Linux-VServer - User contributions [en]

Template:ExperimentalPatchTableMatrix

2009-12-01T07:02:05Z

Ktwilight:

{| class="wikitable" style="margin: 2em auto 2em auto;"
! Linux-VServer branch
Linux kernel
!class="devel"| 2.3
Experimental
! 2.3 + grsecurity
Experimental
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.31.6.tar.bz2 2.6.31.6]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.31.6-vs2.3.0.36.26.diff vs2.3.0.36.26]
| [http://people.linux-vserver.org/~harry/patch-2.6.31.6-vs2.3.0.36.24-grsec2.1.14-20091116.diff vs2.3.0.36.24-grsec2.1.14-20091116]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.30.6.tar.bz2 2.6.30.6]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.30.6-vs2.3.0.36.14-pre8.diff vs2.3.0.36.14-pre8]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.29.6.tar.bz2 2.6.29.6]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.29.6-vs2.3.0.36.14.diff vs2.3.0.36.14]
| [http://people.linux-vserver.org/~harry/patch-2.6.29.6-vs2.3.0.36.14-grsec2.1.14-20090709.diff.gz vs2.3.0.36.14-grsec2.1.14-20090709]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.10.tar.bz2 2.6.28.10]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28.10-vs2.3.0.36.11.diff vs2.3.0.36.11]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.39.tar.bz2 2.6.27.39]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.39-vs2.3.0.36.8.diff vs2.3.0.36.8]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.15.tar.bz2 2.6.27.15]
|
| [http://people.linux-vserver.org/~harry/patch-2.6.27.15-vs2.3.0.36.4-grsec2.1.12-20090210.diff vs2.3.0.36.4-grsec2.1.12-20090210]
|}

Installation on Debian

2009-09-01T20:01:28Z

Ktwilight: updated util-vserver by source

This guide is written against Debian Etch (4.0) and works on Lenny (5.0) as well. Both releases include kernel '''linux-image-vserver-686''', so no manual patching is needed. Hence, Installation on Debian Etch/Lenny is pretty easy and straightforward.

If you need to compile your own kernel, you need to apply the vserver-version.patch. [http://www.kwu.hu/vserver.txt Details at 2007/May/04]

== Packages installation ==
The packages required by Linux-VServer are:
* '''linux-image-vserver-686''' - This is the current kernel, use '''linux-image-vserver-amd64''' on 64-bit systems, you can still create 32-bit guests
* '''util-vserver''' - These are the utilities used to administer the guests
* '''ssh''' - This is probably already installed, but just in case it isn't

All the packages you need can be obtained via
<pre>aptitude install linux-image-vserver-686 util-vserver ssh</pre>
so run this as ''root'' and reboot.
To check out wherever everything went fine you may run
<pre>uname -r</pre>
and check that kernel version contains '''vserver''', e.g. '''2.6.18-4-vserver-686'''. That's it.

Now that the host system is ready, you can proceed with [[Building Guest Systems|building guests]].

=== Install util-vserver by source ===
Occasionally, Debian's util-vserver package can be too old. So, we'll need to compile from [http://people.linux-vserver.org/~dhozac/t/uv-testing/ source].

First, install the required packages for util-vserver to compile.
<pre>apt-get install vlan dietlibc-dev pkg-config libnss3-dev</pre>

Then, we configure util-vserver
<pre>./configure --prefix=/usr --enable-release --mandir=/usr/share/man \
--infodir=/usr/share/info --sysconfdir=/etc --enable-dietlibc \
--localstatedir=/var --with-vrootdir=/home</pre>
Note: You should change ''--with-vrootdir'' accordingly

Finally, we run make to finalise the installation
<pre>make && make install debian && make install install-distribution</pre>

Running ''vserver-info'' will show you that the proper util-vserver is installed. :)

Debian likes to be funny, so we need to enable the following,
* echo /usr/lib/util-vserver/vshelper >| /proc/sys/kernel/vshelper
* echo kernel.vshelper = /usr/lib/util-vserver/vshelper >> /etc/sysctl.conf
* update-rc.d vprocunhide defaults
* update-rc.d vservers-default defaults

== Versions ==
Debian already contains vservers kernels, so no manual patching and compiling is needed.
{|class="wikitablenowrap"
!Debian release
!Kernel version
!VServer version
|-
| Etch
| 2.6.18+6
| 2.0.2.2-rc9
|-
| Lenny
| 2.6.26+17
| 2.3.0.35
|-
|}

== Issues with the current 2.6.26 Kernel ==

=== Hard CPU scheduling ===

This will not work in the Debian 'Lenny' Kernel, the patch used simply does not contain any of this functionality.

=== Problems due to Xattrs ===

There are two sets of issues within the Lenny kernel caused by the change in value of the Xattrs (extended attributes) applied to file in Vserver setups. The patch used in Debian Lenny uses Xattr flags which are set in positions which differ from the flags set by Debian kernels as well as most of the mainline Vserver patches. This result is that Xattrs of files in a non lenny system appear to have completely different flags in Lenny and vice versa. Since these flags are crucial to vserver hashification and chroot security, they can have devastating effects on Vserver guests and on host system security. If you have recently moved to or away from the stock Lenny Vserver kernel, have look at the symptoms below to see if any match your experiences, and apply the fixes/use another kernel as you see fit.

As of writing these issue has not been corrected within the Debian archive. These fixes must be applied whenever moving vserver guest '''from''' or '''to''' the Debian 'Lenny's vserver kernel. For more details and a more concise explanation see [http://irc.13thfloor.at/LOG/2009-05/LOG_2009-05-12.txt Bertls IRC explanation ].

==== Chroot Security Problems ====

Linux-Vserver uses file Xattrs to protect guest superusers from being able to view files above their root, preventing access to host file. This creates issues for anyone who:

* has created a guest with a Debian 2.6.26-*-vserver kernel and wishes to use it with another kernel.
* has created a guest with a different kernel and wishes to use it on a Debian 2.6.26-*-vserver kernel based host.

In effect, the barrier normally in place for guest servers is not recognised by the kernel (the chroot problem) in the situation above and/or immutable links will not function correctly (the unification problem)failing to break when overwritten) in a unified guest setup. Symptoms suffered may include:

* the possibility of vserver guest processes escaping their chroots and accessing other parts of the filesystem
* guest not starting

To fix the barrier flags for a current kernel, see [[Secure_chroot_Barrier#Solution:_Secure_Barrier | these instructions]]. Note that on some setups a barrier flags will appear on all directories under the guest hierarchy, and need to be unset in order to allow the servers to run. Use showattr to reveal the state of play for your guests and fix appropriately.

==== Unification Problems ====

There is a discrepancy between the immutable-unlink flag used for file unification, the process used in vhashify. This creates considerable issues for anyone who:

* has unified guests with a Debian 2.6.26-*-vserver kernel and wishes to use them with another kernel.
* has unified guests with a different kernel and wishes to then it on a Debian 2.6.26-*-vserver kernel based host.

Symptoms suffered may include:

* file that cannot be deleted
* any process involving the writing of files in guests not working
* files not being unlinked on write

To fix the problem each file must be unlinked then the unification re-applied, or one could try this script submitted to [http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508523 bugs.debian.org].

== References ==
* Linux-VServer HOWTO by Daniel15: http://howtoforge.com/linux_vserver_debian_etch

Template:ExperimentalPatchTableMatrix

2009-09-01T16:27:53Z

Ktwilight:

{| class="wikitable" style="margin: 2em auto 2em auto;"
! Linux-VServer branch
Linux kernel
!class="devel"| 2.3
Experimental
! 2.3 + grsecurity
Experimental
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.30.5.tar.bz2 2.6.30.5]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.30.5-vs2.3.0.36.14-pre7.diff vs2.3.0.36.14-pre7]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.29.6.tar.bz2 2.6.29.6]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.29.6-vs2.3.0.36.14.diff vs2.3.0.36.14]
| [http://harry.enzoverder.be/patch-2.6.29.6-vs2.3.0.36.14-grsec2.1.14-20090709.diff.gz vs2.3.0.36.14-grsec2.1.14]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.10.tar.bz2 2.6.28.10]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28.10-vs2.3.0.36.11.diff vs2.3.0.36.11]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.7.tar.bz2 2.6.28.7]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28.7-vs2.3.0.36.8.diff vs2.3.0.36.8]
| [http://harry.enzoverder.be/patch-2.6.28.7-vs2.3.0.36.7-grsec2.1.13-20090303.diff vs2.3.0.36.7-grsec2.1.13]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.31.tar.bz2 2.6.27.31]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.31-vs2.3.0.36.6.diff vs2.3.0.36.6]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.15.tar.bz2 2.6.27.15]
|
| [http://harry.enzoverder.be/patch-2.6.27.15-vs2.3.0.36.4-grsec2.1.12-20090210.diff vs2.3.0.36.4-grsec2.1.12]
|}

Template:ExperimentalPatchTableMatrix

2009-08-19T11:18:56Z

Ktwilight:

{| class="wikitable" style="margin: 2em auto 2em auto;"
! Linux-VServer branch
Linux kernel
!class="devel"| 2.3
Experimental
! 2.3 + grsecurity
Experimental
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.30.5.tar.bz2 2.6.30.5]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.30.5-vs2.3.0.36.14-pre5.diff vs2.3.0.36.14-pre5]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.29.6.tar.bz2 2.6.29.6]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.29.6-vs2.3.0.36.14.diff vs2.3.0.36.14]
| [http://harry.enzoverder.be/patch-2.6.29.6-vs2.3.0.36.14-grsec2.1.14-20090709.diff.gz vs2.3.0.36.14-grsec2.1.14]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.10.tar.bz2 2.6.28.10]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28.10-vs2.3.0.36.11.diff vs2.3.0.36.11]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.7.tar.bz2 2.6.28.7]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28.7-vs2.3.0.36.8.diff vs2.3.0.36.8]
| [http://harry.enzoverder.be/patch-2.6.28.7-vs2.3.0.36.7-grsec2.1.13-20090303.diff vs2.3.0.36.7-grsec2.1.13]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.31.tar.bz2 2.6.27.31]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.31-vs2.3.0.36.6.diff vs2.3.0.36.6]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.15.tar.bz2 2.6.27.15]
|
| [http://harry.enzoverder.be/patch-2.6.27.15-vs2.3.0.36.4-grsec2.1.12-20090210.diff vs2.3.0.36.4-grsec2.1.12]
|}

Template:ExperimentalPatchTableMatrix

2009-06-16T19:06:16Z

Ktwilight:

{| class="wikitable" style="margin: 2em auto 2em auto;"
! Linux-VServer branch
Linux kernel
!class="devel"| 2.3
Experimental
! 2.3 + grsecurity
Experimental
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.29.4.tar.bz2 2.6.29.4]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.29.4-vs2.3.0.36.14.diff vs2.3.0.36.14]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.29.2.tar.bz2 2.6.29.2]
|
| [http://people.linux-vserver.org/~harry/patch-2.6.29.2-vs2.3.0.36.12-grsec2.1.14-20090513.diff vs2.3.0.36.12-grsec2.1.14]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.10.tar.bz2 2.6.28.10]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28.10-vs2.3.0.36.11.diff vs2.3.0.36.11]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.7.tar.bz2 2.6.28.7]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28.7-vs2.3.0.36.8.diff vs2.3.0.36.8]
| [http://harry.enzoverder.be/patch-2.6.28.7-vs2.3.0.36.7-grsec2.1.13-20090303.diff vs2.3.0.36.7-grsec2.1.13]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.25.tar.bz2 2.6.27.25]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.25-vs2.3.0.36.6.diff vs2.3.0.36.6]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.15.tar.bz2 2.6.27.15]
|
| [http://harry.enzoverder.be/patch-2.6.27.15-vs2.3.0.36.4-grsec2.1.12-20090210.diff vs2.3.0.36.4-grsec2.1.12]
|}

Template:ExperimentalPatchTableMatrix

2009-05-18T14:09:52Z

Ktwilight:

{| class="wikitable" style="margin: 2em auto 2em auto;"
! Linux-VServer branch
Linux kernel
!class="devel"| 2.3
Experimental
! 2.3 + grsecurity
Experimental
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.29.2.tar.bz2 2.6.29.2]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.29.2-vs2.3.0.36.10.diff vs2.3.0.36.10]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.10.tar.bz2 2.6.28.10]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28.10-vs2.3.0.36.11.diff vs2.3.0.36.11]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.7.tar.bz2 2.6.28.7]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28.7-vs2.3.0.36.8.diff vs2.3.0.36.8]
| [http://harry.enzoverder.be/patch-2.6.28.7-vs2.3.0.36.7-grsec2.1.13-20090303.diff vs2.3.0.36.7-grsec2.1.13]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.23.tar.bz2 2.6.27.23]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.23-vs2.3.0.36.5.diff vs2.3.0.36.5]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.15.tar.bz2 2.6.27.15]
|
| [http://harry.enzoverder.be/patch-2.6.27.15-vs2.3.0.36.4-grsec2.1.12-20090210.diff vs2.3.0.36.4-grsec2.1.12-20090210]
|}

Template:ExperimentalPatchTableMatrix

2009-05-15T15:21:35Z

Ktwilight:

{| class="wikitable" style="margin: 2em auto 2em auto;"
! Linux-VServer branch
Linux kernel
!class="devel"| 2.3
Experimental
! 2.3 + grsecurity
Experimental
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.29.2.tar.bz2 2.6.29.2]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.29.2-vs2.3.0.36.10.diff vs2.3.0.36.10]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.10.tar.bz2 2.6.28.10]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28.10-vs2.3.0.36.11.diff vs2.3.0.36.11]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.7.tar.bz2 2.6.28.7]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28.7-vs2.3.0.36.8.diff vs2.3.0.36.8]
| [http://harry.enzoverder.be/patch-2.6.28.7-vs2.3.0.36.7-grsec2.1.13-20090303.diff vs2.3.0.36.7-grsec2.1.13]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.21.tar.bz2 2.6.27.21]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.21-vs2.3.0.36.4.diff vs2.3.0.36.4]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.15.tar.bz2 2.6.27.15]
|
| [http://harry.enzoverder.be/patch-2.6.27.15-vs2.3.0.36.4-grsec2.1.12-20090210.diff vs2.3.0.36.4-grsec2.1.12-20090210]
|}

Installation on Debian

2009-05-15T15:18:46Z

Ktwilight:

This guide is written against Debian Etch (4.0) and works on Lenny (5.0) as well. Both releases include kernel '''linux-image-vserver-686''', so no manual patching is needed. Hence, Installation on Debian Etch/Lenny is pretty easy and straightforward.

If you need to compile your own kernel, you need to apply the vserver-version.patch. [http://www.kwu.hu/blog.php Details at 2007/Apr/25]

== Packages installation ==
The packages required by Linux-VServer are:
* '''linux-image-vserver-686''' - This is the current kernel, use '''linux-image-vserver-amd64''' on 64-bit systems, you can still create 32-bit guests
* '''util-vserver''' - These are the utilities used to administer the guests
* '''ssh''' - This is probably already installed, but just in case it isn't

All the packages you need can be obtained via
<pre>aptitude install linux-image-vserver-686 util-vserver ssh</pre>
so run this as ''root'' and reboot.
To check out wherever everything went fine you may run
<pre>uname -r</pre>
and check that kernel version contains '''vserver''', e.g. '''2.6.18-4-vserver-686'''. That's it.

Now that the host system is ready, you can proceed with [[Building Guest Systems|building guests]].

=== Install util-vserver by source ===
Occasionally, Debian's util-vserver package can be too old. So, we'll need to compile from [http://people.linux-vserver.org/~dhozac/t/uv-testing/ source].

First, install the required packages for util-vserver to compile.
<pre>apt-get install vlan dietlibc-dev pkg-config libnss3-dev</pre>

Then, we configure util-vserver
<pre>./configure --prefix=/usr --enable-release --mandir=/usr/share/man \
--infodir=/usr/share/info --sysconfdir=/etc --enable-dietlibc \
--localstatedir=/var --with-vrootdir=/home</pre>
Note: You should change ''--with-vrootdir'' accordingly

Finally, we run make to finalise the installation
<pre>make && make install install-distribution</pre>

Running ''vserver-info'' will show you that the proper util-vserver is installed. :)

== Versions ==
Debian already contains vservers kernels, so no manual patching and compiling is needed.
{|class="wikitablenowrap"
!Debian release
!Kernel version
!VServer version
|-
| Etch
| 2.6.18+6
| 2.0.2.2-rc9
|-
| Lenny
| 2.6.26+17
| 2.3.0.35
|-
|}

== Issues with the current 2.6.26 Kernel ==

=== Hard CPU scheduling ===

This will not work in the Debian 'Lenny' Kernel.

=== Unification and Chroot Security Problems ===

Linux-Vserver uses file xattrs to protect guest superusers from being able to view files above their root, preventing access to host file. The patch used in Debian Lenny contains a different position of the flag which controls this barrier to escaping a guests chrooted enviroment. There is also a discrepancy between the immutable-unlink flag used for file unification. This creates a considerable security issues for anyone who:

* has created a guest with a Debian 2.6.26-*-vserver kernel and wishes to use it with another kernel.
* has created a guest with a different kernel and wishes to use it on a Debian 2.6.26-*-vserver kernel based host.
* has unified guests with a Debian 2.6.26-*-vserver kernel and wishes to use them with another kernel.
* has unified guests with a different kernel and wishes to then it on a Debian 2.6.26-*-vserver kernel based host.

In effect, the barrier normally in place for guest servers is not recognised by the kernel in the situation above and/or immutable links will not function correctly (failinf to break when overwritten) in a unified guest setup.

==== fixing the problem ====

As of writing this issue has not been corrected within the Debian archive. To fix the barrier flags for a current kernel, see [[Secure_chroot_Barrier#Solution:_Secure_Barrier | these instructions]]. In order to fix the problem in unified environment each file on each server must be unlinked then the unification re-applied. These fixes must be applied whenever moving vserver guest '''from''' or '''to''' the Debian 'Lenny's vserver kernel.

For more details and a more concise explanation see [http://irc.13thfloor.at/LOG/2009-05/LOG_2009-05-12.txt Bertls IRC explanation ].

A script for handling the unification problem with having to re-unify is given at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508523

== References ==
* Linux-VServer HOWTO by Daniel15: http://howtoforge.com/linux_vserver_debian_etch

Installation on Debian

2009-05-15T15:18:16Z

Ktwilight: added util-vserver by source

This guide is written against Debian Etch (4.0) and works on Lenny (5.0) as well. Both releases include kernel '''linux-image-vserver-686''', so no manual patching is needed. Hence, Installation on Debian Etch/Lenny is pretty easy and straightforward.

If you need to compile your own kernel, you need to apply the vserver-version.patch. [http://www.kwu.hu/blog.php Details at 2007/Apr/25]

== Packages installation ==
The packages required by Linux-VServer are:
* '''linux-image-vserver-686''' - This is the current kernel, use '''linux-image-vserver-amd64''' on 64-bit systems, you can still create 32-bit guests
* '''util-vserver''' - These are the utilities used to administer the guests
* '''ssh''' - This is probably already installed, but just in case it isn't

All the packages you need can be obtained via
<pre>aptitude install linux-image-vserver-686 util-vserver ssh</pre>
so run this as ''root'' and reboot.
To check out wherever everything went fine you may run
<pre>uname -r</pre>
and check that kernel version contains '''vserver''', e.g. '''2.6.18-4-vserver-686'''. That's it.

Now that the host system is ready, you can proceed with [[Building Guest Systems|building guests]].

=== Install util-vserver by source ===
Occasionally, Debian's util-vserver package can be too old. So, we'll need to compile from [[http://people.linux-vserver.org/~dhozac/t/uv-testing/ source]].

First, install the required packages for util-vserver to compile.
<pre>apt-get install vlan dietlibc-dev pkg-config libnss3-dev</pre>

Then, we configure util-vserver
<pre>./configure --prefix=/usr --enable-release --mandir=/usr/share/man \
--infodir=/usr/share/info --sysconfdir=/etc --enable-dietlibc \
--localstatedir=/var --with-vrootdir=/home</pre>
Note: You should change ''--with-vrootdir'' accordingly

Finally, we run make to finalise the installation
<pre>make && make install install-distribution</pre>

Running ''vserver-info'' will show you that the proper util-vserver is installed. :)

== Versions ==
Debian already contains vservers kernels, so no manual patching and compiling is needed.
{|class="wikitablenowrap"
!Debian release
!Kernel version
!VServer version
|-
| Etch
| 2.6.18+6
| 2.0.2.2-rc9
|-
| Lenny
| 2.6.26+17
| 2.3.0.35
|-
|}

== Issues with the current 2.6.26 Kernel ==

=== Hard CPU scheduling ===

This will not work in the Debian 'Lenny' Kernel.

=== Unification and Chroot Security Problems ===

Linux-Vserver uses file xattrs to protect guest superusers from being able to view files above their root, preventing access to host file. The patch used in Debian Lenny contains a different position of the flag which controls this barrier to escaping a guests chrooted enviroment. There is also a discrepancy between the immutable-unlink flag used for file unification. This creates a considerable security issues for anyone who:

* has created a guest with a Debian 2.6.26-*-vserver kernel and wishes to use it with another kernel.
* has created a guest with a different kernel and wishes to use it on a Debian 2.6.26-*-vserver kernel based host.
* has unified guests with a Debian 2.6.26-*-vserver kernel and wishes to use them with another kernel.
* has unified guests with a different kernel and wishes to then it on a Debian 2.6.26-*-vserver kernel based host.

In effect, the barrier normally in place for guest servers is not recognised by the kernel in the situation above and/or immutable links will not function correctly (failinf to break when overwritten) in a unified guest setup.

==== fixing the problem ====

As of writing this issue has not been corrected within the Debian archive. To fix the barrier flags for a current kernel, see [[Secure_chroot_Barrier#Solution:_Secure_Barrier | these instructions]]. In order to fix the problem in unified environment each file on each server must be unlinked then the unification re-applied. These fixes must be applied whenever moving vserver guest '''from''' or '''to''' the Debian 'Lenny's vserver kernel.

For more details and a more concise explanation see [http://irc.13thfloor.at/LOG/2009-05/LOG_2009-05-12.txt Bertls IRC explanation ].

A script for handling the unification problem with having to re-unify is given at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508523

== References ==
* Linux-VServer HOWTO by Daniel15: http://howtoforge.com/linux_vserver_debian_etch

Template:ExperimentalPatchTableMatrix

2009-04-10T15:11:54Z

Ktwilight:

{| class="wikitable" style="margin: 2em auto 2em auto;"
! Linux-VServer branch
Linux kernel
!class="devel"| 2.3
Experimental
! 2.3 + grsecurity
Experimental
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.29.tar.bz2 2.6.29]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.29-vs2.3.0.36.9-pre4.diff vs2.3.0.36.9-pre4]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.9.tar.bz2 2.6.28.9]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28.9-vs2.3.0.36.10.diff vs2.3.0.36.10]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.7.tar.bz2 2.6.28.7]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28.7-vs2.3.0.36.8.diff vs2.3.0.36.8]
| [http://harry.enzoverder.be/patch-2.6.28.7-vs2.3.0.36.7-grsec2.1.13-20090303.diff vs2.3.0.36.7-grsec2.1.13]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.21.tar.bz2 2.6.27.21]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.21-vs2.3.0.36.4.diff vs2.3.0.36.4]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.15.tar.bz2 2.6.27.15]
|
| [http://harry.enzoverder.be/patch-2.6.27.15-vs2.3.0.36.4-grsec2.1.12-20090210.diff vs2.3.0.36.4-grsec2.1.12-20090210]
|}

Template:ExperimentalPatchTableMatrix

2009-03-30T14:18:57Z

Ktwilight:

{| class="wikitable" style="margin: 2em auto 2em auto;"
! Linux-VServer branch
Linux kernel
!class="devel"| 2.3
Experimental
! 2.3 + grsecurity
Experimental
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.29.tar.bz2 2.6.29]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.29-vs2.3.0.36.9-pre2.diff vs2.3.0.36.9-pre2]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.8.tar.bz2 2.6.28.8]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28.8-vs2.3.0.36.9.diff vs2.3.0.36.9]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.7.tar.bz2 2.6.28.7]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28.7-vs2.3.0.36.8.diff vs2.3.0.36.8]
| [http://harry.enzoverder.be/patch-2.6.28.7-vs2.3.0.36.7-grsec2.1.13-20090303.diff vs2.3.0.36.7-grsec2.1.13]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.21.tar.bz2 2.6.27.21]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.21-vs2.3.0.36.4.diff vs2.3.0.36.4]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.15.tar.bz2 2.6.27.15]
|
| [http://harry.enzoverder.be/patch-2.6.27.15-vs2.3.0.36.4-grsec2.1.12-20090210.diff vs2.3.0.36.4-grsec2.1.12-20090210]
|}

Template:ExperimentalPatchTableMatrix

2009-03-30T14:17:50Z

Ktwilight:

{| class="wikitable" style="margin: 2em auto 2em auto;"
! Linux-VServer branch
Linux kernel
!class="devel"| 2.3
Experimental
! 2.3 + grsecurity
Experimental
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.29.tar.bz2 2.6.29]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.29-vs2.3.0.36.9-pre2.diff vs2.3.0.36.9-pre2]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.8.tar.bz2 2.6.28.8]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28.8-vs2.3.0.36.9.diff vs2.3.0.36.9]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.7.tar.bz2 2.6.28.7]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28.7-vs2.3.0.36.8.diff vs2.3.0.36.8]
| [http://harry.enzoverder.be/patch-2.6.28.7-vs2.3.0.36.7-grsec2.1.13-20090303.diff vs2.3.0.36.7-grsec2.1.13]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.21.tar.bz2 2.6.27.21]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.21-vs2.3.0.36.4.diff vs2.3.0.36.4]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.19.tar.bz2 2.6.27.19]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.19-vs2.3.0.36.4.diff vs2.3.0.36.4]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.15.tar.bz2 2.6.27.15]
|
| [http://harry.enzoverder.be/patch-2.6.27.15-vs2.3.0.36.4-grsec2.1.12-20090210.diff vs2.3.0.36.4-grsec2.1.12-20090210]
|}

Template:ExperimentalPatchTableMatrix

2009-03-18T11:15:05Z

Ktwilight:

{| class="wikitable" style="margin: 2em auto 2em auto;"
! Linux-VServer branch
Linux kernel
!class="devel"| 2.3
Experimental
! 2.3 + grsecurity
Experimental
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.7.tar.bz2 2.6.28.7]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28.7-vs2.3.0.36.8.diff vs2.3.0.36.8]
| [http://harry.enzoverder.be/patch-2.6.28.7-vs2.3.0.36.7-grsec2.1.13-20090303.diff vs2.3.0.36.7-grsec2.1.13]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.19.tar.bz2 2.6.27.19]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.19-vs2.3.0.36.4.diff vs2.3.0.36.4]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.15.tar.bz2 2.6.27.15]
|
| [http://harry.enzoverder.be/patch-2.6.27.15-vs2.3.0.36.4-grsec2.1.12-20090210.diff vs2.3.0.36.4-grsec2.1.12-20090210]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.10.tar.bz2 2.6.27.10]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.10-vs2.3.0.36.4.diff vs2.3.0.36.4]
| [http://harry.enzoverder.be/patch-2.6.27.10-vs2.3.0.36.4-grsec2.1.12-20090107.diff vs2.3.0.36.4-grsec2.1.12-20090107]
|}

Template:ExperimentalPatchTableMatrix

2009-02-25T09:35:20Z

Ktwilight:

Template:ExperimentalPatchTableMatrix

2009-02-13T20:33:16Z

Ktwilight:

Template:ExperimentalPatchTableMatrix

2009-02-13T20:32:50Z

Ktwilight:

Template:ExperimentalPatchTableMatrix

2009-02-09T15:25:19Z

Ktwilight:

Template:ExperimentalPatchTableMatrix

2009-02-05T22:45:12Z

Ktwilight:

Template:ExperimentalPatchTableMatrix

2009-02-04T21:42:22Z

Ktwilight:

Template:ExperimentalPatchTableMatrix

2009-02-04T21:33:57Z

Ktwilight:

{| class="wikitable" style="margin: 2em auto 2em auto;"
! Linux-VServer branch
Linux kernel
!class="devel"| 2.3
Experimental
! 2.3 + grsecurity
Experimental
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.14.tar.bz2 2.6.27.14]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.14-vs2.3.0.36.4.diff vs2.3.0.36.4]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.2.tar.bz2 2.6.28.2]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28.2-vs2.3.0.36.4.diff vs2.3.0.36.4]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.13.tar.bz2 2.6.27.13]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.13-vs2.3.0.36.4.diff vs2.3.0.36.4]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.1.tar.bz2 2.6.28.1]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28.1-vs2.3.0.36.4.diff vs2.3.0.36.4]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.12.tar.bz2 2.6.27.12]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.12-vs2.3.0.36.4.diff vs2.3.0.36.4]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.10.tar.bz2 2.6.27.10]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.10-vs2.3.0.36.4.diff vs2.3.0.36.4]
| [http://harry.enzoverder.be/patch-2.6.27.10-vs2.3.0.36.4-grsec2.1.12-20090107.diff vs2.3.0.36.4-grsec2.1.12-20090107]
|}

Template:ExperimentalPatchTableMatrix

2009-02-04T21:33:13Z

Ktwilight:

{| class="wikitable" style="margin: 2em auto 2em auto;"
! Linux-VServer branch
Linux kernel
!class="devel"| 2.3
Experimental
! 2.3 + grsecurity
Experimental
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.14.tar.bz2 2.6.27.14]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.14-vs2.3.0.36.4.diff vs2.3.0.36.4]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.2.tar.bz2 2.6.28.2]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28.2-vs2.3.0.36.4.diff vs2.3.0.36.4]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.13.tar.bz2 2.6.27.13]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.13-vs2.3.0.36.4.diff vs2.3.0.36.4]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.1.tar.bz2 2.6.28.1]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28.1-vs2.3.0.36.4.diff vs2.3.0.36.4]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.12.tar.bz2 2.6.27.12]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.12-vs2.3.0.36.4.diff vs2.3.0.36.4]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.10.tar.bz2 2.6.27.10]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.10-vs2.3.0.36.4.diff vs2.3.0.36.4]
| [http://harry.enzoverder.be/patch-2.6.27.10-vs2.3.0.36.4-grsec2.1.12-20090107.diff vs2.3.0.36.4-grsec2.1.12-20090107]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.26.6.tar.bz2 2.6.26.6]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.26.6-vs2.3.0.35.6.diff vs2.3.0.35.6]
|
|}

Template:ExperimentalPatchTableMatrix

2009-01-29T10:48:36Z

Ktwilight:

{| class="wikitable" style="margin: 2em auto 2em auto;"
! Linux-VServer branch
Linux kernel
!class="devel"| 2.3
Experimental
! 2.3 + grsecurity
Experimental
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.2.tar.bz2 2.6.28.2]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28.2-vs2.3.0.36.4.diff vs2.3.0.36.4]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.13.tar.bz2 2.6.27.13]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.13-vs2.3.0.36.4.diff vs2.3.0.36.4]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.1.tar.bz2 2.6.28.1]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28.1-vs2.3.0.36.4.diff vs2.3.0.36.4]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.12.tar.bz2 2.6.27.12]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.12-vs2.3.0.36.4.diff vs2.3.0.36.4]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.10.tar.bz2 2.6.27.10]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.10-vs2.3.0.36.4.diff vs2.3.0.36.4]
| [http://harry.enzoverder.be/patch-2.6.27.10-vs2.3.0.36.4-grsec2.1.12-20090107.diff vs2.3.0.36.4-grsec2.1.12-20090107]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.26.6.tar.bz2 2.6.26.6]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.26.6-vs2.3.0.35.6.diff vs2.3.0.35.6]
|
|}

Template:ExperimentalPatchTableMatrix

2009-01-19T13:47:10Z

Ktwilight:

Template:ExperimentalPatchTableMatrix

2009-01-07T15:22:56Z

Ktwilight:

{| class="wikitable" style="margin: 2em auto 2em auto;"
! Linux-VServer branch
Linux kernel
!class="devel"| 2.3
Experimental
! 2.3 + grsecurity
Experimental
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.tar.bz2 2.6.28]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28-vs2.3.0.36.4.diff vs2.3.0.36.4]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.10.tar.bz2 2.6.27.10]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.10-vs2.3.0.36.4.diff vs2.3.0.36.4]
| [http://harry.enzoverder.be/patch-2.6.27.10-vs2.3.0.36.4-grsec2.1.12-20090107.diff vs2.3.0.36.4-grsec2.1.12-20090107]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.8.tar.bz2 2.6.27.8]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.8-vs2.3.0.36.2.diff vs2.3.0.36.2]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.6.tar.bz2 2.6.27.6]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.6-vs2.3.0.36.2.diff vs2.3.0.36.2]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.26.6.tar.bz2 2.6.26.6]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.26.6-vs2.3.0.35.6.diff vs2.3.0.35.6]
|
|}

Template:ExperimentalPatchTableMatrix

2009-01-07T15:21:00Z

Ktwilight:

{| class="wikitable" style="margin: 2em auto 2em auto;"
! Linux-VServer branch
Linux kernel
!class="devel"| 2.3
Experimental

|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.tar.bz2 2.6.28]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28-vs2.3.0.36.4.diff vs2.3.0.36.4]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.10.tar.bz2 2.6.27.10]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.10-vs2.3.0.36.4.diff vs2.3.0.36.4]
| [http://harry.enzoverder.be/patch-2.6.27.10-vs2.3.0.36.4-grsec2.1.12-20090107.diff vs2.3.0.36.4-grsec2.1.12-20090107]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.8.tar.bz2 2.6.27.8]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.8-vs2.3.0.36.2.diff vs2.3.0.36.2]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.6.tar.bz2 2.6.27.6]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.6-vs2.3.0.36.2.diff vs2.3.0.36.2]
|
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.26.6.tar.bz2 2.6.26.6]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.26.6-vs2.3.0.35.6.diff vs2.3.0.35.6]
|
|}

Template:ExperimentalPatchTableMatrix

2009-01-06T13:09:04Z

Ktwilight:

{| class="wikitable" style="margin: 2em auto 2em auto;"
! Linux-VServer branch
Linux kernel
!class="devel"| 2.3
Experimental

|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.tar.bz2 2.6.28]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28-vs2.3.0.36.4.diff vs2.3.0.36.4]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.10.tar.bz2 2.6.27.10]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.10-vs2.3.0.36.4.diff vs2.3.0.36.4]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.8.tar.bz2 2.6.27.8]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.8-vs2.3.0.36.2.diff vs2.3.0.36.2]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.6.tar.bz2 2.6.27.6]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.6-vs2.3.0.36.2.diff vs2.3.0.36.2]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.26.6.tar.bz2 2.6.26.6]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.26.6-vs2.3.0.35.6.diff vs2.3.0.35.6]
|}

Template:ExperimentalPatchTableMatrix

2008-12-31T13:22:29Z

Ktwilight:

{| class="wikitable" style="margin: 2em auto 2em auto;"
! Linux-VServer branch
Linux kernel
!class="devel"| 2.3
Experimental

|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.tar.bz2 2.6.28]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.28-vs2.3.0.36.2.diff vs2.3.0.36.2]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.10.tar.bz2 2.6.27.10]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.10-vs2.3.0.36.2.diff vs2.3.0.36.2]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.8.tar.bz2 2.6.27.8]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.8-vs2.3.0.36.2.diff vs2.3.0.36.2]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.6.tar.bz2 2.6.27.6]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.6-vs2.3.0.36.2.diff vs2.3.0.36.2]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.26.6.tar.bz2 2.6.26.6]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.26.6-vs2.3.0.35.6.diff vs2.3.0.35.6]
|}

Template:ExperimentalPatchTableMatrix

2008-12-20T21:32:05Z

Ktwilight:

{| class="wikitable" style="margin: 2em auto 2em auto;"
! Linux-VServer branch
Linux kernel
!class="devel"| 2.3
Experimental
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.10.tar.bz2 2.6.27.10]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.10-vs2.3.0.36.2.diff vs2.3.0.36.2]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.8.tar.bz2 2.6.27.8]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.8-vs2.3.0.36.2.diff vs2.3.0.36.2]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.6.tar.bz2 2.6.27.6]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.6-vs2.3.0.36.2.diff vs2.3.0.36.2]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.26.6.tar.bz2 2.6.26.6]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.26.6-vs2.3.0.35.6.diff vs2.3.0.35.6]
|}

Memory Limits

2008-12-18T16:59:18Z

Ktwilight:

== Overview ==
A vserver kernel keeps track many resources used by each guest (context). Some of these relate to memory usage by the guest. You can place limits on these resources to prevent guests from using all the host memory and making the host unusable.

Two resources are particularly important in this regard:

* The '''Resident Set Size''' (<code>rss</code>) is the amount of pages currently present in RAM.
* The '''Address Space''' (<code>as</code>) is the total amount of memory (pages) mapped in all the processes in the context.

Both are measured in '''pages''', which are 4 kB each on Intel machines (i386). So a value of 200000 means a limit of 800,000 kB, a little less than 800 MB.

Each resource has a '''soft''' and a '''hard limit'''.

* If a guest exceeds the <code>rss</code> hard limit, the kernel will invoke the Out-of-Memory (OOM) killer to kill some process in the guest.
* The <code>rss</code> soft limit is shown inside the guest as the maximum available memory. If a guest exceeds the <code>rss</code> soft limit, it will get an extra "bonus" for the OOM killer (proportional to the oversize).
* If a guest exceeds the <code>as</code> hard limit, memory allocation attempts will return an error, but no process is killed.
* The <code>as</code> soft limit is not in utilized until now. In the future it may be used to penalizing guests over that limit or it could be used to force swapping on them and such ...

Bertl explained the difference between '''rss''' and '''as''' with the following example. If two processes share 100 MB of memory, then only 100 MB worth of virtual memory pages can be used at most, so the RSS use of the guest increases by 100 MB. However, two processes are using it, so the AS use increases by 200 MB.

This makes me think that limiting AS is less useful than limiting RSS, since it doesn't directly reflect real, limited resources (RAM and swap) on the host, that deprive other virtual machines of those resources. Bertl says that AS limits can be used to give guests a "gentle" warning that they are running out of memory, but I don't know how much more gentle it is, or how to set it accurately.

For example, 100 processes each mapping a 100 MB file would consume a total of 10 GB of address space (AS), but no more than 100 MB of resources on the host. But if you set the AS limit to 10 GB, then it will not stop one process from allocating 4 GB of RAM, which could kill the host or result in that process being killed by the OOM killer.

== Setting memory limits ==
You can set the hard limit on a particular context, effective immediately, with this command:

<pre>
/usr/sbin/vlimit -c <xid> --<resource> <value>
</pre>

<code><xid></code> is the context ID of the guest, which you can determine with the <code>/usr/sbin/vserver-stat</code> command.

For example, if you want to change the '''rss''' hard limit for the vserver with <code><xid></code> 49000, and limit it to 10,000 pages (40 MB), you could use this command:

<pre>
/usr/sbin/vlimit -c 49000 --rss 10000
</pre>

You can change the soft limit instead by adding the <code>-S</code> parameter.

Changes made with the vlimit command are effective only until the vserver is stopped. To make permanent changes, write the value to this file:

<pre>
/etc/vservers/<name>/rlimits/<resource>.hard
</pre>

To set a soft limit, use the same file name with the <code>.soft</code> extension. The <code>rlimits</code> directory is not created by default, so you may need to create it yourself.

If you omit the suffix after the <code>/etc/vservers/<name>/rlimits/rss</code> file, the value will be set for both, the hard and soft limit.

Changes to these files take effect only when the vserver is started. To make immediate and permanent changes to a running vserver, you need to run <code>vlimit</code> '''and''' update the rlimits file.

The safest setting, to prevent any guest from interfering with any other, is to set the total of all RSS hard limits (across all running guests) to be less than the total virtual memory (RAM and swap) on the host. It should be sufficiently less to leave room for processes running on the host, and some disk cache, perhaps 100 MB.

However, this is very conservative, since it assumes the worst case where all guests are using the maximum amount of memory at one time. In practice, you can usually get away with contended resources, i.e. allowing guests to use more than this value.

== Displaying current memory limits ==
To display the currently active RSS limits for a vserver execute the following command:
<pre>
vlimit -c <xid> -a -d | grep RSS
</pre>

The above command will display a similar result, whereas the third value (5000) is the soft limit and the last reflects the current hard limit (10000).
<pre>
RSS N/A 5000 10000
</pre>

== Display memory limits within a vserver ==
Normally the <code>top</code> and <code>free</code> command will display the RAM and Swap usage of the host while invoked within a vserver. To change this behavior, add the <code>VIRT_MEM</code> [[Capabilities_and_Flags#Context_flags_.28cflags.29|context flag]] to your vserver configuration:
<pre>
echo "VIRT_MEM" >> /etc/vservers/<name>/flags
</pre>

After a successful restart of the related vserver, the total available RAM will equal to the value of <code>rss.soft</code> while the difference of <code>rss.hard</code> - <code>rss.soft</code> will be displayed as swap space.

As an example, if you set the <code>rss.hard</code> limit to 10'000 pages and the <code>rss.soft</code> limit to 7'000 pages:
<pre>
vlimit -c <xid> --rss 10000
vlimit -c <xid> -S --rss 7000
vlimit -c <xid> -a -d | grep RSS
</pre>
<pre>
RSS N/A 7000 10000
</pre>

<code>free</code> will report 28'000 KB of total memory and 12'000 KB of Swap space (assuming that one page is 4 KB):
<pre>
free -k
</pre>
<pre>
total used free shared buffers cached
Mem: 28000 4396 23604 0 0 0
-/+ buffers/cache: 4396 23604
Swap: 12000 0 12000
</pre>

'''Note:''' According to Herbert, the kernel won't use any ''real'' swap as soon as the <code>rss.soft</code> limit has been reached. Swapping will be done on the host level, not per vserver (see [http://list.linux-vserver.org/archive?mss:653:200801:iiagcodpghkhehndkgjg "free" command inside vserver]).

Downloads

2008-12-10T16:18:00Z

Ktwilight: /* Kernel Patches */

{{NeedCompletion}}

== Kernel Patches ==

The Linux- VServer project maintains several branches of the kernel patch. Since version 1.00 the versioning is similar to the kernel versioning scheme. Even numbered releases (a.X.z with even X) are stable, reasonably well tested and expected not to change feature-wise. Odd numbered (a.Y.z with odd Y) releases are development releases. The last digit/number (z) is a subversion identifier. Experimental versions and Release Candidates might add a fourth identifier to that scheme.

Basically the stable and development releases should be similar in functionality, but the development releases will include features and enhancements not present in the stable branch. Once those features mature (and get well tested), they will be incorporated by the stable branch.

For example the first stable release (1.00) uses two systemcalls as the previous releases did. However, the vserver system calls have been changed in the first development release (1.1.0). Linus assigned the vserver project a single system call, so a [[System Call Switch]] has been implemented. Running a development release usually requires using recent (latest) tools from the util-vserver development branch.

1.X.z and 1.Y.z releases are for the 2.4 kernels, while 1.9.x (obsoleted by now) and 2.X.y releases are for the 2.6 series.

{{CurrentPatchTableMatrix}}

'''[http://vserver.13thfloor.at/Experimental/ Experimental Releases]'''<br>
Let us know if anything is broken ...

{{ExperimentalPatchTableMatrix}}

All (previous) downloads are available in the [[Archives]]. Also take a look at the [[ChangeLogs]].

For an overview of available Features in each version take a look at [[Feature Matrix]]

Precompiled kernel packages are available for [http://packages.debian.org/search?keywords=linux+image+vserver+&searchon=names&suite=all&section=all debian]

== Userspace Utilities ==

In order to administrate your virtual private servers you need a set of userspace utilities. The following gives an overview of possible choices. For detailed instructions visit the respective project pages.

=== util-vserver ===

Created by Enrico Scholz util-vserver is the current "official" userspace implementation. Many distributions have added binary packages for util-vserver to their repositories.

{| class="wikitable" style="width: 60%;"
| The current version of util-vserver is:
| style="width: 20%;" | [http://ftp.linux-vserver.org/pub/utils/util-vserver/util-vserver-0.30.215.tar.bz2 0.30.215]
|}

* [https://savannah.nongnu.org/projects/util-vserver/ util-vserver project homepage]
* [http://people.linux-vserver.org/~dhozac/t/uv-testing/ util-vserver pre-releases]

=== VServer Control Daemon ===

Being still in development the VServer Control Daemon is another approach for virtual private server management. The concept is based on a client/server architecture using XMLRPC. Currently there are no releases, i.e. source code has to be obtained from SVN.

{| class="wikitable" style="width: 60%;"
| The current version of the VServer Control Daemon is:
| style="width: 20%;" | [http://svn.linux-vserver.org/svn/vcd SVN trunk]
|}

* [http://dev.croup.de/proj/vserver-utils/browser/trunk/doc/vcd.spec?format=raw VCD specification]

=== Testme.sh script ===

Useful for debugging linux-vserver problems.

* [http://vserver.13thfloor.at/Stuff/SCRIPT/testme.sh testme.sh]

=== Ancient vserver tools ===

Although not used much anymore the old tools by Jacques Gelinas are said to still work on current kernels.

{| class="wikitable" style="width: 60%;"
| The current version of the vserver tools is:
| style="width: 20%;" | [ftp://ftp.solucorp.qc.ca/pub/vserver/vserver-0.40.src.tar.gz 0.40]
|}

* [http://www.solucorp.qc.ca/miscprj/s_context.hc vserver tools project homepage]

== Guest images ==

Below is a list of third-party archives for VPS images

* http://mirrors.sandino.net/vserver/images/
* http://debian.marlow.dk/vserver/guest/
* http://lylix.net/vps+templates/func,select/id,1/
* http://distfiles.gentoo.org/experimental/x86/vserver/
* http://distfiles.gentoo.org/experimental/amd64/vserver/

== Chroot repositories ==

A collection of chroot trees suitable to bootstrap a vserver or to use with chroot

* http://packaging-farm.dachary.org/packaging-farm/ and rsync://packaging-farm.dachary.org/packaging-farm/

== 3rd-party applications ==

A collection of applications that support Linux-Vservers

* [http://munin.projects.linpro.no/ munin]: [http://muninexchange.projects.linpro.no/?search=&cid=32&os%5B4%5D=on&os%5B7%5D=on&os%5B3%5D=on&os%5B2%5D=on&os%5B5%5D=on&os%5B8%5D=on&os%5B1%5D=on&os%5B6%5D=on plugins]
* [http://dev.riseup.net/backupninja backupninja]
* [http://puppet.reductivelabs.com puppet]: [http://git.black.co.at/?p=manifests.git;a=shortlog;h=virtual virtual module]
* [http://openqrm.sourceforge.net openQRM]: [http://openqrm.sourceforge.net/plugins.html plugin]

Downloads

2008-12-10T16:14:54Z

Ktwilight:

{{NeedCompletion}}

== Kernel Patches ==

The Linux- VServer project maintains several branches of the kernel patch. Since version 1.00 the versioning is similar to the kernel versioning scheme. Even numbered releases (a.X.z with even X) are stable, reasonably well tested and expected not to change feature-wise. Odd numbered (a.Y.z with odd Y) releases are development releases. The last digit/number (z) is a subversion identifier. Experimental versions and Release Candidates might add a fourth identifier to that scheme.

Basically the stable and development releases should be similar in functionality, but the development releases will include features and enhancements not present in the stable branch. Once those features mature (and get well tested), they will be incorporated by the stable branch.

For example the first stable release (1.00) uses two systemcalls as the previous releases did. However, the vserver system calls have been changed in the first development release (1.1.0). Linus assigned the vserver project a single system call, so a [[System Call Switch]] has been implemented. Running a development release usually requires using recent (latest) tools from the util-vserver development branch.

1.X.z and 1.Y.z releases are for the 2.4 kernels, while 1.9.x (obsoleted by now) and 2.X.y releases are for the 2.6 series.

{{CurrentPatchTableMatrix}}

All (previous) downloads are available in the [[Archives]]. Also take a look at the [[ChangeLogs]].

For an overview of available Features in each version take a look at [[Feature Matrix]]

Precompiled kernel packages are available for [http://packages.debian.org/search?keywords=linux+image+vserver+&searchon=names&suite=all&section=all debian]

== Userspace Utilities ==

In order to administrate your virtual private servers you need a set of userspace utilities. The following gives an overview of possible choices. For detailed instructions visit the respective project pages.

=== util-vserver ===

Created by Enrico Scholz util-vserver is the current "official" userspace implementation. Many distributions have added binary packages for util-vserver to their repositories.

{| class="wikitable" style="width: 60%;"
| The current version of util-vserver is:
| style="width: 20%;" | [http://ftp.linux-vserver.org/pub/utils/util-vserver/util-vserver-0.30.215.tar.bz2 0.30.215]
|}

* [https://savannah.nongnu.org/projects/util-vserver/ util-vserver project homepage]
* [http://people.linux-vserver.org/~dhozac/t/uv-testing/ util-vserver pre-releases]

=== VServer Control Daemon ===

Being still in development the VServer Control Daemon is another approach for virtual private server management. The concept is based on a client/server architecture using XMLRPC. Currently there are no releases, i.e. source code has to be obtained from SVN.

{| class="wikitable" style="width: 60%;"
| The current version of the VServer Control Daemon is:
| style="width: 20%;" | [http://svn.linux-vserver.org/svn/vcd SVN trunk]
|}

* [http://dev.croup.de/proj/vserver-utils/browser/trunk/doc/vcd.spec?format=raw VCD specification]

=== Testme.sh script ===

Useful for debugging linux-vserver problems.

* [http://vserver.13thfloor.at/Stuff/SCRIPT/testme.sh testme.sh]

=== Ancient vserver tools ===

Although not used much anymore the old tools by Jacques Gelinas are said to still work on current kernels.

{| class="wikitable" style="width: 60%;"
| The current version of the vserver tools is:
| style="width: 20%;" | [ftp://ftp.solucorp.qc.ca/pub/vserver/vserver-0.40.src.tar.gz 0.40]
|}

* [http://www.solucorp.qc.ca/miscprj/s_context.hc vserver tools project homepage]

== Guest images ==

Below is a list of third-party archives for VPS images

* http://mirrors.sandino.net/vserver/images/
* http://debian.marlow.dk/vserver/guest/
* http://lylix.net/vps+templates/func,select/id,1/
* http://distfiles.gentoo.org/experimental/x86/vserver/
* http://distfiles.gentoo.org/experimental/amd64/vserver/

== Chroot repositories ==

A collection of chroot trees suitable to bootstrap a vserver or to use with chroot

* http://packaging-farm.dachary.org/packaging-farm/ and rsync://packaging-farm.dachary.org/packaging-farm/

== 3rd-party applications ==

A collection of applications that support Linux-Vservers

* [http://munin.projects.linpro.no/ munin]: [http://muninexchange.projects.linpro.no/?search=&cid=32&os%5B4%5D=on&os%5B7%5D=on&os%5B3%5D=on&os%5B2%5D=on&os%5B5%5D=on&os%5B8%5D=on&os%5B1%5D=on&os%5B6%5D=on plugins]
* [http://dev.riseup.net/backupninja backupninja]
* [http://puppet.reductivelabs.com puppet]: [http://git.black.co.at/?p=manifests.git;a=shortlog;h=virtual virtual module]
* [http://openqrm.sourceforge.net openQRM]: [http://openqrm.sourceforge.net/plugins.html plugin]

Template:ExperimentalPatchTableMatrix

2008-12-08T16:28:18Z

Ktwilight:

Template:ExperimentalPatchTableMatrix

2008-11-21T13:19:03Z

Ktwilight:

Template:ExperimentalPatchTableMatrix

2008-11-21T13:18:18Z

Ktwilight:

== Experimental Releases ==

{| class="wikitable" style="margin: 2em auto 2em auto;"
! Linux-VServer branch
Linux kernel
!class="devel"| 2.3
Experimental
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.6.tar.bz2 2.6.27.6]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.6-vs2.3.0.36.1.diff vs2.3.0.36.1]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.26.6.tar.bz2 2.6.26.6]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.26.6-vs2.3.0.35.6.diff vs2.3.0.35.6]
|}

Template:ExperimentalPatchTableMatrix

2008-11-21T13:16:45Z

Ktwilight:

== Experimental Releases ==

Let us know if something is broken!

{| class="wikitable" style="margin: 2em auto 2em auto;"
! Linux-VServer branch
Linux kernel
!class="devel"| 2.3
Experimental
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.6.tar.bz2 2.6.27.6]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.6-vs2.3.0.36.1.diff vs2.3.0.36.1]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.26.6.tar.bz2 2.6.26.6]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.26.6-vs2.3.0.35.6.diff vs2.3.0.35.6]
|}

Check out the other [http://vserver.13thfloor.at/Experimental/ Experimental Releases] if there are not listed above!

Template:ExperimentalPatchTableMatrix

2008-11-21T13:15:58Z

Ktwilight:

==== Experimental Releases ====

Let us know if something is broken!

{| class="wikitable" style="margin: 2em auto 2em auto;"
! Linux-VServer branch
Linux kernel
!class="devel"| 2.3
Experimental
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.6.tar.bz2 2.6.27.6]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.6-vs2.3.0.36.1.diff vs2.3.0.36.1]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.26.6.tar.bz2 2.6.26.6]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.26.6-vs2.3.0.35.6.diff vs2.3.0.35.6]
|}

Check out the other [http://vserver.13thfloor.at/Experimental/ Experimental Releases] if there are not listed above!

Template:ExperimentalPatchTableMatrix

2008-11-21T13:12:10Z

Ktwilight:

==== Experimental Releases ====

Let us know if something is broken!

{| class="wikitable" style="margin: 2em auto 2em auto;"
! Linux-VServer branch
Linux kernel
!class="devel"| 2.3
Experimental
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.6.tar.bz2 2.6.27.6]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.27.6-vs2.3.0.36.1.diff vs2.3.0.36.1]
|-
| [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.26.6.tar.bz2 2.6.26.6]
| [http://vserver.13thfloor.at/Experimental/patch-2.6.26.6-vs2.3.0.35.6.diff vs2.3.0.35.6]
|}

Other Experimental Releases can be found [http://vserver.13thfloor.at/Experimental/ here]

Template:ExperimentalPatchTableMatrix

2008-11-21T13:09:12Z

Ktwilight: New page: {| class="wikitable" style="margin: 2em auto 2em auto;" ! Linux-VServer branch Linux kernel !class="devel"| 2.3 Experimental |- | [http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27....

How to participate

2008-08-19T21:57:09Z

Ktwilight:

[[image:Opensource-110x95.png|left]] The basic idea behind open source is very simple: When programmers can read, redistribute, and modify the source code for a piece of software, the software evolves. People improve it, people adapt it, people fix bugs. And this can happen at a speed that, if one is used to the slow pace of conventional software development, seems astonishing.

We in the open source community have learned that this rapid evolutionary process produces better software than the traditional closed model, in which only a very few programmers can see the source and everybody else must blindly use an opaque block of bits.

Whether you're an experienced Linux developer or an end user just getting started with Linux-VServer, there are many ways for you to participate in the Linux-VServer project. Join the mailing list to get help or help others, find and report bugs, review the documentation, send your wish list for new features, create and submit patches, or find other creative ways to contribute.

== Improve the Wiki ==

As long as you edit anything on the wiki you are de facto member of the [[Wiki Team]].

This page is built with MediaWiki. The concept of a Wiki is that anybody may add and modify content. Please see the [[Wiki Team]] page if you want to contribute to our Wiki. Refer to the [http://meta.wikimedia.org/wiki/Help:Contents Wikimedia Manual] for instructions how to create and format wiki pages. Please make sure that you follow overall look and feel of the wiki.

We added a [[Sandbox]] and we would kindly ask all that wannabe hackers use that page for the very challenging task of wiki hacking (TIA:).

== Help other users ==

There are many ways to help other Linux-VServer users. Take a look at [[Communicate]] to learn about all our communication methods.

== Test new releases ==

You can help improve Linux-VServer by finding and reporting bugs. Like many other projects we don't maintain Bugzilla or similar but instead handle bugs on the mailing list. If you have never written a bug report, please refer to [[Report a Bug]] to learn what kinds of information make the report most useful.

The experimental releases can be found [http://vserver.13thfloor.at/Experimental/ here].

== Help narrow down problems ==

If there's a problem the developers cannot reproduce, the [[Debugging]] page shows how to proceed to help them get to that point.

== Suggest new features ==

If you feel like a feature is missing feel free to contact the Linux-VServer community with your wishlist. Take a look at [[Communicate]] to learn about all our communication methods.

== Review or write new documentation ==

Visit the [[Documentation]] page to contribute or read articles and manuals. If you've got instructions, solutions to common problems, neat tips and tricks, or just a good way to explain something, we'd love to hear from you.

== Send patches ==

The most obvious way to participate in the development of Linux-VServer is to post a patch as a suggested solution to an existing bug on the mailing list.