to the vserver:
cp -af /dev/vroot/0 /vservers/<name>/dev/hdv1

=== Finishing the setup ===

1. Start your guest. 
2. Inside the guest, run:
quotacheck -maugv

3. Still inside the guest, turn quotas on.

Standard non-shared quota

2007-07-25T06:20:01Z

Daniel15: Cleaned up article

Want to enable quotas from within a vserver, nothing special, just plain old and good quota support? Then this might help you!
First things first, you will need a vserver enabled kernel that you have made working and you need to add vroot support to it (In menuconfig it is in Device Drivers → Block Devices → Virtual Root device support).

After booting on the vroot enabled vserver kernel, you should have a directory '''/dev/vroot/''' with 8 vroot devices (0-7) you can use to set up your quota, if you don't, then you may make them by mknod /dev/vroot/n b 4 n (where n can be from 0 to 7). If your Linux distribution uses ''udev'', these will be at '''/dev/vroot[0-7]''' instead.

Use ''vrsetup'' to tell the kernel what block device you want to handle quota for:
vrsetup /dev/vroot/0 /dev/evms/vs
or
vrsetup /dev/vroot/0 /dev/lvm/vserver0
or
vrsetup /dev/vroot/0 /dev/hda5
Depending on what partitioning scheme you're using.

Setting up the vserver for quota is straight forward: (you need util-vserver 30.208 or newer)
1. Create a default mtab for the guest. To do this, add:
/dev/hdv1 / ufs rw,usrquota,grpquota 0 0
to '''/etc/vservers/<name>/apps/init/mtab'''

2. Add the quota capability to the guest vserver. Add:
quota_ctl
to '''/etc/vservers/<name>/ccapabilities'''

3. Copy the vroot device which we setup earlier to the vserver:
cp -af /dev/vroot/0 /vservers/<name>/dev/hdv1

Finishing the setup:

1. Start your guest.
2. Inside the guest, run:
quotacheck -maugv

3. Still inside the guest, turn quotas on.

DONE!

Standard non-shared quota

2007-07-25T06:16:01Z

Daniel15: Migrated from http://oldwiki.linux-vserver.org/Standard+non-shared+quota

Want to enable quotas from within a vserver, nothing special, just plain old and good quota support? Then this might help you! :)

First things first, you will need a vserver enabled kernel that you have made working and you need to add vroot support to it (In menuconfig it is in Device Drivers, Block Devices, Virtual Root device support).

After booting on the vroot enabled vserver kernel, you should have a directory '''/dev/vroot/''' with 8 vroot devices (0-7) you can use to set up your quota, if you don't, then you may make them by mknod /dev/vroot/n b 4 n (where n can be from 0 to 7).

If your distro uses ''udev'', the vroot devices will be called:

'''/dev/vroot[0-7]'''

Use ''vrsetup'' to tell the kernel what block device you want to handle quota for:
vrsetup /dev/vroot/0 /dev/evms/vs
or
vrsetup /dev/vroot/0 /dev/lvm/vserver0

Setting up the vserver for quota is straight forward: (you need util-vserver 30.208 or newer)

- Step1: Create a default mtab for the guest:
Add
/dev/hdv1 / ufs rw,usrquota,grpquota 0 0
to '''/etc/vservers/<name>/apps/init/mtab'''

- Step2: Add the quota capability to the guest vserver:

Add
quota_ctl
to '''/etc/vservers/<name>/ccapabilities'''

Now you need to copy the vroot device which we setup earlier, to the vserver:
cp -af /dev/vroot/0 /vservers/<name>/dev/hdv1

Finishing the setup:

- start your guest

- inside the guest run:
quotacheck -maugv

- still inside the guest, turn quotas on

DONE!

Template:News

2007-06-19T23:08:14Z

Daniel15: Fixed typo

{| class="wikitablenowrap" style="width: 95%; margin: 0em auto 0em auto;"
! 06 Nov 2006
| [[Announcements/20061106|Linux-VServer Project Announces New Development Release]]
|-
! 03 Sep 2006
| [[Announcements/20060903|Linux-VServer project Announces New Stable Release and New Website]]
|-
! 31 May 2006
| Herbert has some talks and moderation in Vienna at [http://www.linuxwochen.at/2006/Wien Linuxwochen Wien 2006]. It lasts until June 2.
|-
! 3 May 2006
| We've got a booth at [http://linux-vserver.org/linuxtag2006 LinuxTag 2006]. It lasts until May 6. Try channel #vserver-linuxtag
|-
! 29 Mar 2006
| The Linux-VServer project has been accepted for a booth at [http://linux-vserver.org/linuxtag2006 LinuxTag 2006]. We need you there!
|-
! 20 Dec 2005
| [[Downloads|VServer 2.1.0]] development released
|-
! 13 Dec 2005
| [[Downloads|VServer 2.01]] released
|-
! 15 Oct 2005
| [http://www.openweekend.cz/?node=5p&lang=1 Vserver Workshop] at Open Weekend
|-
! 31 Jul 2005
| [http://program.whatthehack.org/event/241.en.html Presentation] at What The Hack ([http://rehash.whatthehack.org/wth/rawtapes/wth_linux_vserver/wth_linux_vserver_140.mp4 video])
|-
! 7 Aug 2005
| [[Downloads|VServer 2.0]] released
|-
! 23 Jan 2005
| [[Downloads|VServer 1.2.10]] released
|-
! 1 Nov 2003
| [[Downloads|VServer 1.0]] released
|}

Talk:Related Projects

2007-03-16T08:38:49Z

Daniel15: Reply

What about KVM or UML? Where should they appear in this list?
: As far as I know, KVM is Operating System-level Virtualization. I'm not sure about UML as I've never heard of it. -- [[User:Daniel15|Daniel15]] <big>(</big>[[User talk:Daniel15|Talk]]/[[Special:Contributions/Daniel15|Contribs]]<big>)</big> 09:38, 16 March 2007 (CET)

Welcome to Linux-VServer.org

2007-02-10T01:26:46Z

Daniel15: Minor grammatical fixes

Linux-VServer provides virtualization for GNU/Linux systems. This is accomplished by kernel level isolation. It allows to run multiple virtual units at once. Those units are sufficiently isolated to guarantee the required security, but utilize available resources efficiently, as they run on the same kernel.

This site contains information relating to the use and development of virtual servers based on Linux-VServer. This particular virtual server model is implemented through a combination of "security contexts", segmented routing, chroot, extended quotas and some other standard tools.

'''Note:''' If this isn't what you are looking for, maybe [http://www.linuxvirtualserver.org/ Linux Virtual Server] is.

<div style="margin: 2em auto 2em auto; padding: 10px; background-color: #F9ECCD; border: 1px solid #004433; text-align: center;">
[[Image:Icon-Caution.png|left]]
We are currently migrating from our old Wiki to MediaWiki, but not all content has been migrated yet. Take a look at the [[Wiki Team]] page for instructions how to help or look at the [http://oldwiki.linux-vserver.org old wiki] to find the information not migrated yet.
</div>

{{CurrentPatchTable}}

=== Latest News ===

{{News}}

Help:Editing

2007-02-09T09:36:09Z

Daniel15: More information :)

== Basics ==
If you don't know anything about editing a Wiki, then please see [http://meta.wikimedia.org/wiki/Help:Editing MediaWiki Editing Documentation], so you can get a basic knowledge of the Wiki syntax.
If you've used Wikipedia before, you'll feel right at home here, as we use the same software they use on their site (MediaWiki).

=== How do I add a page? ===
Simple! To add a page, simply type the page name into the search box to the left, and press Enter. On the search result page, click the "create this page." link.

Talk:Problematic Programs

2007-02-04T08:30:56Z

Daniel15: Reply to comment

I stronly suggest we rename this page to something else. I have become embroiled in a discussion with a customer and their development team who do not fully understand the concept of vservers, and the management team is not strong enough to discern quality of all technical arguments. The developer is using the title of this particular page as an indication that there are "problems with vservers and we shouldnt use them".

The first line of the page does outline how its most often not vserver's fault, but the name of the page seems to summarize a point of view about vservers thats detrimental.

Perhaps we should rename it to soemthing like "programs needing vserver-specific configuration" or the like. Hard to find a nice two word one like "problematic programs", but the name suggests more negative aspects than it should.

-- [[User:Math|Math]]
: The way that I see it, "Problematic Programs" means that the ''programs'' are problematic, not Linux-VServer itself ;). A new title would still be good, but "Programs needing VServer-specific configuration" is probably too long for a page title. -- [[User:Daniel15|Daniel15]] <big>(</big>[[User talk:Daniel15|Talk]]/[[Special:Contributions/Daniel15|Contribs]]<big>)</big> 09:30, 4 February 2007 (CET)

User:Daniel15/Sandbox

2007-02-04T08:29:54Z

Daniel15:

Sandbox :)

Test signature:
[[User:Daniel15|Daniel15]] <big>(</big>[[User talk:Daniel15|Talk]]/[[Special:Contributions/Daniel15|Contribs]]<big>)</big>

Preferences --> Put into "Nickname" box --> Tick "Raw signatures"

User:Daniel15/Sandbox

2007-02-04T08:29:09Z

Daniel15:

Problematic Programs

2007-01-24T11:54:21Z

Daniel15: /* Bind9 on Debian GNU/Linux Woody (3.0), Sarge (3.1), Etch (4.0) */ Added link to Bind9 package

Some programs do things that might work on a normal host but not inside a V-Server. This is often not a fault of V-Server itself, the programs are doing automagic things which fail and no proper error handling is done. Also sometimes the actions need special rights which are not permitted by default in V-Servers. Allowing CAPs is often not necessary since those special CAPs are only required once (e.g. when the program initializes the directories/settings/whatever).

=== OpenGroupware Apache Module ===
If your V-Server doesn't have access to localhost, then the connection to the OpenGroupware server will fail with a "Internal Server Error". The apache module for OpenGroupware called mod_ngobjweb uses a hardcoded "127.0.0.1" IP address in the source (handler.c line 339), this line you need to change to the IP address that should be used (the IP of the V-Server that runs the OpenGroupware? server)

=== Hylafax (with CAPI) ===
If you want to run hylafax in a V-Server, you will get a CAP and device problem which can be easily solved. First you need your capi20 devices in your V-Server, which can't be created by ./MAKEDEV (requires special CAPs) so copy the devices into the V-Server, like this (command run on the host):<pre>cp -aR /dev/capi* /vservers/your_vserver/dev</pre>

Now hylafax can access your CAPI ISDN card but will exit after a few seconds, the problem is it tries to create a /dev/null nod in the hylafax chroot. This fails because of missing CAPs, so lets help hylafax again with copying the nod into the hylafax chroot in the V-Server. Like this (command run on the host):<pre>cp -aR /dev/null /vservers/your_vserver/var/spool/hylafax/dev</pre>
Allright, now hylafax should have CAPI access and run properly.

=== Links inside screen inside a V-Server ===
Don't know why, but links crashes systematically being inside a screen session inside a V-Server started outside a V-Server. (please elaborate!)

=== screen inside a VServer ===

<pre>[root@ge root]# vserver zoe enter

zoe:/# screen
Cannot open your terminal '/dev/pts/5' - please check.

zoe:/# strace screen
...
stat64("/dev/pts/5", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 5), ...}) = 0
open("/dev/pts/5", O_RDWR|O_NONBLOCK) = -1 EACCES (Permission denied)</pre>

is neither a bug nor an issue with screen, it just shows that a vserver context is not allowed to mess with host terminals. either use ssh/telnet to reach the 'guest' or start the screen session before you do the 'enter' (i.e. on the host)

=== OpenLDAP Startup ===
slapd needs name resolution available in order to start up, otherwise it appears to hang. Make sure you have working DNS (or whatever) available to your vserver before starting one with slapd. This behavior is confirmed in my setup, no confirmation from others yet. My Setup: vservers all bind to an interface on a DMZ-like network segment, BIND runs on a vserver. slapd would hang at startup if the BIND vserver had not been started first.

=== rndc ===
Bind's rndc has a hardcoded 127.0.0.1 somewhere so any command to rndc will fail with connection refused. You should have a reachable localhost address defined in /etc/hosts and then you can use <pre>rndc -s localhost</pre> command. You can make a rndc.conf and set the default-server option, like that the '-s localhost' isn't necessary.

=== Asterisk ===
Since some version of Asterisk (at least since 1.0.2), it will not run anymore. On start it fails with: "Unable to set high priority".
This can be solved by allowing CAP_SYS_NICE for that V-Server. You can also not run Asterisk with the realtime priority - Just pass the '-p' command ligne argument to disable the read-time priority. Good doc on setting up Asterisk devices in the vserver: http://www.telephreak.org/papers/vpa/

=== Open/FreeSwan ===
Fails because of writing to /proc (requires patch) TODO: write me

=== Samba ===
Oplocks don't work as smbd insists on receiving break requests from 127.0.0.1
Just patch source/smbd/oplock.c (commenting paranoid code)
<pre>
+++ oplock.c.orig 2005-02-14 14:27:51.000000000 +0200
--- oplock.c 2005-02-02 12:27:50.000000000 +0200
@@ -181,14 +181,12 @@
return False;
}

+#if 0
/* Validate message from address (must be localhost). */
if(from.sin_addr.s_addr != htonl(INADDR_LOOPBACK)) {
DEBUG(0,("receive_local_message: invalid 'from' address \
(was %lx should be 127.0.0.1)\n", (long)from.sin_addr.s_addr));
return False;
}
+#endif

/* Setup the message header */
SIVAL(buffer,OPBRK_CMD_LEN_OFFSET,msg_len);
</pre>
or if you don't want to patch the samba source code you can disable oplock in Samba and it will work too!

Just put the following in your smb.conf:
<pre>
kernel oplocks = no
oplocks = no
</pre>
Note: The Vserver using Samba should also listen on the broadcast address. Thereby you will not be able to have two samba servers in the same net (on the same broadcast).

==== Samba from Debian 3.1 ====

The samba deb in sarge (3.1) provided file sharing. The only oddity observed is that the vserver guest running samba did not appear in a windows box's 'My Network Places'

Use a WINS server. The SMB browsing protocol relies heavily on broadcasts on the local net, which are problematic with vservers. WINS resolution on the other hand is unicast and works flawlessly under vserver.

==== Samba printer and file server with cups ====
Samba runs correctly in a Mandriva (Mdk) 10.1 Vserver, (Apart from the above oplock problem ?).First, edit your ''/etc/sysconfig/network'' file, and set ''networking'' to ''yes'' (This will solve problems for other services !):
<pre>
# cat /etc/sysconfig/network
NETWORKING=yes
</pre>
Some more tweaking is needeed in ''/etc/smb.conf''
<pre>
# cat /etc/smb.conf
...
# YOUR VSERVER IP/MASK HERE
interfaces = xxx.xxx.xxx.xxx/mask
...
</pre>

But if you're using Samba + Cups to provide printing for Windows clients, AND if you want to use the ''Point and Print'' feature, there is more: In the ''[printers]'' section of your ''smb.conf'', you should have the ''use client drivers'' directive set to ''no'', or the driver upload procedure will fail !
<pre>
# cat /etc/smb.conf
...
use client driver = no
...
</pre>
So, here is a full ''smb.conf'' file:
<pre>
# cat /etc/samba/smb.conf | awk '!/^$/ && !/^\s*(#|;)/ {print $0}'
[global]
workgroup = MYDOMAIN
netbios name = MYHOSTNAME
server string = MYCOMMENT (Samba %v)
printcap name = cups
load printers = yes
printing = cups
printer admin = @adm
log file = /var/log/samba/log.%m
max log size = 50
map to guest = bad user
security = domain
password server = *
encrypt passwords = yes
smb passwd file = /etc/samba/smbpasswd
username map = /etc/samba/smbusers
idmap uid = 10000-20000
idmap gid = 10000-20000
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
interfaces = 127. MYVSERVERIP/MYVSERVERMASK
wins server = MYWINSIP
dns proxy = no
# for french users:
dos charset = 850
unix charset = ISO8859-1
[homes]
comment = Home Directories
browseable = no
writable = no
[printers]
comment = All Printers
path = /var/spool/samba
browseable = no
guest ok = no
writable = no
printable = yes
create mode = 0700
print command = lpr-cups -P %p -o raw %s -r # using client side printer drivers.
use client driver = no
[print$]
path = /var/lib/samba/printers
browseable = yes
write list = @adm root
guest ok = yes
inherit permissions = yes
</pre>
...And a working smbusers:
<pre>
# Unix_name = SMB_name1 SMB_name2 ...
root = administrator MYDOMAIN\administrator
nobody = guest pcguest smbguest
</pre>

=== Cups print server ===
Symptoms: The Cups init script exits with:
<pre>
Starting CUPS printing system: cupsd: Child exited with status 98!
</pre>
And the logs (''/var/log/cups/error_log'') show:
<pre>
E [date:hour...] StartListening: Unable to bind socket for address 0.0.0.0:631 - Address already in use.
</pre>
...Or something like this.

With a correct "cupsd.conf file" (Tested version 1.1.21-0.rc1.7mdk, on Mandrake 10.1 - Now Mandriva), it works; All we need is to remove references to ''127.0.0.1'' or ''localhost'' from the file, as well as correctly unsetting the ''Listen'' directive:
<pre>
LogLevel info
TempDir /var/spool/cups/tmp
# No 'Listen' directive !
Port 631
BrowseAddress @LOCAL
BrowseDeny All
BrowseAllow @LOCAL
BrowseOrder deny,allow
<Location />
Order Deny,Allow
Deny From All
Allow From @LOCAL
</Location>
<Location /admin>
AuthType Basic
AuthClass System
Order Deny,Allow
Deny From All
Allow From YOUR_NETWORK_ADDRESS/YOUR_NETMASK # Example: 172.16.0.0/24
# Or
Allow From @LOCAL
</Location>
</pre>
Then you'll need to modify the ''/etc/init.d/cups'' script, to comment any section referring to ''127.0.0.1'' lookup and configuration. This section exists at least on Mandrake 10.1, and is pretty long (Lines 35 to 55 and/or 79), and additionnaly four "''else...if''" lines must be commented far below (Lines 161 to 164) !

Remember to stop any Cupsd running in the host server, or to start it via a wrapper ''/etc/init.d/v_cups'' script:
<pre>
#!/bin/sh
# chkconfig: 2345 15 60
# description: Wrapper to start cups bound to a single IP
USR_LIB_VSERVER=/usr/lib/util-vserver
exec $USR_LIB_VSERVER/vsysvwrapper cups $*
</pre>
Do not forget to give a password to the root user, if you want to ba able to manage your printers from the web interface (http://yourcupsvserver:631)!
<pre>
# passwd root
...
</pre>
If you use Mandriva 10.1 (And maybe some other distros), you’ll need to add the printers drivers for Cups, and reload it:
<pre>
# urpmi --root /vservers/yourcupsvserver/ cups-drivers
# /etc/init.d/cups reload
</pre>
…It added 67 Mb of packages for me.

Then use ''/etc/init.d/v_cups (re)start'' to launch Cups on the host server.
You will now be able to make Cupsd start in the vserver , but more tweaking on the ACLs may be necessary to avoid authentification problems...

=== Bind9 on Debian GNU/Linux Woody (3.0), Sarge (3.1), Etch (4.0) ===
named provided by the bind9 binary packages fails to start because it is compiled with CAPs option.

The debian way is to build** your own package without CAPs:
<pre>
su -
cd /usr/src
apt-get build-dep bind9
apt-get source bind9
cd bind9-x.x.x
vi debian/rules
</pre>
Insert the following line after "./configure --prefix=/usr \":
<pre>
--disable-linux-caps \
</pre>
On a NPTL-enabled system you alse have to replace
<pre>
--enable-threads \
</pre>
with
<pre>
--disable-threads \
</pre>
or bind might refuse to run with an other user than root.

Save the file and go ahead with compiling/installing:
<pre>
dpkg-buildpackage
dpkg -i ../bind9-x.x.x.deb
echo "bind9 hold" | dpkg --set-selections
</pre>
The last line is to set the package "on hold", so it is not touched by the update process. you have to take care of security holes by yourself now!

The Xs in "bind9-x.x.x" denote the version number of bind9. Alternatively you can allow the CAP_SYS_RESOURCE for that V-Server. The best way would be to fix bind, which is somehow broken when it comes to capabilities. Daniel Hokka Zakrisson repaired it. His patch is to be found here:

[bind-9.3.2-caps-when-available.patch] ''need patch url please''

So, if you recompile, it would be the cleanest way to apply that patch. Thanks Daniel! It would be also nice, if someone submits that patch to the bind people or maybe to your distribution's package maintainers in the first step.

Get my [http://linux-vserver.derjohn.de/bind9-packages/bind9-capacheck_9.3.2-2_i386.deb vserver-guest-ready Debian bind9 package] for Debian Sid guests. Feedback welcome: aj@net-lab.net

''Problems getting this to work in an x86_64 vserver. Any hints? From what I can tell from stracing, turning off threads doesn't fix everything related to it. It also caused a juicy Ksymoops.''

=== Zimbra Mail ===
Zimbra is many applications (including Postfix and MySQL? and OpenLDAP? and more) which try to take over the interfaces, and depend a lot on binding from 127.0.0.1 - it is not hard to change, but there is a couple of tricks - it is documented here - http://wiki.zimbra.com/index.php?title=Install_VServer

=== xine ===
won't start with no error message.

"xine --verbose" shows this.
<pre>
ERROR: Could not determine network interfaces, you must use a interfaces config line
</pre>
This happens if you have the xineplug_inp_smb.so plugin. Delete it and everything is fine.

=== 127.0.0.1 issues ===
I had problems with an application that wanted me to access it on 127.0.0.1 and AS 127.0.0.1 to be able to do its configuration. A simple tweak solved the problem. I renamed the default interface directory "0" in /etc/vservers/server/interfaces to "1" and created interface 0 as :
<pre>
dev lo
ip 127.0.0.1
mask 255.0.0.0
name lo
</pre>
now interface "1" is the default created interface by the vserver build script with a local adress like 192.168.1.2 and interface "0" is the loopback. I can now telnet on 127.0.0.1 and it sees that im connecting to 127.0.0.1 from 127.0.0.1

Compiling nagios-1.4 within a vserver requires this, otherwise it hangs during the configure with "checking for ICMP ping syntax..."

=== Hula-project ===
Does not want to start. TODO: add more information.

=== Postfix ===

==== Postfix 2.1.5 (Debian Sarge) ====
On a vserver with two interfaces (lo and eth0), and a postfix 2.1.5 listening on lo, postfix can't send emails : "Invalid argument"... Setting smtp_bind_address (http://www.postfix.org/postconf.5.html#smtp_bind_address) to the external address solves the issue.

==== Postfix Policy Daemon ====
Running a Debian 3.1 Sarge with Backports I have several issues with the postfix-policyd because it wants to set the rlimits.

Log returns:
<pre>
cannot set rlimit: Operation not permitted
</pre>
Strace tells us:
<pre>
setrlimit(RLIMIT_NOFILE, {rlim_cur=4097, rlim_max=4097}) = -1 EPERM (Operation not permitted)
</pre>
Output on the Host
<pre>
# Ulimit -Ha
...
-n: file descriptors 1024
...
</pre>
Thats too little...

Solution:

The App has again a build in need to use CAP_SYS_RESOURCE (which is bad (tm)) so in the guest do:
<pre>
# ulimit -HS -n 8192
# ulimit -Ha
.. shows us now the correct 8192 instead of 1024.

# vserver $yourVserverName restart
# vserver $yourVserverName enter

$yourVserverName # ulimit -Ha
...
-n: file descriptors 8192
...
</pre>
Everything should be fine now !

Frequently Asked Questions

2007-01-24T11:48:38Z

Daniel15: Minor fixes to "Bind9 does not like to start in my guest" section

<div style="margin: 2em auto 2em auto; padding: 10px; background-color: #F9ECCD; border: 1px solid #004433; text-align: center;">
[[Image:Icon-Caution.png|left]]
We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the [[Wiki Team]] page for instructions how to help or look at the [http://oldwiki.linux-vserver.org old wiki] to find the information not migrated yet.

'''To ease migration we created a [[List of old Documentation pages]].'''
</div>

CURRENTLY THE CONTENT OF THE OLD WIKI FAQ (AND MORE) IS BEING MIGRATED TO THIS PAGE (TASK: DERJOHN)

__TOC__

{{Question|Question=What is a 'Guest'?||Details=To talk about stuff, we need some naming. The physical machine is called 'Host' and the 'main' context running the Host Distro is called 'Host Context'. The virtual machine/distro is called 'Guest' and basically is a Distribution (Userspace) running inside a 'Guest Context'.|Signature=derjohn}}

{{Question|Question=What kind of Operating System (OS) can I run as guest?||Details=
A: With VServer you can only run Linux guests. The trick is that a guest does not run a kernel on its own (as XEN and UML do), it merely uses a virtualized host kernel-interface. VServer offers so called security contexts which make it possible to seperate one guest from each other, i.e. they cannot get data from each other. Imagine it as a chroot environment with much more security and features.|Signature=derjohn}}

{{Question|Question=Which distributions did you test?||Details=
A: Some. Check out the wiki for ready-made guest images. But you can easily build own guest images, e.g. with Debian's debootstrap. Checkout ((step-by-step Guide 2.6)) how to do that.|Signature=derjohn}}

{{Question|Question=Is VServer comparable to XEN/UML/QEMU?||Details=
A: Nope. XEN/UML/QEMU and VServer are just good friends. Because you ask, you probably know what XEN/UML/QEMU are. VServer in contrary to XEN/UML/QEMU not "emulate" any hardware you run a kernel on. You can run a VServer kernel in a XEN/UML/QEMU guest. This is confirmed to work at least with Linux 2.6/vs2.0.|Signature=derjohn}}

{{Question|Question=Is VServer secure?||Details=
A: We hope so. It should be as least as secure as Linux is. We consider it much much more secure though.|Signature=derjohn}}

{{Question|Question=Performance?||Details=
A: For a single guest, we basically have native performance. Some tests showed insignificant overhead (about 1-2%) others ran faster than on an unpatched kernel. This is IMVHO significantly less than other solutions waste, especially if you have more than a single guest (because of the resource sharing).|Signature=derjohn}}

{{Question|Question=Is SMP Supported?||Details=
A: Yes, on all SMP capable kernel architectures.|Signature=derjohn}}

{{Question|Question=Resource sharing?||Details=
A: Yes ....
* memory: Dynamically.
* CPU usage: Dynamically (token bucket)|Signature=derjohn}}

{{Question|Question=Resource limiting?||Details=
A: Yes, you can set maximum limits per guest, but you can only offer guaranteed resource availability with some ticks at the time. There is the possibility to ulimit and to rlimit. Rlimit is a new feature of kernel 2.6/vs2.0.|Signature=derjohn}}

{{Question|Question=Disk I/O limiting? Is that possible?||Details=
A: Well, since vs2.1.1 linux-vserver supports a mechanism called 'I/O scheduling', which appeared in the 2.6 mainline some time ago. The mainline kernel offers several I/O schedulers:

<pre>
# cat /sys/block/hdc/queue/scheduler
noop [anticipatory] deadline cfq
</pre>

The default is anticipatory a.k.a. "AS". When running several guests on a host you probably want the I/O performance shared in a fair way among the different guests. The kernel comes with a "completely fair queueing" scheduler, CFQ, which can do that. (More on schedulers can be found at http://lwn.net/Articles/114770/)

This is how to set the scheduler to "cfq" manually:
<pre>
root# echo "cfq" > /sys/block/hdc/queue/scheduler
root# cat /sys/block/hdc/queue/scheduler
noop anticipatory deadline [cfq]
</pre>

Keep in mind that you have to do it on all physical discs. So if you run an md-softraid, do it to all physical /dev/hdXYZ discs!

If you run Debian there is a predefined way to set the /sys values at boot-time:

<pre>
# apt-get install sysfsutils
[...]

# cat /etc/sysfs.conf | grep cfq
block/sda/queue/scheduler = cfq
block/sdc/queue/scheduler = cfq

# /etc/init.d/sysfsutils restart
</pre>

For non-vserver processes and CFQ you can set by which key the kernel decides about the fairness:

<pre>
cat /sys/block/hdc/queue/iosched/key_type
pgid [tgid] uid gid
</pre>
Hint: The 'key_type'-feature has been removed in the mainline kernel recently. Don't look for it any longer :(

The default is tgid, which means to share fairly among process groups. Think every guest is treated like a own process group. It's not possible to set a scheduler strategy within a guest. All processes belonging to the same guest are treated like "noop" within the guest. So: If you run apache and some ftp-server within the _same_ guest, there is no fair scheduling between them, but there is fair scheduling between the whole guest and all other guests.

And: It's possible to tune the scheduler parameters in several ways. Have a look at /sys/block/hdc/queue/....

You need a very recent Version of VS devel, e.g. the 2.1.1-rc18 can do it. Some older version have that feature too, then it got lost and was reinvented. So: Go and get a rc18 - only in 'devel', not stable!|Signature=derjohn}}

{{Question|Question=Why isn't there a device /dev/bla? within a guest||Details=
A: Device nodes allow Userspace to access hardware (or virtual resources). Creating a device node inside the guest's namespace will give access to that device, so for security reasons, the number of 'given' devices is small.|Signature=derjohn}}

{{Question|Question=What is Unification (vunify)?||Details=
A: Unification is Hard Links on Steroids. Guests can 'share' common files (usually binaries and libraries) in a secure way, by creating hard links with special properties (immutable but unlinkable (removable)). The tool to identify common files and to unify them is called vunify.|Signature=derjohn}}

{{Question|Question=What is vhashify?||Details=
A: The successor of vunify, a tool which does unification based on hash values (which allows to find common files in arbitrary paths.)|Signature=derjohn}}

{{Question|Question=How do I manage a multi-guest setup with vhashify?||Details=
A: For 'vhashify', just do these once:

<pre>
mkdir /etc/vservers/.defaults/apps/vunify/hash /vservers/.hash
ln -s /vservers/.hash /etc/vservers/.defaults/apps/vunify/hash/root
</pre>

Then, do this one line per vserver:

<pre>
mkdir /etc/vservers/<vservername>/apps/vunify # vhashify reuses vunify configuration
</pre>
|Signature=derjohn}}

{{Question|Question=With which VS version should I begin?||Details=
A: If you are new to VServer I recommend to try 2.0.+. Take "alpha utils" Version 0.30.210. In Debian Sid there appeared well running version of it recently. (It's a .210 at the time of writing).|Signature=derjohn}}

{{Question|Question=is there a way to implement "user/group quota" per VServer?||Details=
A: Yes, but not on a shared partition for now. You need to put the guest on a separate partition, setup a vroot device (to make the quota access secure), copy that into the guest, and adjust the mtab line inside the guest.|Signature=derjohn}}

{{Question|Question=what about "Quota" for a context?||Details=
A: Context quotas are now called Disk Limits (so that we can tell them apart from the user/group quotas :). They are supported out of the box (with vs2.0) for all major filesystems (Ext2/3, ReiserFS, XFS, JFS)|Signature=derjohn}}

{{Question|Question=Does it support IPv6?||Details=
A: Currently not. Some developer has to move his ... to reimplement this functionality from the V4 code (I read that on the ML ;)). Will probably be superseded by the ngnet (next generation networking) soon. There is a Wiki page regarding this: http://linux-vserver.org/IPv6|Signature=derjohn}}

{{Question|Question=I can't do all I want with the network interfaces inside the guest?||Details=
A: For now the networking is 'Host Business' -- the host is a router, and each guest is a server. You can set the capability ICMP_RAW in the context of the guest, or even the capability CAP_NET_RAW (which would even allow to sniff interfaces of other guests!). Likely to change with ngnet. |Signature=derjohn}}

{{Question|Question=Is there a web-based interface for vserver that will allow creation/deletion/configuration etc. of vserver guests?||Details=
A. http://OpenVPS.org which is a set of scripts with a web-interface for webhosters/ISPs. http://Openvcp.org which is a distributed system (agent!) with a web-interface, with which you can build/remove guests. http://vsmon.revolutionlinux.com/ is a distributed monitoring-only solution that allows you to search for a particular vserver in your park. |Signature=derjohn}}

{{Question|Question=What is old-style and new-style config?||Details=
A. Old-style config refers to a single text-file that contains all the configuration settings. With new-style config the configuration is split into several directories and files. You should probably go for new-style config if you are asking.|Signature=derjohn}}

{{Question|Question=What is the "great flower page"?||Details=
A. Well, this page contains all configation options for vserver in version > 1.9 (I think .. I joined Linux-VServer in version 2, so I don't know for sure). The name of the page is derivived from the stylesheet(s) it contains: It displays background pictures of a very great flower, so regard it as highly optimized. It was designed by a non-designer, who asks us to create a better one. I played with the thought of creating a complete new theme for that page - but actually we all got used to the name "great flower page", so we stick to it. If you are unable to read it clearly, feel invited to join the IRC channel #vserver, we may tell you how to ;)|Signature=derjohn}}

{{Question|Question=How do I add several IPs to a vserver? ||Details=
A: First of all a single guest vserver only supports up to 16 IPs (There is a 64-IP patch available, which is in "derjohn's kernel", you need extra util-vserver anyway).
Here is a little helper-script that adds a list of IPs defined in a text file, one per line.
<pre>
#!/bin/bash
j=1
for i in `cat myiplist`; do
j=$(($j+1))
mkdir $j
echo $i > $j/ip
echo $i > $j/ip-old
echo "24" > $j/prefix
done
</pre>|Signature=derjohn}}

{{Question|Question=If my host has only one a single public IP, can I use RFC1918 IP (e.g. 192.168.foo.bar) for the guest vservers?||Details=
A: Yes, use iptables with SNAT to masquerade it.
<pre>
iptables -t nat -I POSTROUTING -s $VSERVER_NETZ ! -d $VSERVER_NETZ -j SNAT --to $EXT_IP
</pre>
See: HowtoPrivateNetworking and
http://www.tgunkel.de/it/software/doc/linux_server.en#h3-VServer_Masquerading_SNAT (THX, [MUPPETS]Gonzo)|Signature=derjohn}}

{{Question|Question=If I shut down my vserver guest, the whole Internet interface ethX on the host is shut down. What happened? ||Details=
A: When you shut down a guest (''i.e. vserver foo stop''), the IP is brought down on the host also. If this IP happens to be the primary IP of the host, the kernel will not only bring down the primary IP, but also all secondary IP addresses. But in very recent kernels, there is an option ''settable'' which prevents that nasty feature. It's called "alias promotion". You may set it via sysctl by adding ''net.ipv4.conf.all.promote_secondaries=1'' in /etc/sysctl.conf or via sysctl command line.|Signature=derjohn}}

{{Question|Question=On Debian Sarge (stable) only util-vserver is 0.30-204 available, which has been reported to be buggy (I didnt check the version for longer time) How do I compile a local version of alpha util-vserver .210 on Debian?||Details=
A:
<pre>
apt-get build-dep util-vserver

./configure --prefix=/usr/local/ --enable-release \
--mandir=/usr/local/share/man \
--infodir=/usr/local/share/info \
--sysconfdir=/etc --enable-dietlibc \
--localstatedir=/var \
--with-vrootdir=/var/lib/vservers

make

make install-distribution
(Which does a make install + setting a symlink ln -s /usr/local/lib/util-vserver/vshelper /sbin/vshelper )

</pre>

To test which version you are running:
<pre>
# which vserver
/usr/local/sbin/vserver

</pre>

This should point to ..local...

If you dont want to build it yourself: On www.backports.org there are backported (for sarge) linux-images (2.6.16) with vserver-patch enabled and a updated util-vserver package as well.
|Signature=derjohn}}

{{Question|Question=I use derjohn's kernel or a differnet kernel with a more-than-16-IPs-per-guest-patch and can't use more than 16 IPs. Why?||Details=
A: You need to patch util-vserver, too. So you obviously need to recompile util-vserver (see above). In the util-vserver directory there are header files in the ./kernel/ directory. Patch like this:

<pre>
kernel/network.h:#define NB_IPV4ROOT 64
</pre>

BTW: The initial patches can be found here: http://vserver.13thfloor.at/Experimental/VARIOUS/util-vserver-0.30.196-net64.diff.bz2 and http://vserver.13thfloor.at/Experimental/VARIOUS/delta-2.6.9-vs1.9.3-net64.diff
|Signature=unknown}}

{{Question|Question=I run a Debian host and want to build an Ubuntu guest. Howto?||Details=
A: Simple ;) Assume you want to build a breezy guest on a sid host with IP 192.168.0.2 and hostname vubuntu, then do:
<pre>
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu
</pre>

[UPDATE] Currently there are problems in building breezy under unclear circumstances, which seems to have to do with udev. If the above didnt work, try:
<pre>
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu -- --exclude=udev
</pre>
In very recent versions of the utils, the problem should not occur anymore (it has to do with the 'secure-mount' if you look in the MLs)

Well, sid's debootstrap knows how to bootstrap Ubuntu linux. Make sure to have a current debootstrap package:
<pre>
apt-get update
apt-get install debootstrap
</pre>
The knowledge how to build ubuntu 'breezy badger' (which you probably want to be your guest at the time of writing) has been added recently.|Signature=derjohn}}

{{Question|Question=How do I make a vserver guest start by default?||Details=
A: At least on Debian, I can tell you how to do it with the new-style config. If your guest is called "derjohn" and you want it to be started somewhere at the of your bootstrap process, then do:
<pre>
echo "default" > /etc/vservers/derjohn/apps/init/mark
</pre>
If you want to start it earlier, please read the init script "/etc/init.d/vserver-default" to find out how to do it. In most cases you don't need to change this. On Debian the vservers are started at "90", so after most other stuff is up (networking etc.).

Besides that I created a small helper script for managing the autostart foo: ((vserver-autostart))|Signature=derjohn}}

{{Question|Question=My host works, but when I start a guest it says that it has a problem with chbind.||Details=
A: You are probably using util-vserver <= 0.30.209, which does use dynamic network contexts internally (With 0.30.210 this fact changed). So if you compiled your kernel without dynamic contexts, you may start guests, but you can't use the network context.The solution is either to switch to .210 util (or Hollow's toolset) or compile the kernel with dynamic network contexts.
SE Keyword: invalid option `nid' testme.sh|Signature=derjohn}}

{{Question|Question=When I try to ssh to the guest, I log into the host, even if I installed sshd on the guest. What's wrong here?||Details=
A: Look at /etc/ssh/sshd_config of the host:

<pre>
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
</pre>

And now change the setting to
<pre>
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
ListenAddress your.hosts.ip.here # not the guests IP!
</pre>

Then '/etc/init.d/ssh restart' on the host, after that on the guest (if you did apt-get install ssh on the guest already.)

Do I have to explain more? If the hosts sshd binds all available IP addresses on port 22 (The hosts 'sees' even all addresses of the guests!). So if the guest starts its sshd, it cant bind to port 22 any more. You need to change that setting only on the host.
(BTW: A similar approach has to be done for a lot of daemons, e.g. Apache. If the daemon does not support an explicit bind, you may use the chbind command to 'hide' IP addresses from the daemon before starting.)|Signature=derjohn}}

{{Question|Question=I did everything right, but the application foo does not start. What's up there?||Details=
A: Before asking on the IRC channel, please check out the 'problematic programs' page:
[[Problematic Programs]]|Signature=derjohn}}

{{Question|Question=Bind9 does not like to start in my guest.||Details=
A: Check out the [[Problematic Programs]] page and/or get my [http://linux-vserver.derjohn.de/bind9-packages/bind9-capacheck_9.3.2-2_i386.deb vserver-guest-ready Debian package] for Debian Sid guests, and check out the [http://linux-vserver.derjohn.de/bind9-packages/README.txt readme]. (Hint: This is fresh stuff. The give me Feedback) 
[UPDATE] Since VServer Devel 2.1.1-rc18 you do not need to patch the userland tools anymore. The capabilities are masked.|Signature=derjohn}}

{{Question|Question=Which guest vservers are running?||Details=
A: {{vserver-stat}}. Example output:
<pre>
CTX PROC VSZ RSS userTIME sysTIME UPTIME NAME
0 77 965.1M 334.6M 14m14s18 2m28s69 1h33m46 root server
49152 7 14M 5.2M 0m00s40 0m00s30 1h30m15 chiffon
</pre>|Signature=derjohn}}

{{Question|Question=How can I reboot/halt guests?||Details=
A: It depends.
For vserver with legacy-interfaces support, you have to replace {{/sbin/halt}} in guests with vreboot and start rebootmgr in host. You also need to have a dummy <guest>.conf file in /etc/vservers for each guest. Please have a look at /etc/init.d/rebootmgr.
Vserver with native interface utilizes /dev/initctl. No changes are needed in guests. Just make sure that REBOOT capability is adjusted in guests.|Signature=derjohn}}

{{Question|Question=Do I really need the legacy-interfaces? What are these legacy-interfaces?||Details=
A: Since vserver is an ongoing project, new features might replace old ones, some might still on development. Legacy-interfaces are available for backward compability (which might be removed someday). See Q: How can I reboot/halt guests?|Signature=derjohn}}

{{Question|Question= I have a vserver running on a Linux kernel with preemption. Is VServer "preempt" safe?||Details=
A: There are no known issues about running vserver on a preemption enabled kernel. I would like to add, that the vserver kernelhackers would probably exclude that option in 'make menuconfig' if there would be an incompatibility. Just my $.02 :)|Signature=derjohn}}

{{Question|Question=Is this a new project? When was it started?||Details=
A: The first public occurance of linux-vserver was Oct 2001. The initial mail can be found here: http://www.cs.helsinki.fi/linux/linux-kernel/2001-40/1065.html
So you can expect a mature software product wich does it's magic quite well (And hey, we have a version > 2.0 ! )|Signature=derjohn}}

{{Question|Question=Can I run an OpenVPN Server in a guest?||Details=
A: Yes. I don't want to provide an in-depth OpenVPN tutorial, but want to show how I made OpenVPN work in a guest as server. I was not able to run it with a tun devive, due to a buglet in util-vserver and kernel when it comes to settings a an ip address a point to point link: If you add "ip addr add <ip> peer <mypeer> dev tun0" there is no way to map the tun0 interface into a guest, even not with a 'nodev' option. (bug confirmed to be reproducible by daniel_hoczac)

First of all you have to prepare the host with a persistent tuntap interface in tap-mode. The tools we need come from the uml-utilities.
Then you need to create a device /dev/net/tun, which the OpenVPN userspace daemon reads. Well assume 10.10.10.100 is the server IP, and 10.10.10.101 is the client ip - to be cool be choose a /31 netmask (255.255.255.254), so we have a net without broadcast and don't waste IPs :)

On the host do:
<pre>
# apt-get install uml-utilities
# cd /var/lib/vserver/<myopenvpnserver>/dev/
# ./MAKEDEV tun
(creates the dev/net/tun device accessible by te guest - even a tap interface need /dev/net/tun !)
# tunctl -t tap0
(creates the network device 'tap0' persistently)
</pre>

Then add the ip to the guest:
<pre>
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/ip
10.10.10.100
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/prefix
31
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/dev
tap0
(This kind of config brings the ip when the vserver is started - only the tap0 interface has to exist already, see above!)
</pre>

Here is a sample config for the guest (which is acting as a server):

Install OpenVPN package on server and client, in the Debian case:
<pre>
# apt-get install openvpn
</pre>

The server's conf looks like that:
<pre>
# port and interface specs

# behave like a ssl-webserver
port 443
proto tcp-server

# tap device? (keep in mind you need /dev/net/tun !)
dev tap0

# now the ips we will use for the tunnel
ifconfig 10.10.10.100 255.255.255.254
ifconfig-noexec

# the server part

# Keep VPN connections, even if the client IP changes
float

# use compression (may also even obfuscate content filters)
comp-lzo

# use a static key - create it with 'openvpn --genkey --secret static.key'
secret static.key

# dont reload the key after a SIGUSR1
persist-key

# check alive all 10 secs
keepalive 10 60

# verbosity level (from 1 to 9, 9 is max log level)
verb 4
status openvpn-status.log
</pre>

The client's conf may look like that (This example even makes the tunnel the clients default address):
<pre>
# cat /etc/openvpn/client.conf
# port and interface specs

# the following is not necessary, if you bring up openvpn via Debian's init script:
daemon ovpn-my-clients-name

# behave like a ssl-webserver
port 443
proto tcp-client
remote %%%<insert-the-guest-primary-public-ip-here>%%%%
# what device tun ot tap?
dev tap

# now the ips we will use for the tunnel
ifconfig 10.10.10.101 255.255.255.254

# Keep VPN connections, even if the client IP changes
float
mssfix

# use compression (may also even obfuscate content filters)
comp-lzo

# use a static key
secret static.key

# dont reload the key after a SIGUSR1
persist-key

# check alive all 10 secs
keepalive 10 60

# verbosity level (from 1 to 9, 9 is max log level)
verb 4

# set the default route
route-gateway 10.10.10.100
redirect-gateway def1
# to add special routes you can do it wihtin the openvpn client conf:
# route <dest> <mask> <gateway>

# if you need to connect via proxy (like squid)
# http-proxy s p [up] [auth] : Connect to remote host through an HTTP proxy at
# address s and port p. If proxy authentication is required,
# up is a file containing username/password on 2 lines, or
# 'stdin' to prompt from console. Add auth='ntlm' if
# the proxy requires NTLM authentication.

# http-proxy s p [up] [auth]

# http-proxy-option type [parm] : Set extended HTTP proxy options.
# Repeat to set multiple options.
# VERSION version (default=1.0)
# AGENT user-agent

# http-proxy-option type [parm]
</pre>

In the next lesson I will talk about OpenVPN's server mode, which can deal with with multiple clients connecting to one ip and one port (i.e. you only need one guest for tons or 'roadwarriros'), tls connections and pki.

Contributions welcome. :)|Signature=derjohn}}

{{Question|Question=32 vs 64 Bit? What should I take?||Details=
A: If you have the choice make the host a 64 bit one. You can run a guest as 32 bit or as 64 bit on a 64 bit host. To run it as 32 bit, you need to compile the x86_64 (a.k.a. AMD64) with the following options:

<pre>
[*] Kernel support for ELF binaries
<M> Kernel support for MISC binaries
[*] IA32 Emulation <---- without that, the entire 32bit API is not present
<M> IA32 a.out support
</pre>

You can force the guest to behave like a 32 environment like this:
<pre>
echo linux_32bit > /etc/vservers/$NAME/personality
echo i686 > /etc/vservers/$NAME/uts/machine
</pre>
(thanks cehteh for the hint!)

But you can force debootstrap to but 32 bit binaries into the guest by 'export ARCH=i386';
<pre>
export ARCH=i386 ; vserver build ....
</pre>|Signature=derjohn}}

{{Question|Question=I want to (re)mount a partition in a running guest ... but the guest has no rights (capability) to (re)mount?||Details=
A: I'll explain. I take as example your /tmp partition within the guest is too small, what will be likely the case if you stay with the 16MB default (vserver build mounts /tmp as 16 MB tempfs!).
<pre>
# vnamespace -e XID mount -t tmpfs -o remount,size=256m,mode=1777 none /var/lib/vservers/<guest>/tmp/
</pre>
Be warned that the guest will not recognize the change, as the /etc/mtab file is not updated when you mount like this. To permanently change the mount, edit /etc/vserver/<guest>/fstab on the host.|Signature=derjohn}}

{{Question|Question=How do I limit a guests RAM? I want to prevent OOM situations on the host!||Details=
A: First you can read [http://linux-vserver.org/Memory+Allocation] and [[Memory Limits]].

If you want a recipe, do that:
1. Check the size of memory pages. On x86 and x86_64 is usually 4 KB per page.
2. Create /etc/vserver/<guest>/rlimits/
3. Check your physical memory size on the host, e.g. with "free -m". maxram = kilobytes/pagesize.
4. Limit the guests physical RAM to value smaller then maxram:

<pre>
echo %%insertYourPagesHereSmallerThanMaxram%% > /etc/vserver/<guest>/rlimits/rss
</pre>

5. Check your swapspace, e.g. with 'swapon -s'. maxswap = swapkilobytes/pagesize.
6. Limit the guest's maximum number of as pages to a value smaller than (maxram+maxswap):

<pre>
echo %%desiredvalue%% > /etc/vserver/<guest>/rlimits/as
</pre>

It should be clear this can still lead to OOM situations. Example: You have two guests and your as limit per guest is greater than 50% of (maxram+maxswap). If both guests request their maximum at the same point in time, there will be not enough mem .....|Signature=derjohn}}

{{Question|Question=Were can I get newer versions of VServer as ready made packages for Debian?||Details=
A: Here you go: http://linux-vserver.derjohn.de/ . There is also some stuff on backports.org, but my kernels are always 'devel' branch.|Signature=derjohn}}

{{Question|Question=Can I use iptables ?||Details=
Yes but right now only on the host (rootserver). Please realize that all traffic is local and will not touch the forward chain.|Signature=BeginnerFAQ}}

{{Question|Question=Trying to connect to a vserver from the host or another vserver on the same host fails||Details=
strace shows
<pre>
sin_addr=inet_addr("xx.xx.xx.xx")}, yy) = -1 EINVAL (Invalid argument)
</pre>
A: The host/guest cannot communicate with another guest on same host.
* check all netmasks on all interfaces (do they overlap) ?
* check policy routing (disable it temporary) ?
* check that lo is up (Networking within a host/guest always uses lo interface)
|Signature=CommonProblems}}

{{Question|Question=#1 ERROR: capset(): Operation not permitted||Details=capabilities are not enabled in kernel-setup
please check that CONFIG_SECURITY_CAPABILITIES is loaded or included in the kernel. ( check with "cat /path_to_kernel/.config | grep -i cap ")
(2.6.11.5-vs-1.9.5 + 0.30-205)|Signature=IrcQuestions}}

{{Question|Question=How can I make 'vserver start' mount the root filesystem||Details=
mount it via /etc/vservers/vserver-name/fstab, make sure to set the option 'dev' e.g.:
<pre>/dev/drbd0 / xfs rw,dev 0 0</pre>
util-vserver 210 won't be able to find some scripts for the reboot, add into /etc/vservers/vserver-name/apps/init/cmd.stop
<pre>/etc/init.d/rc
6</pre>
|Signature=AdrianReyer}}

{{Question|Question=How do I tag a guest's directory with xid?||Details=
Tagging the guest's files gives you serveral advantages, e.g. the accoutung will work properly.
Filesystem XID tagging only works on supported filesystem. Those are currently: ext2/3, reiserfs/reiser3, xfs and jfs.
To activate the XID tagging you have to mount the filesystem with "-o tagxid". Attention: It's _not_ possible to "-o remount,tagxid", you have to mount it freshly. The guests will tag their files automatiaclly. If you copy files in from the host, you have to tag them manually like this:
<pre>chxid -c xid -R /var/lib/vservers/<guest></pre>
Note: Context 0 and 1 will see all files, guests will only be able to acess untagged files and their own XID. They can see other XID files but no information about the file, e.g. no owner, no group, no permissions.
|Signature=derjohn_and_gonzo_and_are}}

More FAQs to be merged;
[http://www.linux-vserver.org/Frequently_Asked_Questions_scratch]

{{Question|Question=My mysqld running in a guest behaves strangely and is awfully slow/locks up||Details=
This can be related to /tmp being too small. mysqld stores temporary tables in /tmp and as such, if a lot of queries happen and /tmp runs full this can cause one query to lock up whilst creating the tmp table and all other queries waiting to acquire the lock. There are two possible solutions to that problem: a.) Modify /etc/vservers/vserver-name/fstab and assign more memory to the tmpfs of /tmp and b.) remove the /tmp entry from /etc/vservers/vserver-name/fstab completly. Especially on database servers with a rather high load the second one might be the preferred method.|Signature=sp}}

{{Question|Question="I deleted a guest's directory without shutting it down. Now I have a "ghost" running. Is there any possibility to get it out of proc without rebooting?||Details=vkill --xid <xid> -s 15; sleep 2; vkill --xid <xid> -s 9|Signature=daniel_hozac}}

== Upgrade from 2.0 to 2.2 ==

{{Question|Question=I now get errors like "ncontext: vc_net_create(): Invalid argument; dynamic contexts disabled." on startup. Vservers are not started||Details=Dynamic context are disabled by default and are deprecated. For example, tagxid and network checks won't be useable with dynamic ids. Now you should manually assign a explicit context to your vservers, like
echo 101 > /etc/vservers/myvserv/context
|Signature=daniel_hozac&Beuc}}

Talk:Frequently Asked Questions

2007-01-24T11:42:45Z

Daniel15:

"great flower page"? Wasn't that the one at http://www.nongnu.org/util-vserver/doc/conf/configuration.html? Looks like it's been... "fixed" now :D --[[User:Daniel15|Daniel15]] <big>(</big>[[User talk:Daniel15|Talk]]/[[Special:Contributions/Daniel15|Contribs]]<big>)</big> 12:42, 24 January 2007 (CET)

Talk:Frequently Asked Questions

2006-12-17T01:10:36Z

Daniel15: Remove spam

Usage Scenarios

2006-12-16T00:49:16Z

Daniel15: /* Consolidation and Separation */ Minor updates

For many people, virtual server may look like a great toy: Very high geekness factor. It looks cool, but probably not for everyone. '''Wrong!'''

The primary goal of this project is to create virtual servers sharing the same machine. A virtual server operates like a normal Linux server. It runs normal services such as ssh, mail, web and database servers.

== Consolidation and Separation ==

As the hardware evolves, it is tempting to put more and more tasks on a server. Though Linux could reliably handle it, at some point, you will end up with too much stuff and people fiddling in the same box that you worry about updating things. Additionally, separating different or similar services which otherwise would interfere with each other, either because they are poorly designed or because they are simply incapable of peaceful coexistence for whatever reason, may often be complex or even impossible.

The Linux-VServer project addresses this issue. The same box is able to run multiple virtual servers and each one does the job it is supposed to do. If you need to upgrade to PHP 5 for a given project, you can do so, and only that one project is affected.

Also, you can give the root password of a virtual server to an administrator for that virtual server and he/she will be able to perform updates, restart services and so on without having to know about every other project hosted on the same server. This allows a clever provider to sell Virtual Private Servers, which uses less resources than other virtualization techniques, which in turn allows to put more units on a single machine.

The list of providers doing so is relatively long, and so this is rightfully considered the main area of application. See [[VServer Hosting]] for a (probably incomplete) list of companies providing Virtual Private Servers based on the Linux-VServer technology.

== Enhancing Security ==

While it can be interesting to run several virtual servers in one box, there is one concept potentially more generally useful. Imagine a physical server running a single virtual server. The goal is isolate the main environment from any service, any network. You boot in the main environment, start very few services and then continue in the virtual server.

The service in the main environment would be:

* Unreachable from the network.
* Able to log messages from the virtual server in a secure way. The virtual server would be unable to change/erase the logs. Even a cracked virtual server would not be able the edit the log.
* Able to run intrusion detection facilities, potentially spying the state of the virtual server without being accessible or noticed. For example, tripwire could run there and it would be impossible to circumvent its operation or trick it.

Another option is to put the firewall in a virtual server, and pull in the DMZ, containing each service in a separate VPS. On proper configuration, this setup can reduce the number of required machines drastically, without impacting performance.

== Resource Independence ==

Since virtual servers are only guests on the hardware they are using, they are not aware of the specifics: they do not contain disk configurations, kernels or network configurations.

One key feature of a virtual server is the independence from the actual hardware. Most hardware issues are irrelevant for a virtual server installation.

The main server acts as a host and takes care of all the details. The virtual server is just a client and ignores all the details. As such, the client can be moved to another physical server with very few manipulations.

For example, to move the virtual server from one physical computer to another, it sufficient to do the following:

* shutdown the running server
* copy it over to the other machine
* copy the configuration
* start the virtual server on the new machine

No adjustments to user setup, password database or hardware configuration are required, as long as both machines are binary compatible.

Thus, once you have found that a project is using more resource than expected, you can easily move it to another box without tinkering around in hardware configuration files. A virtual server is just a directory on the filesystem of host system.

== Fail-over Scenarios ==

Pushing the limit a little further, replication technology could be used to keep an up-to-the-minute copy of the filesystem of a running virtual server. This would permit a very fast fail-over if the running server goes offline for whatever reason.

All the known methods to accomplish this, starting with network replication via rsync, or drbd, via network devices, or shared disk arrays, to distributed filesystems, can be utilized to reduce the down-time and improve overall efficiency.

== Experimenting and Upgrading ==

If you intend to upgrade a system to get new features or security updates, you probably first test the new packages on the development machine, before you are ready to update the production server. Having some experience you do it properly:

* Doing a backup of the server
* Perform all the upgrades and install the new applications

Two hours later you realise that something does not work as expected. To make it worse, it works fine on the development machine. We have all experienced this.

Another solution to this problem would be to install the new production server on new hardware, but this is not as easy, as you have to clone the first server (most people are not comfortable doing this) or you do not have the hardware.

Using virtual servers, all this is very easy:

* Stop the virtual server in production
* Make a copy of the virtual server
* Perform the upgrades in the new virtual server

To get back to our example above, two hours later you realise that something does not work as expected and you cannot immediately fix it.

Again, using virtual servers, the (temporary) solution to this problem is very easy:

* Stop the new virtual server and assign it a new IP address
* Start both the old and new virtual server

Now the old one is still online and you can track down the issues on your new virtual server using a different IP address, fix the problem and reassign the old IP address to the new virtual server.

== Distribution Independence ==

People are often talking about their preferred distribution. Should one use Fedora, Debian or something else? Should one give a spin to the latest and greatest distribution just for the sake of it?

With virtual servers, the choice of a distribution is less important. When you select a distribution, you expect it will do the following:

* Good hardware support/detection
* Good package technology/updates
* Good package selection
* Reliable packages

The choice is important because every service running on a box will be using the same distribution. Most distributions out there are good and reliable. Still each one has its peculiarities and probably flaws. For example, one distribution is doing a great job on security but is not delivering the latest and greatest PHP. Now because you have decided to use this distribution for some projects, using virtual servers does not prevent you from using another distribution for other projects or even a second virtual server for existing projects.

== Other considerations ==

* '''Virtual Private Servers are running on the same kernel as the host:''' Unlike other VM solutions, Linux-VServer does not require additional memory or processing power, in fact it may even reduce used memory due to the fact that multiple virtual servres may share the same files.

* '''There are no special daemons running:''' A VPS running crond, sshd, httpd and sendmail uses the same resources as a normal Linux server running these services.

* '''No pre-allocated disk space needed:''' A VPS generally shares the disk space with the host system, so there is no need to pre-allocate disk space for each virtual server to find out later that your disk is full, yet each VPS is using only a tiny portion of their allocated space.

* '''Resource sharing:''' Since virtual servers can share binaries and libraries without interfering, a second VPS generally costs about 40-100MB of disk space only. Most of this space is a copy of the packaging database.

* '''32-/64-bit independence:''' You can easily run a 32-bit distribution inside a VPS on a 64-bit host system, but faster, sometimes a lot.

* '''Admin tools work inside a vserver as usual''': A vserver feels like a real server from within and can be used in the same ways.

== See Also ==

* [[Overview]]

Howto make BSD-style init SysV-compatible

2006-12-11T22:01:25Z

Daniel15: Howto make bsd-style init sysv-compatible moved to Howto make BSD-style init SysV-compatible: Capitalisation

To make archlinux boot nicely, some modifications to the init scripts are needed. 
First create a /etc/init.d dir and add a new file /etc/init.d/rc with content: 

if [ $1 -eq 3 ]; then
echo "entering runlevel 3:multi";
/etc/rc.multi
fi
if [ $1 -eq 6 ]; then
echo "entering runlevel 6:reboot";
/etc/rc.shutdown
fi
if [ $1 -eq 0 ]; then
echo "entering runlevel 0: shutdown";
/etc/rc.shutdown
fi
if [ $1 -eq 4 ]; then
echo "entering runlevel 4";
fi
if [ $1 -eq 5 ]; then
echo "entering runlevel 5";
fi
if [ $1 -eq 1 ]; then
echo "entering runlevel 1:single";
/etc/rc.single
fi
if [ $1 -eq 2 ]; then
echo "entering runlevel 2:multi";
/etc/rc.multi
fi

This script starts the right init-scripts for the runlevels. you now should be able to boot up your archlinux guest system. but there is some more work to get around all these warning and error messages on bootup. 
You need to remove all that has to do with kernel, driver and networking. Edit the /etc/rc.conf file and remove networking and syslog-ng (syslog-ng will not work) from DAEMONS. 
Edit /etc/rc.shutdown and comment out all below and including stat_busy "Saving Random Seed" to # Power off or reboot
 
Have fun with your archlinux guest and feel free to improve the rc script :)

Howto make bsd-style init sysv-compatible

2006-12-11T22:01:25Z

Daniel15: Howto make bsd-style init sysv-compatible moved to Howto make BSD-style init SysV-compatible: Capitalisation

#REDIRECT [[Howto make BSD-style init SysV-compatible]]

Howto make BSD-style init SysV-compatible

2006-12-11T22:00:17Z

Daniel15: Minor edits

Installation on Debian

2006-12-11T04:03:22Z

Daniel15: Minor edit

This guide is written against Debian Etch (4.0). This release includes kernel '''linux-image-vserver-686''', so no manual patching is needed. Hence, Installation on Debian Etch is pretty easy and straightforward.

== Packages installation ==
The packages required by Linux-VServer are:
* '''linux-image-vserver-686''' - This is the actual kernel
* '''util-vserver''' - These are the utilities used to administer the guests
* '''vserver-debiantools''' - These are special Vserver tools for Debian, used to create and duplicate Debian guest systems.
* '''ssh''' - This is probably already installed, but just in case it isn't

All the packages you need can be obtained via
<pre>apt-get install linux-image-vserver-686 util-vserver vserver-debiantools ssh</pre>
so run this as ''root'' and reboot.
To check out wherever everything went fine you may run
<pre>uname -r</pre>
and check that kernel version is something like '''2.6.17-2-vserver-686'''. That's it.
Now let's create a virtual machine.

== Virtual machine creation ==
On a Debian system, creation of guests is done via the <tt>newvserver</tt> command. The syntax for this command is: 
newvserver --vsroot /var/lib/vservers/ --hostname [Hostname] \
--domain [Domain] --ip [IP Address]/[CIDR Range] \
--dist etch --mirror [Debian Mirror] --interface [Net Interface]
''(the backslashes at the end of the lines mean that it continues onto the next line. You may copy it as-is [with the backslashes], or put the whole command on one line [and exclude the backslashes], as is done below)''

The command line arguments are:
* '''vsroot''' - This is where the files for the guests are kept. On a default installation, this will be at /var/lib/vservers. Alternatively, some people create a separate partition for their vservers.
* '''Hostname''' - The hostname of the system (eg. test1)
* '''Domain''' - The domain of the system. This is usually the same as the domain you chose for the host system (eg. dan-network.local. This doesn't need to be real, it's only used internally.)
* '''IP Address'''- The IP address for the guest system (eg. 10.1.1.7)
* '''CIDR Range''' - The CIDR Range for your local network. For a 10.x.x.x network, this is usually /8. For a 172.16.x.x network, this is usually /16. For a 192.168.x.x network, this is usually /24. If your network is subnetted, this will be different. When in doubt, choose /8 :)
* '''Dist''' - The distribution to use. For the purposes of this exercise, we use etch.
* '''Debian Mirror''' - The Debian mirror you use (when in doubt, choose ftp://ftp.debian.org/debian)
* '''Interface''' - Your network interface, if it's not eth0 (eg. eth1).

So, let's make a test server. The settings for our test guest are like so:
* '''Hostname:''' test1
* '''Domain:''' example.com
* '''IP Address:''' 10.1.1.7
* '''CIDR Range:''' /8
* '''Debian Mirror:''' http://ftp.au.debian.org/debian/
* '''Interface:''' eth1

newvserver --vsroot /var/lib/vservers/ --hostname test1 --domain example.com --ip 10.1.1.7/8 --dist etch --mirror http://ftp.au.debian.org/debian/ --interface eth1

== Virtual machine operation ==
To start VM just created, run
<pre>vserver test1 start</pre>
To get into it, type
<pre>vserver test1 enter</pre>
Again, study man for more information.

== References ==
* Linux-VServer HOWTO by Daniel15: http://howtoforge.com/linux_vserver_debian_etch

Installation on Debian

2006-12-11T03:55:07Z

Daniel15: Expanded

This guide is written against Debian Etch (4.0). This release includes kernel '''linux-image-vserver-686''', so no manual patching is needed. Hence, Installation on Debian Etch is pretty easy and straightforward.

== Packages installation ==
The packages required by Linux-VServer are:
* '''linux-image-vserver-686''' - This is the actual kernel
* '''util-vserver''' - These are the utilities used to administer the guests
* '''vserver-debiantools''' - These are special Vserver tools for Debian, used to create and duplicate Debian guest systems.
* '''ssh''' - This is probably already installed, but just in case it isn't

All the packages you need can be obtained via
<pre>apt-get install linux-image-vserver-686 util-vserver vserver-debiantools ssh</pre>
so run this as ''root'' and reboot.
To check out wherever everything went fine you may run
<pre>uname -r</pre>
and check that kernel version is something like '''2.6.17-2-vserver-686'''. That's it.
Now let's create a virtual machine.

== Virtual machine creation ==
On a Debian system, creation of guests is done via the <tt>newvserver</tt> command. The syntax for this command is: 
newvserver --vsroot /var/lib/vservers/ --hostname [Hostname] \
--domain [Domain] --ip [IP Address]/[CIDR Range] \
--dist etch --mirror [Debian Mirror] --interface [Net Interface]
''(the backslashes at the end of the lines mean that it continues onto the next line. You may copy it as-is [with the backslashes], or put the whole command on one line [and exclude the backslashes], as I do below)''

The command line arguments are:
* '''vsroot''' - This is where the files for the guests are kept. On a default installation, this will be at /var/lib/vservers. Alternatively, some people create a separate partition for their vservers.
* '''Hostname''' - The hostname of the system (eg. test1)
* '''Domain''' - The domain of the system. This is usually the same as the domain you chose for the host system (eg. dan-network.local. This doesn't need to be real, it's only used internally.)
* '''IP Address'''- The IP address for the guest system (eg. 10.1.1.7)
* '''CIDR Range''' - The CIDR Range for your local network. For a 10.x.x.x network, this is usually /8. For a 172.16.x.x network, this is usually /16. For a 192.168.x.x network, this is usually /24. If your network is subnetted, this will be different. When in doubt, choose /8 :)
* '''Dist''' - The distribution to use. For the purposes of this exercise, we use etch.
* '''Debian Mirror''' - The Debian mirror you use (when in doubt, choose ftp://ftp.debian.org/debian)
* '''Interface''' - Your network interface, if it's not eth0 (eg. eth1).

So, let's make a test server. The settings for our test guest are like so:
* '''Hostname:''' test1
* '''Domain:''' example.com
* '''IP Address:''' 10.1.1.7
* '''CIDR Range:''' /8
* '''Debian Mirror:''' http://ftp.au.debian.org/debian/
* '''Interface:''' eth1

newvserver --vsroot /var/lib/vservers/ --hostname test1 --domain example.com --ip 10.1.1.7/8 --dist etch --mirror http://ftp.au.debian.org/debian/ --interface eth1

== Virtual machine operation ==
To start VM just created, run
<pre>vserver test1 start</pre>
To get into it, type
<pre>vserver test1 enter</pre>
Again, study man for more information.

== References ==
* Linux-VServer HOWTO by Daniel15: http://howtoforge.com/linux_vserver_debian_etch

User talk:Powerfox

2006-12-10T12:14:02Z

Daniel15: Notice about spam protection

Wow, nice work with the spam protection... Keep it up :-) --[[User:Daniel15|Daniel15]] <big>(</big>[[User talk:Daniel15|Talk]]/[[Special:Contributions/Daniel15|Contribs]]<big>)</big> 13:14, 10 December 2006 (CET)

Wiki Team

2006-12-10T12:05:45Z

Daniel15: Protected "Wiki Team": Frequent spam target; only registered users can edit [edit=autoconfirmed:move=autoconfirmed]

Because anybody with a user account can edit the wiki, the wiki team is quite a loose group of individuals. There are however a few core members that help to contribute and maintain the wiki on a near daily basis.

If you are interested in regular contribution to the wiki, you should consider signing up for the mailing list or join our IRC channel (see [[Communicate]]).

== Start Here ==

The first thing is to learn some basics on how to edit a page. Once you have figured out the basics, you can look at the Maintenance Tasks below as they include lots of pages that need attention, every little bit helps.

* [http://en.wikipedia.org/wiki/Wiki What is a wiki?]
* [http://meta.wikimedia.org/w/index.php?title=Help:Editing Editing Help on MetaWiki]

To just play with editing a page, use your own user page or the [[Sandbox]].

== Tasks ==

<div style="margin: 2em auto 2em auto; padding: 10px; background-color: #F9ECCD; border: 1px solid #004433; text-align: center;">
[[Image:Icon-Caution.png|left]]
We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet.<br\>
See [[Wiki Relocation]] to learn which pages still need attention.

'''Your are welcome to help the Wiki Team migrating old pages or create new pages with similar content.'''
</div>

Generic wiki maintenance tasks:

* [[Special:Wantedpages|Wanted Pages]] — These are pages that don't exist, but there are two or more links to them.
* [[Special:DoubleRedirects|Double Redirects]] — Redirects that redirect to a redirect
* [[Special:BrokenRedirects|Broken Redirects]] — Redirects that redirect to a non-existing page
* [[Special:Unusedcategories|Unused Categories]] — categories with no pages in it
* [[Special:Uncategorizedpages|Uncategorized Pages]] — pages that are not in any category

== Core Members ==

* [[User:Hollow|Hollow]]
* [[User:Derjohn|Derjohn]]

Wiki Team

2006-12-10T12:05:22Z

Daniel15: rv spam

Wiki Team

2006-12-05T23:36:16Z

Daniel15: rv spam

Wiki Team

2006-11-30T07:48:48Z

Daniel15: Now THAT was a lot of spam :|

User talk:Hollow

2006-10-20T11:22:13Z

Daniel15:

Haha, I guess that I'm not the only one deleting spam from this Wiki anymore :P --[[User:Daniel15|Daniel15]] 13:22, 20 October 2006 (CEST)

User:Daniel15

2006-09-29T16:22:10Z

Daniel15:

Hi. I'm Daniel15 :)

I guess I'm also the "official" spam cleaner :P