Difference between revisions of "Miscellaneous openVZ notes"

From Notes_Wiki
m
m
 
(3 intermediate revisions by the same user not shown)
Line 1: Line 1:
<yambe:breadcrumb>OpenvZ</yambe:breadcrumb>
[[Main Page|Home]] > [[CentOS]] > [[CentOS 6.x]] > [[Virtualization tools]] > [[OpenvZ]] > [[Miscellaneous openVZ notes]]
=Miscellaneous openVZ notes=


 
==Enabling iptables modules for container==
=Enabling iptables modules for container=


Note use of --iptables is deprecated in latest openVZ.  iptables can be enabled using:
Note use of --iptables is deprecated in latest openVZ.  iptables can be enabled using:
Line 16: Line 14:




=Source NAT for containers using base machine=
==Source NAT for containers using base machine==


Source NAT for containers can be done using base machine to provide LAN/Internet access to container without requiring an additional IP or exposing the container to outside world. To NAT outgoing connections from container use:  
Source NAT for containers can be done using base machine to provide LAN/Internet access to container without requiring an additional IP or exposing the container to outside world. To NAT outgoing connections from container use:  
Line 25: Line 23:




=Enabling tun/tap devices for container=
==Enabling tun/tap devices for container==


To enable tun/tap devices for container (to use container as VPN server) use following steps:
To enable tun/tap devices for container (to use container as VPN server) use following steps:
Line 44: Line 42:




=Correcting time-zone used in container=
==Finding container for a given base machine process==
 
If the container image in use is configured for different time-zone then time-zone can be corrected using something like:
<pre>
    rm -f /etc/localtime
    ln -s /usr/share/zoneinfo/Asia/Kolkata /etc/localtime
</pre>
 
 
 
=Finding container for a given base machine process=


Command '<tt>pstree -pun | less</tt>' on base machine can help in seeing process tree of all containers which includes all container inits and their childrens.  This can help in finding process id of init of container under which given process has been started.  Once init process id for given container is known, container ID can be determined using:
Command '<tt>pstree -pun | less</tt>' on base machine can help in seeing process tree of all containers which includes all container inits and their childrens.  This can help in finding process id of init of container under which given process has been started.  Once init process id for given container is known, container ID can be determined using:
Line 64: Line 52:




=Detecting if current machine or VM or container is using openVZ=
==Detecting if current machine or VM or container is using openVZ==


To check if current host is using openVZ use following command as root user:
To check if current host is using openVZ use following command as root user:
Line 75: Line 63:




=Changing VE_LAYOUT from ploop to simfs=
==Changing VE_LAYOUT from ploop to simfs==


Latest openVZ installations have default VE_LAYOUT as ploop instead of older simfs.  If this is not desired then edit '<tt>/etc/vz/vz.conf</tt>' and set
Latest openVZ installations have default VE_LAYOUT as ploop instead of older simfs.  If this is not desired then edit '<tt>/etc/vz/vz.conf</tt>' and set
Line 84: Line 72:




<yambe:breadcrumb>OpenvZ</yambe:breadcrumb>
==Change CTID of container==
 
To change CTID of container use following steps:
#Stop container with &lt;old-ctid&gt;
#Rename /etc/vz/conf/&lt;old-ctid&gt;.conf to /etc/vz/conf/&lt;new-ctid&gt;.conf
#Edit /etc/vz/conf/&lt;new-ctid&gt;.conf and change virtual-interface name to new CTID if such name is present
#Rename /vz/private/&lt;old-ctid&gt; to /vz/private/&lt;new-ctid&gt;
#Rename /vz/root/&lt;old-ctid&gt; to /vz/root/&lt;new-ctid&gt;
#Start container with &lt;new-ctid&gt;
 
 
 
 
[[Main Page|Home]] > [[CentOS]] > [[CentOS 6.x]] > [[Virtualization tools]] > [[OpenvZ]] > [[Miscellaneous openVZ notes]]

Latest revision as of 13:10, 24 August 2022

Home > CentOS > CentOS 6.x > Virtualization tools > OpenvZ > Miscellaneous openVZ notes

Enabling iptables modules for container

Note use of --iptables is deprecated in latest openVZ. iptables can be enabled using: 

vzctl set <ctid> --netfilter full

The new setup also disables connection tracking in base machine. This can be re-enabled by editing '/etc/modprobe.d/openvz.conf' and change the line to: 

options nf_conntrack ip_conntrack_disable_ve0=0


Source NAT for containers using base machine

Source NAT for containers can be done using base machine to provide LAN/Internet access to container without requiring an additional IP or exposing the container to outside world. To NAT outgoing connections from container use: 

iptables -t nat -I POSTROUTING -s <container-private-IP> -o <exit-interface> -j SNAT --to-source <container-ip>


Enabling tun/tap devices for container

To enable tun/tap devices for container (to use container as VPN server) use following steps:

  1. Use following commands with appropriate CID on base machine 
    vzctl set <CID> --devnodes net/tun:rw --save
    

    vzctl set <CID> --devices c:10:200:rw --save
    

    vzctl set <CID> --capability net_admin:on --save
  2. Use following commands as root user inside container 
    mkdir -p /dev/net
    

    mknod /dev/net/tun c 10 200
    

    chmod 600 /dev/net/tun
  3. Restart container


Finding container for a given base machine process

Command 'pstree -pun | less' on base machine can help in seeing process tree of all containers which includes all container inits and their childrens. This can help in finding process id of init of container under which given process has been started. Once init process id for given container is known, container ID can be determined using: 

lsof 2>&1 | grep <init-pid> | grep -v lsof

so that various files used by that process in base machine can be listed. Now if the given process has opened /vz/root/<CID>/dev/null file then it means it is init process of <CID> container.


Detecting if current machine or VM or container is using openVZ

To check if current host is using openVZ use following command as root user: 

cat /proc/1/status | grep envID

If value is present and is 0 then openVZ is being used and the command was run on base host. Any other envID indicates CTID of the container being used.

Learned from http://christian.hofstaedtler.name/blog/2008/10/detecting-openvz.html


Changing VE_LAYOUT from ploop to simfs

Latest openVZ installations have default VE_LAYOUT as ploop instead of older simfs. If this is not desired then edit '/etc/vz/vz.conf' and set 

VE_LAYOUT=simfs

If ploop is desired then ploop package must be installed.


Change CTID of container

To change CTID of container use following steps:

  1. Stop container with <old-ctid>
  2. Rename /etc/vz/conf/<old-ctid>.conf to /etc/vz/conf/<new-ctid>.conf
  3. Edit /etc/vz/conf/<new-ctid>.conf and change virtual-interface name to new CTID if such name is present
  4. Rename /vz/private/<old-ctid> to /vz/private/<new-ctid>
  5. Rename /vz/root/<old-ctid> to /vz/root/<new-ctid>
  6. Start container with <new-ctid>



Home > CentOS > CentOS 6.x > Virtualization tools > OpenvZ > Miscellaneous openVZ notes

Retrieved from "http://www.sbarjatiya.com/notes_wiki/index.php?title=Miscellaneous_openVZ_notes&oldid=6872"