wiki:TipAndDoc/Linux/LXC

Version 55 (modified by mitty, 8 years ago) (diff)

--

  1. two NICs in one container
    1. example
  2. mount bind
    1. read-only bind
  3. X11 with VNC
    1. common packages
    2. GNOME
    3. Xfce
    4. LXDE
  4. mount inside container
    1. ホストで直接mountし、コンテナには--bindでアクセスさせる
  5. backup
  6. DHCP
    1. no valid interfaces found
    2. Dependency failed for dhcpcd on eth0.

  • LinuX Container
  • ホスト側のvethデバイス名を指定する
    • ​lxc-chroot-linux-containers - Re: (Lxc-users) veth name - msg#00058 - Recent Discussion OSDir.com
    • man 5 lxc.conf

      By default lxc choose a name for the network device belonging to the outside of the container, this name is handled by lxc, but if you wish to handle this name yourself, you can tell lxc to set a specific name with the lxc.network.veth.pair option.

    • 複数のコンテナで同じ名前のpairを指定すると、二つ目は起動しない(下記の例ではtest1, test2コンテナでlxc.network.veth.pair = testと指定)
    • $ sudo lxc-start -n test2 
      lxc-start: failed to create test-vethNdql6o : File exists
lxc-start: failed to create netdev
lxc-start: failed to create the network
lxc-start: failed to spawn 'test2'
lxc-start: No such file or directory - failed to remove cgroup '/sys/fs/cgroup/cpu/sysdefault/lxc/test2'
  • 指定しない場合、mktemp("vethXXXXXX")で決定される
    • ​SourceForge - lxc/lxc/blob - src/lxc/conf.c

      static int instanciate_veth(struct lxc_handler *handler, struct lxc_netdev *netdev)

    • ホスト側の物理NIC(lxc.network.link)とリンクするveth1の名前やifindexを外部から知る手段が無い模様
      • $ sudo lxc-start -d -n test -o test.log -l DEBUG 
              lxc-start 1356615687.534 DEBUG    lxc_conf - instanciated veth 'vethtgqRWu/vethnwRgNf', index is '99'
      • lxc.network.veth.pair = vtest とすると以下の様になる 
              lxc-start 1356615810.522 DEBUG    lxc_conf - instanciated veth 'vtest/vethA3QwQ9', index is '102'
  • mitty@precise:~$ lxc-create -t ubuntu -h 
    usage: lxc-create -n <name> [-f configuration] [-t template] [-h] -- [template_options]
usage: lxc-create -n <name> [-f configuration] [-t template] [-h] [fsopts] -- [template_options]
   fsopts: -B none
   fsopts: -B lvm [--lvname lvname] [--vgname vgname] [--fstype fstype] [--fssize fssize]
   fsopts: -B btrfs
           flag is not necessary, if possible btrfs support will be used

creates a lxc system object.

Options:
name         : name of the container
configuration: lxc configuration
template     : lxc-template is an accessible template script

The container backing store can be altered using '-B'.  By default it
is 'none', which is a simple directory tree under /var/lib/lxc/<name>/rootfs
Otherwise, the following option values may be relevant:
lvname       : [for -lvm] name of lv in which to create lv,
                container-name by default
vgname       : [for -lvm] name of vg in which to create lv, 'lxc' by default
fstype       : name of filesystem to create, ext4 by default
fssize       : size of filesystem to create, 1G by default

template-specific help follows: (these options follow '--')
/usr/lib/lxc/templates/lxc-ubuntu -h|--help [-a|--arch] [-b|--bindhome <user>] [--trim] [-d|--debug]
   [-F | --flush-cache] [-r|--release <release>] [ -S | --auth-key <keyfile>]
release: the ubuntu release (e.g. precise): defaults to host release on ubuntu, otherwise uses latest LTS
trim: make a minimal (faster, but not upgrade-safe) container
bindhome: bind <user>'s home into the container
          The ubuntu user will not be created, and <user> will have
          sudo access.
arch: the container architecture (e.g. amd64): defaults to host arch
auth-key: SSH Public key file to inject into container

two NICs in one container

example

  • 通常のbridge(veth)ではなくmacvlanであるが、vethでも同じはず
  • /var/lib/lxc/test/config 
    lxc.network.type=macvlan
lxc.network.macvlan.mode=bridge
lxc.network.link=em1
lxc.network.flags=up
lxc.network.hwaddr = 00:16:3e:85:2e:da
lxc.network.type=macvlan
lxc.network.macvlan.mode=bridge
lxc.network.link=em1
lxc.network.flags=up
lxc.network.hwaddr = 00:16:3e:85:2e:db
  • mitty@test:~$ ifconfig -a | egrep 'addr|Link' 
    eth0      Link encap:Ethernet  HWaddr 00:16:3e:85:2e:da
          inet addr:192.168.83.207  Bcast:192.168.83.255  Mask:255.255.255.0
          inet6 addr: fe80::216:3eff:fe85:2eda/64 Scope:Link
eth1      Link encap:Ethernet  HWaddr 00:16:3e:85:2e:db
          inet addr:192.168.83.212  Bcast:192.168.83.255  Mask:255.255.255.0
          inet6 addr: fe80::216:3eff:fe85:2edb/64 Scope:Link
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
  • mitty@test:~$ ip route 
    default via 192.168.83.243 dev eth0
192.168.83.0/24 dev eth0  proto kernel  scope link  src 192.168.83.207
192.168.83.0/24 dev eth1  proto kernel  scope link  src 192.168.83.212

mount bind

  • /var/lib/lxc/>container name>/fstab を用いて、ホストの特定ディレクトリ以下をゲストにbind出来る
  • fstab 
    /media mnt none bind 0 0
    • host:/media -> guest:/mnt とマウントされる
    • mntに「/」が無いことに注意
    • mitty@lxc:~$ mount 
      /dev/disk/by-uuid/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX on /mnt type ext4 (rw,relatime,errors=remount-ro,user_xattr,barrier=1,data=ordered)
    • mitty@lxc:~$ ls -l /mnt/ 
      total 0
-rw-r--r-- 1 root root 0 Oct 23 22:01 host-media
  1. mitty@lxc:~$ sudo rm /mnt/host-media 
    removed `/mnt/host-media'
  2. mitty@host:~$ ls -l /media/host-media 
    ls: cannot access /media/host-media: No such file or directory

read-only bind

  • fstab 
    /media mnt none bind,ro 0 0
  • mountコマンドの出力結果は「(rw,relatime,errors=remount-ro,user_xattr,barrier=1,data=ordered)」で変わらないが、read-only化される
  • mitty@lxc:~$ sudo rm /mnt/host-media 
    rm: cannot remove `/mnt/host-media': Read-only file system

X11 with VNC

  • 12.04上のLXCでは、configのcgroupの設定やmknodなどは特に必要ない模様
  • vnc自体については => network/vnc
  • 基本的にaptitude install -Rでインストールしている
  • エラーメッセージについては ~/.vnc/ 以下に保存されるログファイルから

common packages

  • vnc4server
  • xfonts-base 
    could not open default font 'fixed'

GNOME

  • ~/.vnc/xstartup 
    xsetroot -solid grey
exec gnome-session &

Xfce

  • xfce4
  • ~/.vnc/xstartup 
    xsetroot -solid grey
exec startxfce4 &
  • もしくは 
    xsetroot -solid grey
exec xfce4-session &
  • 後者だとTrashディレクトリなどがFile Managerに表示されない
    • ファイルアイコンが表示されない

LXDE

  • lxde
  • ~/.vnc/xstartup 
    xsetroot -solid grey
exec lxsession -s LXDE &
    • -s LXDEは無くても良い模様

mount inside container

  • コンテナの中ではAppArmorによってmountが禁止されているため、直接NFSマウントするにはAppArmorの再設定が必要

ホストで直接mountし、コンテナには--bindでアクセスさせる

  1. host# mount nfsserver:/path/to/export /mnt/somewhere
  2. /var/lib/lxc/CONTAINER/fstab 
    /mnt/somewhere   path/to/mountdir    none bind 0 0
  3. host# lxc-start -d -n CONTAINER
  4. lxc$ mount 
    nfsserver:/path/to/export on /path/to/mountdir type nfs4 (rw,relatime,...)
  • ホスト上でread-onlyマウントしていても、/var/lib/lxc/CONTAINER/fstabでのread/write権限設定によって上書きされるので注意
  • cifsも同じやりかたでマウントできる
    • cifsではホスト上でread-onlyマウントしていると、設定は一部(?)引き継がれる模様
    • touch hogeすると、touch: cannot touch `/path/to/mountdir/hoge': Read-only file systemとエラーになるが、実際にはファイルは生成される
    • 0バイトのファイルは生成されるが、データの書き込みは出来ない模様
    • 削除は出来ないため、削除できないファイルが作成されてしまう点に注意
  • ホスト上のマウントディレクトリを直接コンテナのディレクトリにbindする必要がある。つまり、以下のようなことは出来ない
    1. host# mount nfsserver:/path/to/export/dir1 /mnt/somewhere/dir1
    2. lxc/CONTAINER/fstab 
      /mnt/somewhere   path/to/mountdir    none bind 0 0
    3. lxc$ ls -l /path/to/mountdir/dir1
      • nfsserver:/path/to/export/dir1 が見えることが期待されるが、実際にはマウントされていない

backup

DHCP

no valid interfaces found

  • Arch Linux 4.4.5-1
  • lxc 1:1.1.5-4
  • dhcpcd 6.10.1-1
  • # dhcpcd 
    dev: loaded udev
no valid interfaces found
no interfaces have a carrier
forked to background, child pid 65
  • # dhcpcd eth0 
    DUID 00:01:00:01:1e:8a:6a:5e:ba:4a:37:94:4a:9d
eth0: IAID 16:b6:47:44
eth0: rebinding lease of 192.168.0.185
eth0: NAK: address in use from 192.168.0.1
eth0: message: address in use
eth0: soliciting a DHCP lease
eth0: soliciting an IPv6 router
eth0: offered 192.168.0.172 from 192.168.0.1
eth0: probing address 192.168.0.172/24
eth0: leased 192.168.0.172 for 86400 seconds
eth0: adding route to 192.168.0.0/24
eth0: adding default route via 192.168.0.1
forked to background, child pid 123
  • LXCコンテナ内で、udevdが起動しないことが原因の模様
  • strace -f dhcpcd
    • コンテナホスト(検証はKVMゲストで行った) 
      access("/run/udev/control", F_OK) = 0

open("/sys/devices/virtual/net/lo/uevent", O_RDONLY|O_CLOEXEC) = 9
fstat(9, {st_mode=S_IFREG|0644, st_size=4096, ...}) = 0
fstat(9, {st_mode=S_IFREG|0644, st_size=4096, ...}) = 0
read(9, "INTERFACE=lo\nIFINDEX=1\n", 4096) = 23
read(9, "", 4096)                 = 0
read(9, "", 4096)                 = 0
close(9)                          = 0
open("/run/udev/data/n1", O_RDONLY|O_CLOEXEC) = 9

open("/sys/devices/pci0000:00/0000:00:03.0/virtio0/net/ens3/uevent", O_RDONLY|O_CLOEXEC) = 9
fstat(9, {st_mode=S_IFREG|0644, st_size=4096, ...}) = 0
fstat(9, {st_mode=S_IFREG|0644, st_size=4096, ...}) = 0
read(9, "INTERFACE=ens3\nIFINDEX=2\n", 4096) = 25
read(9, "", 4096)                 = 0
read(9, "", 4096)                 = 0
close(9)                          = 0
open("/run/udev/data/n2", O_RDONLY|O_CLOEXEC) = 9
    • LXCコンテナ 
      access("/run/udev/control", F_OK) = -1 ENOENT (No such file or directory)

open("/sys/devices/virtual/net/lo/uevent", O_RDONLY|O_CLOEXEC) = 9
fstat(9, {st_mode=S_IFREG|0644, st_size=4096, ...}) = 0
fstat(9, {st_mode=S_IFREG|0644, st_size=4096, ...}) = 0
read(9, "INTERFACE=lo\nIFINDEX=1\n", 4096) = 23
read(9, "", 4096)                 = 0
read(9, "", 4096)                 = 0
close(9)                          = 0
open("/run/udev/data/n1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)

open("/sys/devices/virtual/net/eth0/uevent", O_RDONLY|O_CLOEXEC) = 9
fstat(9, {st_mode=S_IFREG|0644, st_size=4096, ...}) = 0
fstat(9, {st_mode=S_IFREG|0644, st_size=4096, ...}) = 0
read(9, "INTERFACE=eth0\nIFINDEX=6\n", 4096) = 25
read(9, "", 4096)                 = 0
read(9, "", 4096)                 = 0
close(9)                          = 0
open("/run/udev/data/n6", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
write(2, "no valid interfaces found", 25) = 25
write(2, "\n", 1)                 = 1

write(1, "no interfaces have a carrier\n", 29) = 29
      • [root@test /]# systemctl status systemd-udevd 
        ● systemd-udevd.service - udev Kernel Device Manager
   Loaded: loaded (/usr/lib/systemd/system/systemd-udevd.service; static; vendor preset: disabled)
   Active: inactive (dead)
Condition: start condition failed at Sat 2016-04-02 08:30:59 UTC; 5h 9min ago
           ConditionPathIsReadWrite=/sys was not met
     Docs: man:systemd-udevd.service(8)
           man:udev(7)
  • ​arch:Linux_Containers#Systemd_considerations_.28required.29
    • 上記を参考にsystemdの設定を行ったが効果なし
  • ​arch:dhcpcd#dhcpcd_and_systemd_network_interfaces

    dhcpcd.service can be ​Enabled without specifying an interface. This may, however, create a race condition at boot with systemd-udevd trying to apply a predictable network interface name: 

    error changing net interface name wlan0 to wlp4s0: Device or resource busy"

    To avoid it, enable dhcpcd per interface it should bind to as described in ​dhcpcd#Running. The downside of the template unit is, however, that it does not support hot-plugging of a wired connection and will fail if the network cable is not connected. To work-around the failure, see ​dhcpcd#Timeout_delay.

    とのことなので、いずれにせよdhcpcd.serviceを使用しないのがよさそう
  • 古い情報
    • ​Odd Bits dhcpcd[492]: eth0: if_init: Read-only file system

Dependency failed for dhcpcd on eth0.

  • # systemctl start dhcpcd@eth0 
    A dependency job for dhcpcd@eth0.service failed. See 'journalctl -xe' for details.
  • # journalctl -xe 
    Apr 10 20:00:56 test3 systemd[1]: Starting of sys-subsystem-net-devices-eth0.device not supported.
-- Subject: Unit sys-subsystem-net-devices-eth0.device has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit sys-subsystem-net-devices-eth0.device has failed.
--
-- The result is unsupported.
Apr 10 20:00:56 test3 systemd[1]: Dependency failed for dhcpcd on eth0.
-- Subject: Unit dhcpcd@eth0.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit dhcpcd@eth0.service has failed.
--
-- The result is dependency.
Apr 10 20:00:56 test3 systemd[1]: dhcpcd@eth0.service: Job dhcpcd@eth0.service/start failed with result 'dependency'.
  • /usr/lib/systemd/system/dhcpcd@.service 
    [Unit]
Description=dhcpcd on %I
Wants=network.target
Before=network.target
BindsTo=sys-subsystem-net-devices-%i.device
After=sys-subsystem-net-devices-%i.device

[Service]
Type=forking
PIDFile=/run/dhcpcd-%I.pid
ExecStart=/usr/bin/dhcpcd -q -w %I
ExecStop=/usr/bin/dhcpcd -x %I

[Install]
WantedBy=multi-user.target
    • BindsTo=, After=の行を削除することで対応可能

Attachments (4)

Download all attachments as: .zip