Re: [lxc-users] Am I misusing LXCs?

[Scott Lopez]

Is it functioning for you? Yes? Then it isn't wrong. In *nix there are
a dozen ways to skin a cat, and that's before you start scripting in
your language of choice.

Is it the most efficient use? Maybe not. Running a single application
in a LXC container? Maybe you'd be better off with Docker or Rkt. Have
multiple containers to run? Look at CoreOS. Worried about security?
Then maybe separate everything into completely different VMs. Set up
firewalls, vlans and proxies.

So no, you're not misusing LXC. It may not be the best tool for your
job, but your job is running. Be happy!


On Thu, Mar 30, 2017 at 3:20 PM, John Lewis  wrote:
> It is traditional LXC because LXD wasn't out when I set it up
> originally.  I won't build the packages for LXD if I am not even using
> it properly.
>
> I direct incoming connections using iptables with both the the host and
> the virtual router.
>
> I am extremely confident about moving my installation. I will use
> Ansible for the provisioning and the configuration. I will install all
> of the packages I need on a simple VPS. I can still use cgroups to
> control the resource usage of the processes. It will be moderately
> easier for me to secure because it is easy to see where everything is
> and what state everything is in.
>
> I backup the VPS with rsnapshot that is running on a host that I have
> physical access too and I rotate the backup drive to another location.
> The LXCs are disk images.
>
> Could you elaborate on separating data from services?
>
> On Thu, 2017-03-30 at 23:07 +0300, Simos Xenitellis wrote:
>> Is that the traditional LXC or is it LXD/LXC containers?
>> I have a similar set-up (the latter, with LXD/LXC) and there is also a
>> vsftpd in the mix.
>>
>> I think your question is about best practices and whether your
>> installation adheres
>> to some best practices.
>> How do you direct incoming connections to each container? Do you use
>> iptables or something else?
>> If you where to migrate your installation to another VPS, how
>> confident would you be to do that?
>> How do you get backups? Do you take snapshots as backups?
>>
>> I think that if you reach a point where you separate your data from
>> the services, the management of the containers
>> will become much easier and you will feel more confident with the 
>> installation.
>>
>> Simos
>> ___
>> lxc-users mailing list
>> lxc-users@lists.linuxcontainers.org
>> http://lists.linuxcontainers.org/listinfo/lxc-users
>
>
> ___
> lxc-users mailing list
> lxc-users@lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-users
___
lxc-users mailing list
lxc-users@lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-users

Re: [lxc-users] Am I misusing LXCs?

[John Lewis]

It is traditional LXC because LXD wasn't out when I set it up
originally.  I won't build the packages for LXD if I am not even using
it properly.

I direct incoming connections using iptables with both the the host and
the virtual router.

I am extremely confident about moving my installation. I will use
Ansible for the provisioning and the configuration. I will install all
of the packages I need on a simple VPS. I can still use cgroups to
control the resource usage of the processes. It will be moderately
easier for me to secure because it is easy to see where everything is
and what state everything is in. 

I backup the VPS with rsnapshot that is running on a host that I have
physical access too and I rotate the backup drive to another location.
The LXCs are disk images.

Could you elaborate on separating data from services?

On Thu, 2017-03-30 at 23:07 +0300, Simos Xenitellis wrote:
> Is that the traditional LXC or is it LXD/LXC containers?
> I have a similar set-up (the latter, with LXD/LXC) and there is also a
> vsftpd in the mix.
> 
> I think your question is about best practices and whether your
> installation adheres
> to some best practices.
> How do you direct incoming connections to each container? Do you use
> iptables or something else?
> If you where to migrate your installation to another VPS, how
> confident would you be to do that?
> How do you get backups? Do you take snapshots as backups?
> 
> I think that if you reach a point where you separate your data from
> the services, the management of the containers
> will become much easier and you will feel more confident with the 
> installation.
> 
> Simos
> ___
> lxc-users mailing list
> lxc-users@lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-users


___
lxc-users mailing list
lxc-users@lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-users

Re: [lxc-users] Am I misusing LXCs?

[Simos Xenitellis]

On Thu, Mar 30, 2017 at 8:53 PM, John Lewis  wrote:
> I build an LXC network on my VPS to separate all of my personal service
> from each other how similar they are to each other while not having to
> buy more VPS that I don't utilize intensely. Both my containers and my
> host are running Debian 8.
>
> I made a container for Email communications (Email and PBX) Two for
> authentication, One for web sites one for SQL Database and one for DNS
> DHCP.
>
> It was a nice learning experience, but right now, I think the setup is
> annoying to maintain because this wasn't the simplest configuration I
> could have used.
>
> Should I even use containers for this kind of thing? If I should use
> containers at all, how should I use them?
>

Is that the traditional LXC or is it LXD/LXC containers?
I have a similar set-up (the latter, with LXD/LXC) and there is also a
vsftpd in the mix.

I think your question is about best practices and whether your
installation adheres
to some best practices.
How do you direct incoming connections to each container? Do you use
iptables or something else?
If you where to migrate your installation to another VPS, how
confident would you be to do that?
How do you get backups? Do you take snapshots as backups?

I think that if you reach a point where you separate your data from
the services, the management of the containers
will become much easier and you will feel more confident with the installation.

Simos
___
lxc-users mailing list
lxc-users@lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-users

[lxc-users] Am I misusing LXCs?

[John Lewis]

I build an LXC network on my VPS to separate all of my personal service
from each other how similar they are to each other while not having to
buy more VPS that I don't utilize intensely. Both my containers and my
host are running Debian 8.

I made a container for Email communications (Email and PBX) Two for
authentication, One for web sites one for SQL Database and one for DNS
DHCP.

It was a nice learning experience, but right now, I think the setup is
annoying to maintain because this wasn't the simplest configuration I
could have used. 

Should I even use containers for this kind of thing? If I should use
containers at all, how should I use them? 

___
lxc-users mailing list
lxc-users@lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-users

Re: [lxc-users] nfs server in [unprivileged] container?

[Marat Khalili]

> To clarify, in your setup, is the container using zfs? are you creating a 
> dataset for /nfs and exporting that to the container?

In my setup it is a btrfs subvolume that's bind-mounted to nfs container and 
then shared via nfs. It contains users' home directories so the load is not 
particularly high.
-- 

With Best Regards,
Marat Khalili___
lxc-users mailing list
lxc-users@lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-users

[lxc-users] Making sure that you can actually "dig mycontainer.lxd" from the server, etc.

[Simos Xenitellis]

Hi All,

I just figured out that it is possible, and available by default, to
use the domain names of the LXD containers FROM the server.
It has been quite confusing, and could not get it working, so I am
documenting this here.

Let's get a list of the containers and try to access by DNS the
hostname of the container,

$ lxc list
+-+-+-+--++---+
|NAME |  STATE  |IPV4 |IPV6|TYPE
 | SNAPSHOTS |
+-+-+-+++---+
| mycontainer | RUNNING | 10.0.185.211 (eth0) |  | PERSISTENT
| 0 |
+-+-+-+++---+
$ host mycontainer.lxd
mycontainer.lxd has address 10.0.185.211
$ _

The way this works, is that there is a special configuration file (for
"dnsmasq"),
that instructs our Ubuntu's caching nameserver (dnsmasq) to use LXD's
caching nameserver (another instance of dnsmasq), for the name
resolution of *.lxd domains.

If you looked into the file /etc/dnsmasq.d/lxd, you would be looking
at the wrong place.

The correct place to look at, can be found from Ubuntu's caching
nameserver process:

 3136 ?S  0:00 /usr/sbin/dnsmasq --no-resolv
--keep-in-foreground --no-hosts --bind-interfaces
--pid-file=/var/run/NetworkManager/dnsmasq.pid
--listen-address=127.0.1.1 --cache-size=0 --conf-file=/dev/null
--proxy-dnssec --enable-dbus=org.freedesktop.NetworkManager.dnsmasq
--conf-dir=/etc/NetworkManager/dnsmasq.d

and it is: /etc/NetworkManager/dnsmasq.d

In there, there is a 'lxd' file with content similar to

server=/lxd/10.60.117.1
server=/117.60.10.in-addr.arpa/10.60.117.1

This means that for domains with the .lxd suffix, consult the DNS
server at IP address 10.60.117.1 (LXD's caching nameserver, and DHCP
server). Also, do reverse lookups.

The problem is that this file, /etc/NetworkManager/dnsmasq.d/lxd, is
most probably generated while running "lxd init". At least on my
system, it has NOT been regenerated after the subsequent invocations
of "lxd init". That is, I had such a file with a June 2016 timestamp,
with obviously wrong contents.

A cursory grep in the source of LXD did not reveal where this
/etc/NetworkManager/dnsmasq.d/lxd is generated from. It is possible
that it is not generated anymore, and a small chance that it never got
generated by "lxd init".

The documentation at
https://help.ubuntu.com/lts/serverguide/lxc.html#lxc-network provides
some hints, but does not mention the case of having NetworkManager
installed.

Simos
___
lxc-users mailing list
lxc-users@lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-users

Re: [lxc-users] Image "ubuntu:x" not found (no 16.04 images on "ubuntu:")

[Simos Xenitellis]

First of all, now it's working as Stéphane wrote earlier.

On Thu, Mar 30, 2017 at 4:55 PM, Sergiusz Pawlowicz
 wrote:
> On Thu, Mar 30, 2017 at 5:34 PM, Simos Xenitellis
>  wrote:
>> Hi All,
>>
>> I just tried "lxc image list ubuntu:" and I do not see any 16.04 images.
>> (i.e. lxc launch ubuntu:x mycontainer   fails).
>>
>> I attach the output of "lxc image list ubuntu:".
>>
>> I suppose it is a temporary issue, just logging it here.
>
> I have the same issue.
>
> It's really strange, today I am not able to launch any installation,
>
> $ lxc launch ubuntu: test
> Creating test
> error: Couldn't find the requested image
>
> It looks like aliases got lost on  https://cloud-images.ubuntu.com/releases ?
>

Currently, the "ubuntu:" image is the default for "ubuntu:16.04".
Therefore, the "error: Couldn't find the requested image" error means
that it could not find the 16.04 image.

Personally, I use the explicit name, with the single-letter alias: "ubuntu:x".

> $ lxc image list ubuntu:
>
> ++--++-+-+--+---+
> |   ALIAS| FINGERPRINT  | PUBLIC |
> DESCRIPTION   |  ARCH   |   SIZE   |  UPLOAD
> DATE  |
> ++--++-+-+--+---+
> | p (5 more) | 973c3a42737a | yes| ubuntu 12.04 LTS amd64
> (release) (20170307) | x86_64  | 156.00MB | Mar 7, 2017 at 12:00am
> (UTC)  |
> ++--++-+-+--+---+
>
> What is "p (5 more)"?
>

The "p (5 more)" text means that for the Ubuntu 12.04 (precise) image,
there are six aliases in total.
The default name is "p", as shown in the list.
To find out the full list of aliases, run

$ lxc image info ubuntu:p
Fingerprint: 973c3a42737ae3c4161d2a2b64d4ffee1be07ee018f47e2df86b67b909111d5f
Size: 156.00MB
Architecture: x86_64
Public: yes
Timestamps:
Created: 2017/03/07 00:00 UTC
Uploaded: 2017/03/07 00:00 UTC
Expires: 2017/04/26 00:00 UTC
Last used: never
Properties:
serial: 20170307
description: ubuntu 12.04 LTS amd64 (release) (20170307)
os: ubuntu
release: precise
version: 12.04
architecture: amd64
label: release
Aliases:
- 12.04
- 12.04/amd64
- p
- p/amd64
- precise
- precise/amd64
Auto update: disabled
$ _

At the end of the output you can see the full list of six aliases.

Simos

> Did I miss something?
>
> cheers,
> Serge
> ___
> lxc-users mailing list
> lxc-users@lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-users
___
lxc-users mailing list
lxc-users@lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-users

Re: [lxc-users] nfs server in [unprivileged] container?

[Spike]

thanks to both of you for chiming in. Maybe gluster got better, by my past
experiences with it weren't particularly good so I'm inclined to stay away
from it until at least I can find some solid demonstration of it working on
ubuntu.

@Marat, re kernel code, yes, that was my conclusion also per thread on the
zfs ML, and it actually doesn't matter that much, it'd still be useful to
separate the rest of the configs like you said, which was my main goal. To
clarify, in your setup, is the container using zfs? are you creating a
dataset for /nfs and exporting that to the container?

thank you,

Spike

On Thu, Mar 30, 2017 at 3:26 AM Fajar A. Nugraha  wrote:

> On Thu, Mar 30, 2017 at 2:19 PM, Marat Khalili  wrote:
>
> https://launchpad.net/~gluster/+archive/ubuntu/nfs-ganesha
> 
>
> Disclamer: I haven't tested it.
>
> Yes, I found it too, but its production readiness is unclear to me.
>
>
> Redhat says gluster and ganesha is production ready (as in, they're
> selling subscription for it)
>
> https://www.redhat.com/en/technologies/storage/gluster
>
> https://access.redhat.com/documentation/en-us/red_hat_gluster_storage/3.2/html/administration_guide/sect-nfs#sect-NFS_Ganesha
>
> --
> Fajar
> ___
> lxc-users mailing list
> lxc-users@lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-users
___
lxc-users mailing list
lxc-users@lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-users

Re: [lxc-users] Image "ubuntu:x" not found (no 16.04 images on "ubuntu:")

[Stéphane Graber]

On Thu, Mar 30, 2017 at 08:55:23PM +0700, Sergiusz Pawlowicz wrote:
> On Thu, Mar 30, 2017 at 5:34 PM, Simos Xenitellis
>  wrote:
> > Hi All,
> >
> > I just tried "lxc image list ubuntu:" and I do not see any 16.04 images.
> > (i.e. lxc launch ubuntu:x mycontainer   fails).
> >
> > I attach the output of "lxc image list ubuntu:".
> >
> > I suppose it is a temporary issue, just logging it here.
> 
> I have the same issue.
> 
> It's really strange, today I am not able to launch any installation,
> 
> $ lxc launch ubuntu: test
> Creating test
> error: Couldn't find the requested image
> 
> It looks like aliases got lost on  https://cloud-images.ubuntu.com/releases ?
> 
> $ lxc image list ubuntu:
> 
> ++--++-+-+--+---+
> |   ALIAS| FINGERPRINT  | PUBLIC |
> DESCRIPTION   |  ARCH   |   SIZE   |  UPLOAD
> DATE  |
> ++--++-+-+--+---+
> | p (5 more) | 973c3a42737a | yes| ubuntu 12.04 LTS amd64
> (release) (20170307) | x86_64  | 156.00MB | Mar 7, 2017 at 12:00am
> (UTC)  |
> ++--++-+-+--+---+
> 
> What is "p (5 more)"?
> 
> Did I miss something?

Looks like the simplestreams data at https://cloud-images.ubuntu.com got
broken for a bit, things seem to be back to working order now.

-- 
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com


signature.asc
Description: PGP signature
___
lxc-users mailing list
lxc-users@lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-users

Re: [lxc-users] subuids and subgid range with multiple LXC containers

[Joshua Schaeffer]

On Tue, Mar 28, 2017 at 7:07 PM, Serge E. Hallyn  wrote:

> One thing I've always thought would be useful, but not had the time to
> pursue, woudl be to have a concept of 'clients' or somesuch, where each
> client can get one or more unique ranges.  They can then use those
> ranges however they want, but no other clients will ever get their
> rnages.


+1 for this idea. I would find that extremely useful.
___
lxc-users mailing list
lxc-users@lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-users

Re: [lxc-users] Image "ubuntu:x" not found (no 16.04 images on "ubuntu:")

[Sergiusz Pawlowicz]

On Thu, Mar 30, 2017 at 5:34 PM, Simos Xenitellis
 wrote:
> Hi All,
>
> I just tried "lxc image list ubuntu:" and I do not see any 16.04 images.
> (i.e. lxc launch ubuntu:x mycontainer   fails).
>
> I attach the output of "lxc image list ubuntu:".
>
> I suppose it is a temporary issue, just logging it here.

I have the same issue.

It's really strange, today I am not able to launch any installation,

$ lxc launch ubuntu: test
Creating test
error: Couldn't find the requested image

It looks like aliases got lost on  https://cloud-images.ubuntu.com/releases ?

$ lxc image list ubuntu:

++--++-+-+--+---+
|   ALIAS| FINGERPRINT  | PUBLIC |
DESCRIPTION   |  ARCH   |   SIZE   |  UPLOAD
DATE  |
++--++-+-+--+---+
| p (5 more) | 973c3a42737a | yes| ubuntu 12.04 LTS amd64
(release) (20170307) | x86_64  | 156.00MB | Mar 7, 2017 at 12:00am
(UTC)  |
++--++-+-+--+---+

What is "p (5 more)"?

Did I miss something?

cheers,
Serge
___
lxc-users mailing list
lxc-users@lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-users

Re: [lxc-users] user 'ubuntu' does not exist within LXD container

[Simos Xenitellis]

On Thu, Mar 23, 2017 at 3:39 PM, Francesco Longo  wrote:
> Thanks for your reply. It seems that if I put a sleep after container
> creation _sometimes_ it works. Probably, I have to play with the delay.
>
> Is there a correct way to do that? I mean, is there a way to execute a set
> of commands inside the container after the container has properly booted? I
> guess that I could use cloud-init but that means it would work only in
> ubuntu images right?
>

Add some code that will check whether the "ubuntu" account has been
created in the container.
If it has not been created yet, you can "sleep 1", and check again.
Keep checking until the account gets created.

Simos

> Francesco
>
>
> On Thu, Mar 23, 2017 at 12:32 PM, Simos Xenitellis
>  wrote:
>>
>> On Thu, Mar 23, 2017 at 12:41 PM, Francesco Longo  wrote:
>> > Hi all,
>> > I'm playing with Raspberry Pi virtualization, i.e., in few words,
>> > creating
>> > LXD containers on top of a Raspberry Pi and attaching to them a couple
>> > of
>> > FUSE filesystems mirroring the GPIO /sys/class/gpio filesystem.
>> >
>> > I created a simple script that you can find here:
>> >
>> > https://github.com/flongo82/raspberry_virtualization/blob/master/launch_virtual_rasp.sh
>> >
>> > A first issue I'm dealing with is that when using lxc exec to add the
>> > ubuntu
>> > user to the gpio groups it says that the ubuntu user does not exist.
>> > But, if
>> > I login into the container the user is actually there but, of course, it
>> > is
>> > not part of the gpio group given that the command has failed.
>> >
>> > This is the output of the script:
>> >
>> > Creating virtual rasp test!
>> > Creating test
>> > Starting test
>> > Adding group `gpio' (GID 1000) ...
>> > Done.
>> > usermod: user 'ubuntu' does not exist
>> > Device gpio added to test
>> > Device devices added to test
>> >
>> > Any idea why this is happening? Is it possible that I need to wait a
>> > while
>> > before issuing this kind of lxc exec command after creating the
>> > container?
>>
>> You can look into the image at /var/lib/lxd/images/
>> and you will verify that the "ubuntu" account is not preinstalled in the
>> image.
>> In there you can see that there exist cloud-init templates that do things
>> like creating users. My quick look did not show which template creates
>> the "ubuntu" user,
>> so have a better look in there.
>> "cloud-init" runs after the container is created, therefore it makes
>> sense is the "ubuntu" account
>> is not available exactly after the exit for "lxc launch".
>>
>> Simos
>>
>> >
>> > I'm using LXD version 2.12 on top of a
>> > ubuntu-16.04-preinstalled-server-armhf+raspi3.img.xz image.
>> >
>> > Thanks,
>> > Francesco
>> >
>> > --
>> >
>> > --
>> > Dr. Francesco Longo, PhD
>> > Assistant Professor
>> > Dipartimento  di Ingegneria
>> > Università degli Studi di Messina
>> > address: Contrada di Dio (S. Agata), 98166, Messina, Italy
>> > email: flo...@unime.it
>> > phone: +39 090 3977335 --- fax: +39 090 3977471
>> >
>> > --
>> >
>> > ___
>> > lxc-users mailing list
>> > lxc-users@lists.linuxcontainers.org
>> > http://lists.linuxcontainers.org/listinfo/lxc-users
>> ___
>> lxc-users mailing list
>> lxc-users@lists.linuxcontainers.org
>> http://lists.linuxcontainers.org/listinfo/lxc-users
>
>
>
>
> --
> --
> Dr. Francesco Longo, PhD
> Assistant Professor
> Dipartimento  di Ingegneria
> Università degli Studi di Messina
> address: Contrada di Dio (S. Agata), 98166, Messina, Italy
> email: flo...@unime.it
> phone: +39 090 3977335 --- fax: +39 090 3977471
> --
>
> ___
> lxc-users mailing list
> lxc-users@lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-users
___
lxc-users mailing list
lxc-users@lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-users

[lxc-users] Image "ubuntu:x" not found (no 16.04 images on "ubuntu:")

[Simos Xenitellis]

Hi All,

I just tried "lxc image list ubuntu:" and I do not see any 16.04 images.
(i.e. lxc launch ubuntu:x mycontainer   fails).

I attach the output of "lxc image list ubuntu:".

I suppose it is a temporary issue, just logging it here.

Simos


image-list-no-x.txt.gz
Description: GNU Zip compressed data
___
lxc-users mailing list
lxc-users@lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-users

Re: [lxc-users] nfs server in [unprivileged] container?

[Fajar A. Nugraha]

On Thu, Mar 30, 2017 at 2:19 PM, Marat Khalili  wrote:

> https://launchpad.net/~gluster/+archive/ubuntu/nfs-ganesha
> 
>
> Disclamer: I haven't tested it.
>
> Yes, I found it too, but its production readiness is unclear to me.
>

Redhat says gluster and ganesha is production ready (as in, they're selling
subscription for it)

https://www.redhat.com/en/technologies/storage/gluster
https://access.redhat.com/documentation/en-us/red_hat_gluster_storage/3.2/html/administration_guide/sect-nfs#sect-NFS_Ganesha

-- 
Fajar
___
lxc-users mailing list
lxc-users@lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-users

Re: [lxc-users] nfs server in [unprivileged] container?

[Marat Khalili]

https://launchpad.net/~gluster/+archive/ubuntu/nfs-ganesha 



Disclamer: I haven't tested it.
Yes, I found it too, but its production readiness is unclear to me. 
Also, it is not present in stock Ubuntu repositories. Would be glad to 
hear any success stories before trying it myself.



--

With Best Regards,
Marat Khalili

___
lxc-users mailing list
lxc-users@lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-users

Re: [lxc-users] nfs server in [unprivileged] container?

[Fajar A. Nugraha]

On Thu, Mar 30, 2017 at 12:47 PM, Marat Khalili  wrote:

> The story would be all different for userspace nfs server, but apparently
> there's none.
>
>
https://launchpad.net/~gluster/+archive/ubuntu/nfs-ganesha

Disclamer: I haven't tested it.

-- 
Fajar
___
lxc-users mailing list
lxc-users@lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-users