http://linux-vserver.org/api.php?action=feedcontributions&user=62.253.128.13&feedformat=atomLinux-VServer - User contributions [en]2024-03-19T08:44:19ZUser contributionsMediaWiki 1.20.2http://linux-vserver.org/Memory_LimitsMemory Limits2006-09-27T23:18:04Z<p>62.253.128.13: </p>
<hr />
<div>A vserver kernel keeps track many resources used by each guest (context). Some of these relate to memory usage by the guest. You can place limits on these resources to prevent guests from using all the host memory and making the host unusable.<br />
<br />
Two resources are particularly important in this regard: <br />
<br />
* The '''Resident Set Size''' (<code>rss</code>) is the amount of virtual memory (RAM + swap) that the context is allowed to use;<br />
* The '''Address Space''' (<code>as</code>) is the total amount of memory (pages) mapped in each process in the context.<br />
<br />
Both are measured in '''pages''', which are 4 kB each on Intel machines (i386). So a value of 200000 means a limit of 800,000 kB, a little less than 800 MB.<br />
<br />
Each resource has a soft and a hard limit. The soft limit has little effect, but the hard limit does:<br />
<br />
* If a guest exceeds the <code>rss</code> hard limit, the kernel will invoke the Out-of-Memory (OOM) killer to kill some process in the guest;<br />
* If a guest exceeds the <code>as</code> hard limit, memory allocation attempts will return an error, but no process is killed.<br />
<br />
The hard limit of the '''as''' resource refers to the total number of pages mapped in processes. The purpose of the soft limit is unknown.<br />
<br />
Bertl explained the difference between '''rss''' and '''as''' with the following example. If two processes share 100 MB of memory, then only 100 MB worth of virtual memory pages can be used at most, so the RSS use of the guest increases by 100 MB. However, two processes are using it, so the AS use increases by 200 MB. <br />
<br />
This makes me think that limiting AS is less useful than limiting RSS, since it doesn't directly reflect real, limited resources (RAM and swap) on the host, that deprive other virtual machines of those resources. Bertl says that AS limits can be used to give guests a "gentle" warning that they are running out of memory, but I don't know how much more gentle it is, or how to set it accurately. <br />
<br />
For example, 100 processes each mapping a 100 GB file would consume a total of 10 GB of address space (AS), but no more than 100 MB of resources on the host. But if you set the AS limit to 10 GB, then it will not stop one process from allocating 4 GB of RAM, which could kill the host or result in that process being killed by the OOM killer.<br />
<br />
You can set the hard limit on a particular context, effective immediately, with this command:<br />
<br />
<pre><br />
/usr/sbin/vlimit -c <xid> --<resource> <value><br />
</pre><br />
<br />
<xid> is the context ID of the guest, which you can determine with the <code>/usr/sbin/vserver-stat</code> command.<br />
<br />
For example, if you want to change the '''rss''' hard limit for the vserver with <xid> 49000, and limit it to 10,000 pages (40 MB), you could use this command:<br />
<br />
<pre><br />
/usr/sbin/vlimit -c 49000 --rss 10000<br />
</pre><br />
<br />
You can change the soft limit instead by adding the -S parameter.<br />
<br />
Changes made with the vlimit command are effective only until the vserver is stopped. To make permanent changes, write the value to this file:<br />
<br />
<pre><br />
/etc/vservers/<name>/rlimits/<resource>.hard<br />
</pre><br />
<br />
To set a soft limit, use the same file name without the <code>.hard</code> extension. The <code>rlimits</code> directory is not created by default, so you may need to create it yourself.<br />
<br />
Changes to these files take effect only when the vserver is started. To make immediate and permanent changes to a running vserver, you need to run vlimit '''and''' update the rlimits file.<br />
<br />
The safest setting, to prevent any guest from interfering with any other, is to set the total of all RSS hard limits (across all running guests) to be less than the total virtual memory (RAM and swap) on the host. It should be sufficiently less to leave room for processes running on the host, and some disk cache, perhaps 100 MB.<br />
<br />
However, this is very conservative, since it assumes the worst case where all guests are using the maximum amount of memory at one time. In practice, you can usually get away with contended resources, i.e. allowing guests to use more than this value.</div>62.253.128.13http://linux-vserver.org/Memory_LimitsMemory Limits2006-09-27T23:14:39Z<p>62.253.128.13: </p>
<hr />
<div>A vserver kernel keeps track many resources used by each guest (context). Some of these relate to memory usage by the guest. You can place limits on these resources to prevent guests from using all the host memory and making the host unusable.<br />
<br />
Two resources are particularly important in this regard: <br />
<br />
* The '''Resident Set Size''' (<code>rss</code>) is the amount of virtual memory (RAM + swap) that the context is allowed to use;<br />
* The '''Address Space''' (<code>as</code>) is the total amount of memory (pages) mapped in each process in the context.<br />
<br />
Both are measured in '''pages''', which are 4 kB each on Intel machines (i386). So a value of 200000 means a limit of 800,000 kB, a little less than 800 MB.<br />
<br />
Each resource has a soft and a hard limit. The soft limit has little effect, but the hard limit does:<br />
<br />
* If a guest exceeds the <code>rss</code> hard limit, the kernel will invoke the Out-of-Memory (OOM) killer to kill some process in the guest;<br />
* If a guest exceeds the <code>as</code> hard limit, memory allocation attempts will return an error, but no process is killed.<br />
<br />
The hard limit of the '''as''' resource refers to the total number of pages mapped in processes. The purpose of the soft limit is unknown.<br />
<br />
Bertl explained the difference between '''rss''' and '''as''' with the following example. If two processes share 100 MB of memory, then only 100 MB worth of virtual memory pages can be used at most, so the RSS use of the guest increases by 100 MB. However, two processes are using it, so the AS use increases by 200 MB. <br />
<br />
This makes me think that limiting AS is less useful than limiting RSS, since it doesn't directly reflect real, limited resources (RAM and swap) on the host, that deprive other virtual machines of those resources. Bertl says that AS limits can be used to give guests a "gentle" warning that they are running out of memory, but I don't know how much more gentle it is, or how to set it accurately. <br />
<br />
For example, 100 processes each mapping a 100 GB file would consume a total of 10 GB of address space (AS), but no more than 100 MB of resources on the host. But if you set the AS limit to 10 GB, then it will not stop one process from allocating 4 GB of RAM, which could kill the host or result in that process being killed by the OOM killer.<br />
<br />
You can set the hard limit on a particular context, effective immediately, with this command:<br />
<br />
<pre><br />
/usr/sbin/vlimit -c <xid> --<resource> <value><br />
</pre><br />
<br />
For example, if you want to change the '''rss''' hard limit for the vserver with <xid> 49000 (which you can determine with /usr/sbin/vserver-stat), and limit it to 50,000 pages (200 MB), you could use this command:<br />
<br />
<pre><br />
/usr/sbin/vlimit -c 49000 --rss 50000<br />
</pre><br />
<br />
You can change the soft limit instead by adding the -S parameter.<br />
<br />
Changes made with the vlimit command are effective only until the vserver is stopped. To make permanent changes, write the value to /etc/vservers/<name>/rlimits/<resource> for the soft limit, or <resource>.hard for the hard limit. You may need to create the rlimits directory. Changes to these files take effect only when the vserver is started. To make immediate and permanent changes to a running vserver, you need to run vlimit '''and''' update the rlimits file.<br />
<br />
The safest setting, to prevent any guest from interfering with any other, is to set the total of all RSS hard limits (across all running guests) to be less than the total virtual memory (RAM and swap) on the host. It should be sufficiently less to leave room for processes running on the host, and some disk cache, perhaps 100 MB.<br />
<br />
However, this is very conservative, since it assumes the worst case where all guests are using the maximum amount of memory at one time. In practice, you can usually get away with contended resources, i.e. allowing guests to use more than this value.</div>62.253.128.13http://linux-vserver.org/Memory_LimitsMemory Limits2006-09-27T23:08:20Z<p>62.253.128.13: </p>
<hr />
<div>A vserver kernel keeps track many resources used by each guest (context). Some of these relate to memory usage by the guest. You can place limits on these resources to prevent guests from using all the host memory and making the host unusable.<br />
<br />
Two resources are particularly important in this regard: '''rss''' and '''as'''. These refer to the '''resident set size''' and '''address space''' respectively. Both are measured in '''pages''', which are 4 kB each on Intel machines (i386). So a value of 200000 means a limit of 800,000 kB, a little less than 800 MB.<br />
<br />
Each resource has a soft and a hard limit. The soft limit of the '''rss''' resource refers to the amount of physical memory (RAM) which the guest context may use. The hard limit refers to the amount of virtual memory (RAM and swap) which the guest context may use. If the guest exceeds the hard limit, then the kernel will invoke the Out-of-Memory (OOM) killer to kill some process in the guest.<br />
<br />
The hard limit of the '''as''' resource refers to the total number of pages mapped in processes. The purpose of the soft limit is unknown.<br />
<br />
Bertl explained the difference between '''rss''' and '''as''' with the following example. If two processes share 100 MB of memory, then only 100 MB worth of virtual memory pages can be used at most, so the RSS use of the guest increases by 100 MB. However, two processes are using it, so the AS use increases by 200 MB. <br />
<br />
This makes me think that limiting AS is less useful than limiting RSS, since it doesn't directly reflect real, limited resources (RAM and swap) on the host, that deprive other virtual machines of those resources. Bertl says that AS limits can be used to give guests a "gentle" warning that they are running out of memory, but I don't know how much more gentle it is, or how to set it accurately. <br />
<br />
For example, 100 processes each mapping a 100 GB file would consume a total of 10 GB of address space (AS), but no more than 100 MB of resources on the host. But if you set the AS limit to 10 GB, then it will not stop one process from allocating 4 GB of RAM, which could kill the host or result in that process being killed by the OOM killer.<br />
<br />
You can set the hard limit on a particular context, effective immediately, with this command:<br />
<br />
<pre><br />
/usr/sbin/vlimit -c <xid> --<resource> <value><br />
</pre><br />
<br />
For example, if you want to change the '''rss''' hard limit for the vserver with <xid> 49000 (which you can determine with /usr/sbin/vserver-stat), and limit it to 50,000 pages (200 MB), you could use this command:<br />
<br />
<pre><br />
/usr/sbin/vlimit -c 49000 --rss 50000<br />
</pre><br />
<br />
You can change the soft limit instead by adding the -S parameter.<br />
<br />
Changes made with the vlimit command are effective only until the vserver is stopped. To make permanent changes, write the value to /etc/vservers/<name>/rlimits/<resource> for the soft limit, or <resource>.hard for the hard limit. You may need to create the rlimits directory. Changes to these files take effect only when the vserver is started. To make immediate and permanent changes to a running vserver, you need to run vlimit '''and''' update the rlimits file.<br />
<br />
The safest setting, to prevent any guest from interfering with any other, is to set the total of all RSS hard limits (across all running guests) to be less than the total virtual memory (RAM and swap) on the host. It should be sufficiently less to leave room for processes running on the host, and some disk cache, perhaps 100 MB.<br />
<br />
However, this is very conservative, since it assumes the worst case where all guests are using the maximum amount of memory at one time. In practice, you can usually get away with contended resources, i.e. allowing guests to use more than this value.</div>62.253.128.13http://linux-vserver.org/Frequently_Asked_QuestionsFrequently Asked Questions2006-09-27T22:20:21Z<p>62.253.128.13: </p>
<hr />
<div><div style="margin: 2em auto 2em auto; padding: 10px; background-color: #F9ECCD; border: 1px solid #004433; text-align: center;"><br />
[[Image:Icon-Caution.png|left]]<br />
We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the [[Wiki Team]] page for instructions how to help or look at the [http://oldwiki.linux-vserver.org old wiki] to find the information not migrated yet.<br />
<br />
'''To ease migration we created a [[List of old Documentation pages]].'''<br />
</div><br />
<br />
CURRENTLY THE CONTENT OF THE OLD WIKI FAQ (AND MORE) IS BEING MIGRATED TO THIS PAGE (TASK: DERJOHN)<br />
<br />
<br />
__TOC__<br />
<br />
{{Question|Question=What is a 'Guest'?||Details=To talk about stuff, we need some naming. The physical machine is called 'Host' and the 'main' context running the Host Distro is called 'Host Context'. The virtual machine/distro is called 'Guest' and basically is a Distribution (Userspace) running inside a 'Guest Context'.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=What kind of Operating System (OS) can I run as guest?||Details=<br />
A: With VServer you can only run Linux guests. The trick is that a guest does not run a kernel on its own (as XEN and UML do), it merely uses a virtualized host kernel-interface. VServer offers so called security contexts which make it possible to seperate one guest from each other, i.e. they cannot get data from each other. Imagine it as a chroot environment with much more security and features.|Signature=derjohn}}<br />
<br />
{{Question|Question=Which distributions did you test?||Details=<br />
A: Some. Check out the wiki for ready-made guest images. But you can easily build own guest images, e.g. with Debian's debootstrap. Checkout ((step-by-step Guide 2.6)) how to do that.|Signature=derjohn}}<br />
<br />
{{Question|Question=Is VServer comparable to XEN/UML/QEMU?||Details=<br />
A: Nope. XEN/UML/QEMU and VServer are just good friends. Because you ask, you probably know what XEN/UML/QEMU are. VServer in contrary to XEN/UML/QEMU not "emulate" any hardware you run a kernel on. You can run a VServer kernel in a XEN/UML/QEMU guest. This is confirmed to work at least with Linux 2.6/vs2.0.|Signature=derjohn}}<br />
<br />
{{Question|Question=Is VServer secure?||Details=<br />
A: We hope so. It should be as least as secure as Linux is. We consider it much much more secure though.|Signature=derjohn}}<br />
<br />
{{Question|Question=Performance?||Details=<br />
A: For a single guest, we basically have native performance. Some tests showed insignificant overhead (about 1-2%) others ran faster than on an unpatched kernel. This is IMVHO significantly less than other solutions waste, especially if you have more than a single guest (because of the resource sharing).|Signature=derjohn}}<br />
<br />
{{Question|Question=Is SMP Supported?||Details=<br />
A: Yes, on all SMP capable kernel architectures.|Signature=derjohn}}<br />
<br />
{{Question|Question=Resource sharing?||Details=<br />
A: Yes ....<br />
* memory: Dynamically.<br />
* CPU usage: Dynamically (token bucket)|Signature=derjohn}}<br />
<br />
{{Question|Question=Resource limiting?||Details=<br />
A: Yes, you can set maximum limits per guest, but you can only offer guaranteed resource availability with some ticks at the time. There is the possibility to ulimit and to rlimit. Rlimit is a new feature of kernel 2.6/vs2.0.|Signature=derjohn}}<br />
<br />
{{Question|Question=Disk I/O limiting? Is that possible?||Details=<br />
A: Well, since vs2.1.1 linux-vserver supports a mechanism called 'I/O scheduling', which appeared in the 2.6 mainline some time ago. The mainline kernel offers several I/O schedulers:<br />
<br />
<pre><br />
# cat /sys/block/hdc/queue/scheduler<br />
noop [anticipatory] deadline cfq<br />
</pre><br />
<br />
The default is anticipatory a.k.a. "AS". When running several guests on a host you probably want the I/O performance shared in a fair way among the different guests. The kernel comes with a "completely fair queueing" scheduler, CFQ, which can do that. (More on schedulers can be found at http://lwn.net/Articles/114770/)<br />
<br />
This is how to set the scheduler to "cfq" manually:<br />
<pre><br />
root# echo "cfq" > /sys/block/hdc/queue/scheduler<br />
root# cat /sys/block/hdc/queue/scheduler<br />
noop anticipatory deadline [cfq]<br />
</pre><br />
<br />
Keep in mind that you have to do it on all physical discs. So if you run an md-softraid, do it to all physical /dev/hdXYZ discs!<br />
<br />
If you run Debian there is a predefined way to set the /sys values at boot-time:<br />
<br />
<pre><br />
# apt-get install sysfsutils<br />
[...]<br />
<br />
# cat /etc/sysfs.conf | grep cfq<br />
block/sda/queue/scheduler = cfq<br />
block/sdc/queue/scheduler = cfq<br />
<br />
# /etc/init.d/sysfsutils restart<br />
</pre><br />
<br />
For non-vserver processes and CFQ you can set by which key the kernel decides about the fairness:<br />
<br />
<pre><br />
cat /sys/block/hdc/queue/iosched/key_type<br />
pgid [tgid] uid gid<br />
</pre><br />
Hint: The 'key_type'-feature has been removed in the mainline kernel recently. Don't look for it any longer :(<br />
<br />
The default is tgid, which means to share fairly among process groups. Think every guest is treated like a own process group. It's not possible to set a scheduler strategy within a guest. All processes belonging to the same guest are treated like "noop" within the guest. So: If you run apache and some ftp-server within the _same_ guest, there is no fair scheduling between them, but there is fair scheduling between the whole guest and all other guests.<br />
<br />
And: It's possible to tune the scheduler parameters in several ways. Have a look at /sys/block/hdc/queue/....<br />
<br />
You need a very recent Version of VS devel, e.g. the 2.1.1-rc18 can do it. Some older version have that feature too, then it got lost and was reinvented. So: Go and get a rc18 - only in 'devel', not stable!|Signature=derjohn}}<br />
<br />
{{Question|Question=Why isn't there a device /dev/bla? within a guest||Details=<br />
A: Device nodes allow Userspace to access hardware (or virtual resources). Creating a device node inside the guest's namespace will give access to that device, so for security reasons, the number of 'given' devices is small.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is Unification (vunify)?||Details=<br />
A: Unification is Hard Links on Steroids. Guests can 'share' common files (usually binaries and libraries) in a secure way, by creating hard links with special properties (immutable but unlinkable (removable)). The tool to identify common files and to unify them is called vunify.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is vhashify?||Details=<br />
A: The successor of vunify, a tool which does unification based on hash values (which allows to find common files in arbitrary paths.)|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I manage a multi-guest setup with vhashify?||Details=<br />
A: For 'vhashify', just do these once:<br />
<br />
<pre><br />
mkdir /etc/vservers/.defaults/apps/vunify/hash /vservers/.hash<br />
ln -0s /vservers/.hash /etc/vservers/.defaults/apps/vunify/hash/root<br />
</pre><br />
<br />
Then, do this one line per vserver:<br />
<br />
<pre><br />
mkdir /etc/vservers/<vservername>/apps/vunify # vhashify reuses vunify configuration<br />
</pre><br />
<br />
<br />
The command 'ln' creates a link between two files. "ln -s" creates a symbolic link -- two files are linked by name. "ln -0s" uses a Vserver extention to create a unified link.|Signature=derjohn}}<br />
<br />
{{Question|Question=With which VS version should I begin?||Details=<br />
A: If you are new to VServer I recommend to try 2.0.+. Take "alpha utils" Version 0.30.210. In Debian Sid there appeared well running version of it recently. (It's a .210 at the time of writing).|Signature=derjohn}}<br />
<br />
{{Question|Question=is there a way to implement "user/group quota" per VServer?||Details=<br />
A: Yes, but not on a shared partition for now. You need to put the guest on a separate partition, setup a vroot device (to make the quota access secure), copy that into the guest, and adjust the mtab line inside the guest.|Signature=derjohn}}<br />
<br />
{{Question|Question=what about "Quota" for a context?||Details=<br />
A: Context quotas are now called Disk Limits (so that we can tell them apart from the user/group quotas :). They are supported out of the box (with vs2.0) for all major filesystems (Ext2/3, ReiserFS, XFS, JFS)|Signature=derjohn}}<br />
<br />
{{Question|Question=Does it support IPv6?||Details=<br />
A: Currently not. Some developer has to move his ... to reimplement this functionality from the V4 code (I read that on the ML ;)). Will probably be superseded by the ngnet (next generation networking) soon. There is a Wiki page regarding this: http://linux-vserver.org/IPv6|Signature=derjohn}}<br />
<br />
{{Question|Question=I can't do all I want with the network interfaces inside the guest?||Details=<br />
A: For now the networking is 'Host Business' -- the host is a router, and each guest is a server. You can set the capability ICMP_RAW in the context of the guest, or even the capability CAP_NET_RAW (which would even allow to sniff interfaces of other guests!). Likely to change with ngnet. |Signature=derjohn}}<br />
<br />
{{Question|Question=Is there a web-based interface for vserver that will allow creation/deletion/configuration etc. of vserver guests?||Details=<br />
A. [Update] Errrh, there is http://OpenVPS.org which is a set of scripts with a web-interface for webhosters/ISPs. <br />
A. [Update] Errrh, there is http://Openvcp.org which is a distributed system (agent!) with a web-interface, with which you can build/remove guests! cool stuff! beta, try out!|Signature=derjohn}}<br />
<br />
{{Question|Question=What is old-style and new-style config?||Details=<br />
A. Old-style config refers to a single text-file that contains all the configuration settings. With new-style config the configuration is split into several directories and files. You should probably go for new-style config if you are asking.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is the "great flower page"?||Details=<br />
A. Well, this page contains all configation options for vserver in version > 1.9 (I think .. I joined Linux-VServer in version 2, so I don't know for sure). The name of the page is derivived from the stylesheet(s) it contains: It displays background pictures of a very great flower, so regard it as highly optimized. It was designed by a non-designer, who asks us to create a better one. I played with the thought of creating a complete new theme for that page - but actually we all got used to the name "great flower page", so we stick to it. If you are unable to read it clearly, feel invited to join the IRC channel #vserver, we may tell you how to ;)|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I add several IPs to a vserver? ||Details=<br />
A: First of all a single guest vserver only supports up to 16 IPs (There is a 64-IP patch available, which is in "derjohn's kernel", you need extra util-vserver anyway).<br />
Here is a little helper-script that adds a list of IPs defined in a text file, one per line.<br />
<pre><br />
#!/bin/bash<br />
j=1<br />
for i in `cat myiplist`; do<br />
j=$(($j+1))<br />
mkdir $j<br />
echo $i > $j/ip<br />
echo $i > $j/ip-old<br />
echo "24" > $j/prefix<br />
done<br />
</pre>|Signature=derjohn}}<br />
<br />
{{Question|Question=If my host has only one a single public IP, can I use RFC1918 IP (e.g. 192.168.foo.bar) for the guest vservers?||Details=<br />
A: Yes, use iptables with SNAT to masquerade it. <br />
<pre><br />
iptables -t nat -I POSTROUTING -s $VSERVER_NETZ ! -d $VSERVER_NETZ -j SNAT --to $EXT_IP<br />
</pre><br />
See: HowtoPrivateNetworking and <br />
http://www.tgunkel.de/it/software/doc/linux_server#h3-Vserver_Masquerading_SNAT (THX, [MUPPETS]Gonzo)|Signature=derjohn}}<br />
<br />
{{Question|Question=If I shut down my vserver guest, the whole Internet interface ethX on the host is shut down. What happened? ||Details=<br />
A: When you shut down a guest (''i.e. vserver foo stop''), the IP is brought down on the host also. If this IP happens to be the primary IP of the host, the kernel will not only bring down the primary IP, but also all secondary IP addresses. But in very recent kernels, there is an option ''settable'' which prevents that nasty feature. It's called "alias promotion". You may set it via sysctl by adding ''net.ipv4.conf.all.promote_secondaries=1'' in /etc/sysctl.conf or via sysctl command line.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=On Debian Sarge (stable) only util-vserver is 0.30-204 available, which has been reported to be buggy (I didnt check the version for longer time) How do I compile a local version of alpha util-vserver .210 on Debian?||Details=<br />
A:<br />
<pre><br />
apt-get build-dep util-vserver<br />
<br />
./configure --prefix=/usr/local/ --enable-release \<br />
--mandir=/usr/local/share/man \<br />
--infodir=/usr/local/share/info \<br />
--sysconfdir=/etc --enable-dietlibc \<br />
--localstatedir=/var \<br />
--with-vrootdir=/var/lib/vservers<br />
<br />
make<br />
<br />
make install-distribution<br />
(Which does a make install + setting a symlink ln -s /usr/local/lib/util-vserver/vshelper /sbin/vshelper )<br />
<br />
</pre><br />
<br />
To test which version you are running:<br />
<pre><br />
# which vserver<br />
/usr/local/sbin/vserver<br />
<br />
</pre><br />
<br />
This should point to ..local...<br />
<br />
If you dont want to build it yourself: On www.backports.org there are backported (for sarge) linux-images (2.6.16) with vserver-patch enabled and a updated util-vserver package as well.<br />
|Signature=derjohn}}<br />
<br />
{{Question|Question=I use derjohn's kernel or a differnet kernel with a more-than-16-IPs-per-guest-patch and can't use more than 16 IPs. Why?||Details=<br />
A: You need to patch util-vserver, too. So you obviously need to recompile util-vserver (see above). In the util-vserver directory there are header files in the ./kernel/ directory. Patch like this:<br />
<br />
<pre><br />
kernel/network.h:#define NB_IPV4ROOT 64<br />
</pre><br />
<br />
BTW: The initial patches can be found here: http://vserver.13thfloor.at/Experimental/VARIOUS/util-vserver-0.30.196-net64.diff.bz2 and http://vserver.13thfloor.at/Experimental/VARIOUS/delta-2.6.9-vs1.9.3-net64.diff<br />
|Signature=unknown}}<br />
<br />
{{Question|Question=I run a Debian host and want to build an Ubuntu guest. Howto?||Details=<br />
A: Simple ;) Assume you want to build a breezy guest on a sid host with IP 192.168.0.2 and hostname vubuntu, then do:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu<br />
</pre><br />
<br />
[UPDATE] Currently there are problems in building breezy under unclear circumstances, which seems to have to do with udev. If the above didnt work, try:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu -- --exclude=udev<br />
</pre><br />
In very recent versions of the utils, the problem should not occur anymore (it has to do with the 'secure-mount' if you look in the MLs)<br />
<br />
Well, sid's debootstrap knows how to bootstrap Ubuntu linux. Make sure to have a current debootstrap package: <br />
<pre><br />
apt-get update<br />
apt-get install debootstrap<br />
</pre><br />
The knowledge how to build ubuntu 'breezy badger' (which you probably want to be your guest at the time of writing) has been added recently.|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I make a vserver guest start by default?||Details=<br />
A: At least on Debian, I can tell you how to do it with the new-style config. If your guest is called "derjohn" and you want it to be started somewhere at the of your bootstrap process, then do:<br />
<pre><br />
echo "default" > /etc/vservers/derjohn/apps/init/mark<br />
</pre><br />
If you want to start it earlier, please read the init script "/etc/init.d/vserver-default" to find out how to do it. In most cases you don't need to change this. On Debian the vservers are started at "90", so after most other stuff is up (networking etc.).<br />
<br />
Besides that I created a small helper script for managing the autostart foo: ((vserver-autostart))|Signature=derjohn}}<br />
<br />
{{Question|Question=My host works, but when I start a guest it says that it has a problem with chbind.||Details=<br />
A: You are probably using util-vserver <= 0.30.209, which does use dynamic network contexts internally (With 0.30.210 this fact changed). So if you compiled your kernel without dynamic contexts, you may start guests, but you can't use the network context.The solution is either to switch to .210 util (or Hollow's toolset) or compile the kernel with dynamic network contexts.<br />
SE Keyword: invalid option `nid' testme.sh|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=When I try to ssh to the guest, I log into the host, even if I installed sshd on the guest. What's wrong here?||Details=<br />
A: Look at /etc/ssh/sshd_config of the host:<br />
<br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
#ListenAddress ::<br />
</pre><br />
<br />
And now change the setting to <br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
ListenAddress your.hosts.ip.here # not the guests IP! <br />
</pre><br />
<br />
Then '/etc/init.d/ssh restart' on the host, after that on the guest (if you did apt-get install ssh on the guest already.)<br />
<br />
Do I have to explain more? If the hosts sshd binds all available IP addresses on port 22 (The hosts 'sees' even all addresses of the guests!). So if the guest starts its sshd, it cant bind to port 22 any more. You need to change that setting only on the host. <br />
(BTW: A similar approach has to be done for a lot of daemons, e.g. Apache. If the daemon does not support an explicit bind, you may use the chbind command to 'hide' IP addresses from the daemon before starting.)|Signature=derjohn}}<br />
<br />
{{Question|Question=I did everything right, but the application foo does not start. What's up there?||Details=<br />
A: Before asking on the IRC channel, please check out the 'problematic programs' page:<br />
[[Problematic Programs]]|Signature=derjohn}}<br />
<br />
{{Question|Question=Bind9 does not like to start in my guest.||Details=<br />
A: Check out the 'problematic programs' page:<br />
((ProblematicPrograms)) and/or get my [((ProblematicPrograms)) and/or get my [http://linux-vserver.derjohn.de/bind9-packages/bind9-capacheck_9.3.2-2_i386.deb vserver-guest-ready Debian package] for Debian Sid guests from that URL: http://linux-vserver.derjohn.de/bind9-packages/bind9-capacheck_9.3.2-2_i386.deb and check out the [http://linux-vserver.derjohn.de/bind9-packages/README.txt readme]. (Hint: This is fresh stuff. The give me Feedback)<br />
<br />
[UPDATE] Since VServer Devel 2.1.1-rc18 you do not need to patch the userland tools anymore. The capabilities are masked.|Signature=derjohn}}<br />
<br />
{{Question|Question=Which guest vservers are running?||Details=<br />
A: {{vserver-stat}}. Example output:<br />
<pre><br />
CTX PROC VSZ RSS userTIME sysTIME UPTIME NAME<br />
0 77 965.1M 334.6M 14m14s18 2m28s69 1h33m46 root server<br />
49152 7 14M 5.2M 0m00s40 0m00s30 1h30m15 chiffon<br />
</pre>|Signature=derjohn}}<br />
<br />
<br />
<br />
{{Question|Question=How can I reboot/halt guests?||Details=<br />
A: It depends. <br />
For vserver with legacy-interfaces support, you have to replace {{/sbin/halt}} in guests with vreboot and start rebootmgr in host. You also need to have a dummy <guest>.conf file in /etc/vservers for each guest. Please have a look at /etc/init.d/rebootmgr.<br />
Vserver with native interface utilizes /dev/initctl. No changes are needed in guests. Just make sure that REBOOT capability is adjusted in guests.|Signature=derjohn}}<br />
<br />
{{Question|Question=Do I really need the legacy-interfaces? What are these legacy-interfaces?||Details=<br />
A: Since vserver is an ongoing project, new features might replace old ones, some might still on development. Legacy-interfaces are available for backward compability (which might be removed someday). See Q: How can I reboot/halt guests?|Signature=derjohn}}<br />
<br />
{{Question|Question= I have a vserver running on a Linux kernel with preemption. Is VServer "preempt" safe?||Details=<br />
A: There are no known issues about running vserver on a preemption enabled kernel. I would like to add, that the vserver kernelhackers would probably exclude that option in 'make menuconfig' if there would be an incompatibility. Just my $.02 :)|Signature=derjohn}}<br />
<br />
{{Question|Question=Is this a new project? When was it started?||Details=<br />
A: The first public occurance of linux-vserver was Oct 2001. The initial mail can be found here: http://www.cs.helsinki.fi/linux/linux-kernel/2001-40/1065.html<br />
So you can expect a mature software product wich does it's magic quite well (And hey, we have a version > 2.0 ! )|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=Can I run an OpenVPN Server in a guest?||Details=<br />
A: Yes. I don't want to provide an in-depth OpenVPN tutorial, but want to show how I made OpenVPN work in a guest as server. I was not able to run it with a tun devive, due to a buglet in util-vserver and kernel when it comes to settings a an ip address a point to point link: If you add "ip addr add <ip> peer <mypeer> dev tun0" there is no way to map the tun0 interface into a guest, even not with a 'nodev' option. (bug confirmed to be reproducible by daniel_hoczac)<br />
<br />
First of all you have to prepare the host with a persistent tuntap interface in tap-mode. The tools we need come from the uml-utilities.<br />
Then you need to create a device /dev/net/tun, which the OpenVPN userspace daemon reads. Well assume 10.10.10.100 is the server IP, and 10.10.10.101 is the client ip - to be cool be choose a /31 netmask (255.255.255.254), so we have a net without broadcast and don't waste IPs :)<br />
<br />
On the host do: <br />
<pre><br />
# apt-get install uml-utilities<br />
# cd /var/lib/vserver/<myopenvpnserver>/dev/<br />
# ./MAKEDEV tun<br />
(creates the dev/net/tun device accessible by te guest - even a tap interface need /dev/net/tun !)<br />
# tunctl -t tap0<br />
(creates the network device 'tap0' persistently)<br />
</pre><br />
<br />
Then add the ip to the guest:<br />
<pre><br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/ip<br />
10.10.10.100<br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/prefix<br />
31<br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/dev<br />
tap0<br />
(This kind of config brings the ip when the vserver is started - only the tap0 interface has to exist already, see above!)<br />
</pre><br />
<br />
Here is a sample config for the guest (which is acting as a server):<br />
<br />
Install OpenVPN package on server and client, in the Debian case:<br />
<pre><br />
# apt-get install openvpn<br />
</pre><br />
<br />
The server's conf looks like that:<br />
<pre><br />
# port and interface specs<br />
<br />
# behave like a ssl-webserver<br />
port 443<br />
proto tcp-server<br />
<br />
# tap device? (keep in mind you need /dev/net/tun !)<br />
dev tap0<br />
<br />
# now the ips we will use for the tunnel<br />
ifconfig 10.10.10.100 255.255.255.254<br />
ifconfig-noexec<br />
<br />
# the server part<br />
<br />
# Keep VPN connections, even if the client IP changes<br />
float<br />
<br />
# use compression (may also even obfuscate content filters)<br />
comp-lzo<br />
<br />
# use a static key - create it with 'openvpn --genkey --secret static.key'<br />
secret static.key<br />
<br />
# dont reload the key after a SIGUSR1<br />
persist-key<br />
<br />
# check alive all 10 secs<br />
keepalive 10 60<br />
<br />
# verbosity level (from 1 to 9, 9 is max log level)<br />
verb 4<br />
status openvpn-status.log<br />
</pre><br />
<br />
The client's conf may look like that (This example even makes the tunnel the clients default address):<br />
<pre><br />
# cat /etc/openvpn/client.conf<br />
# port and interface specs<br />
<br />
# the following is not necessary, if you bring up openvpn via Debian's init script:<br />
daemon ovpn-my-clients-name<br />
<br />
# behave like a ssl-webserver<br />
port 443<br />
proto tcp-client<br />
remote %%%<insert-the-guest-primary-public-ip-here>%%%%<br />
# what device tun ot tap?<br />
dev tap<br />
<br />
# now the ips we will use for the tunnel<br />
ifconfig 10.10.10.101 255.255.255.254<br />
<br />
# Keep VPN connections, even if the client IP changes<br />
float<br />
mssfix<br />
<br />
# use compression (may also even obfuscate content filters)<br />
comp-lzo<br />
<br />
# use a static key<br />
secret static.key<br />
<br />
# dont reload the key after a SIGUSR1<br />
persist-key<br />
<br />
# check alive all 10 secs<br />
keepalive 10 60<br />
<br />
# verbosity level (from 1 to 9, 9 is max log level)<br />
verb 4<br />
<br />
# set the default route<br />
route-gateway 10.10.10.100<br />
redirect-gateway def1<br />
# to add special routes you can do it wihtin the openvpn client conf:<br />
# route <dest> <mask> <gateway><br />
<br />
# if you need to connect via proxy (like squid)<br />
# http-proxy s p [up] [auth] : Connect to remote host through an HTTP proxy at<br />
# address s and port p. If proxy authentication is required,<br />
# up is a file containing username/password on 2 lines, or<br />
# 'stdin' to prompt from console. Add auth='ntlm' if<br />
# the proxy requires NTLM authentication.<br />
<br />
# http-proxy s p [up] [auth]<br />
<br />
<br />
# http-proxy-option type [parm] : Set extended HTTP proxy options.<br />
# Repeat to set multiple options.<br />
# VERSION version (default=1.0)<br />
# AGENT user-agent<br />
<br />
# http-proxy-option type [parm]<br />
</pre><br />
<br />
In the next lesson I will talk about OpenVPN's server mode, which can deal with with multiple clients connecting to one ip and one port (i.e. you only need one guest for tons or 'roadwarriros'), tls connections and pki.<br />
<br />
Contributions welcome. :)|Signature=derjohn}}<br />
<br />
{{Question|Question=32 vs 64 Bit? What should I take?||Details=<br />
A: If you have the choice make the host a 64 bit one. You can run a guest as 32 bit or as 64 bit on a 64 bit host. To run it as 32 bit, you need to compile the x86_64 (a.k.a. AMD64) with the following options:<br />
<br />
<pre><br />
[*] Kernel support for ELF binaries<br />
<M> Kernel support for MISC binaries<br />
[*] IA32 Emulation <---- without that, the entire 32bit API is not present<br />
<M> IA32 a.out support <br />
</pre><br />
<br />
You can force the guest to behave like a 32 environment like this:<br />
<pre><br />
echo linux_32bit > /etc/vservers/$NAME/personality<br />
echo i686 > /etc/vservers/$NAME/uts/machine<br />
</pre><br />
(thanks cehteh for the hint!)<br />
<br />
But you can force debootstrap to but 32 bit binaries into the guest by 'export ARCH=i386';<br />
<pre><br />
export ARCH=i386 ; vserver build .... <br />
</pre>|Signature=derjohn}}<br />
<br />
{{Question|Question=I want to (re)mount a partition in a running guest ... but the guest has no rights (capability) to (re)mount?||Details=<br />
A: I'll explain. I take as example your /tmp partition within the guest is too small, what will be likely the case if you stay with the 16MB default (vserver build mounts /tmp as 16 MB tempfs!).<br />
<pre><br />
# vnamespace -e XID mount -t tmpfs -o remount,size=256m,mode=1777 none /var/lib/vservers/<guest>/tmp/<br />
</pre><br />
Be warned that the guest will not recognize the change, as the /etc/mtab file is not updated when you mount like this. To permanently change the mount, edit /etc/vserver/<guest>/fstab on the host.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=How do I limit a guests RAM? I want to prevent OOM situations on the host!||Details=<br />
A: First you can read [http://linux-vserver.org/Memory+Allocation] and [[Memory Limits]].<br />
<br />
If you want a recipe, do that:<br />
1. Check the size of memory pages. On x86 and x86_64 is usually 4 KB per page.<br />
2. Create /etc/vserver/<guest>/rlimits/<br />
3. Check your physical memory size on the host, e.g. with "free -m". maxram = kilobytes/pagesize.<br />
4. Limit the guests physical RAM to value smaller then maxram:<br />
<br />
<pre><br />
echo %%insertYourPagesHereSmallerThanMaxram%% > /etc/vserver/<guest>/rlimits/rss<br />
</pre><br />
<br />
5. Check your swapspace, e.g. with 'swapon -s'. maxswap = swapkilobytes/pagesize.<br />
6. Limit the guest's maximum number of as pages to a value smaller than (maxram+maxswap):<br />
<br />
<pre><br />
echo %%desiredvalue%% > /etc/vserver/<guest>/rlimits/as<br />
</pre><br />
<br />
It should be clear this can still lead to OOM situations. Example: You have two guests and your as limit per guest is greater than 50% of (maxram+maxswap). If both guests request their maximum at the same point in time, there will be not enough mem .....|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=Were can I get newer versions of VServer as ready made packages for Debian?||Details=<br />
A: Here you go: http://linux-vserver.derjohn.de/ . There is also some stuff on backports.org, but my kernels are always 'devel' branch.|Signature=derjohn}}<br />
<br />
{{Question|Question=Can I use iptables ?||Details=<br />
Yes but right now only on the host (rootserver). Please realize that all traffic is local and will not touch the forward chain.|Signature=BeginnerFAQ}}<br />
<br />
{{Question|Question=Trying to connect to a vserver from the host or another vserver on the same host fails||Details=<br />
strace shows<br />
<pre> <br />
sin_addr=inet_addr("xx.xx.xx.xx")}, yy) = -1 EINVAL (Invalid argument)<br />
</pre><br />
A: The host/guest cannot communicate with another guest on same host.<br />
* check all netmasks on all interfaces (do they overlap) ?<br />
* check policy routing (disable it temporary) ?<br />
* check that lo is up (Networking within a host/guest always uses lo interface)<br />
|Signature=CommonProblems}}<br />
<br />
{{Question|Question=#1 ERROR: capset(): Operation not permitted||Details=capabilities are not enabled in kernel-setup<br />
please check that CONFIG_SECURITY_CAPABILITIES is loaded or included in the kernel. ( check with "cat /path_to_kernel/.config | grep -i cap ")<br />
(2.6.11.5-vs-1.9.5 + 0.30-205)|Signature=IrcQuestions}}<br />
<br />
{{Question|Question=How can I make 'vserver start' mount the root filesystem||Details=<br />
mount it via /etc/vservers/vserver-name/fstab, make sure to set the option 'dev' e.g.:<br />
<pre>/dev/drbd0 / xfs rw,dev 0 0</pre><br />
util-vserver 210 won't be able to find some scripts for the reboot, add into /etc/vservers/vserver-name/apps/init/cmd.stop<br />
<pre>/etc/init.d/rc<br />
6</pre><br />
|Signature=AdrianReyer}}<br />
<br />
{{Question|Question=How do I tag a guest's directory with xid?||Details=<br />
Tagging the guest's files gives you serveral advantages, e.g. the accoutung will work properly.<br />
Filesystem XID tagging only works on supported filesystem. Those are currently: ext2/3, reiserfs/reiser3, xfs and jfs.<br />
To activate the XID tagging you have to mount the filesystem with "-o tagxid". Attention: It's _not_ possible to "-o remount,tagxid", you have to mount it freshly. The guests will tag their files automatiaclly. If you copy files in from the host, you have to tag them manually like this:<br />
<pre>chxid -c xid -R /var/lib/vservers/<guest></pre><br />
Note: Context 0 and 1 will see all files, guests will only be able to acess untagged files and their own XID. They can see other XID files but no information about the file, e.g. no owner, no group, no permissions.<br />
|Signature=derjohn_and_gonzo_and_are}}<br />
<br />
More FAQs to be merged;<br />
[http://www.linux-vserver.org/Frequently_Asked_Questions_scratch]<br />
<br />
{{Question|Question=My mysqld running in a guest behaves strangely and is awfully slow/locks up||Details=<br />
This can be related to /tmp being too small. mysqld stores temporary tables in /tmp and as such, if a lot of queries happen and /tmp runs full this can cause one query to lock up whilst creating the tmp table and all other queries waiting to acquire the lock. There are two possible solutions to that problem: a.) Modify /etc/vservers/vserver-name/fstab and assign more memory to the tmpfs of /tmp and b.) remove the /tmp entry from /etc/vservers/vserver-name/fstab completly. Especially on database servers with a rather high load the second one might be the preferred method.|Signature=sp}}</div>62.253.128.13http://linux-vserver.org/Frequently_Asked_QuestionsFrequently Asked Questions2006-09-27T22:19:54Z<p>62.253.128.13: </p>
<hr />
<div><div style="margin: 2em auto 2em auto; padding: 10px; background-color: #F9ECCD; border: 1px solid #004433; text-align: center;"><br />
[[Image:Icon-Caution.png|left]]<br />
We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the [[Wiki Team]] page for instructions how to help or look at the [http://oldwiki.linux-vserver.org old wiki] to find the information not migrated yet.<br />
<br />
'''To ease migration we created a [[List of old Documentation pages]].'''<br />
</div><br />
<br />
CURRENTLY THE CONTENT OF THE OLD WIKI FAQ (AND MORE) IS BEING MIGRATED TO THIS PAGE (TASK: DERJOHN)<br />
<br />
<br />
__TOC__<br />
<br />
{{Question|Question=What is a 'Guest'?||Details=To talk about stuff, we need some naming. The physical machine is called 'Host' and the 'main' context running the Host Distro is called 'Host Context'. The virtual machine/distro is called 'Guest' and basically is a Distribution (Userspace) running inside a 'Guest Context'.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=What kind of Operating System (OS) can I run as guest?||Details=<br />
A: With VServer you can only run Linux guests. The trick is that a guest does not run a kernel on its own (as XEN and UML do), it merely uses a virtualized host kernel-interface. VServer offers so called security contexts which make it possible to seperate one guest from each other, i.e. they cannot get data from each other. Imagine it as a chroot environment with much more security and features.|Signature=derjohn}}<br />
<br />
{{Question|Question=Which distributions did you test?||Details=<br />
A: Some. Check out the wiki for ready-made guest images. But you can easily build own guest images, e.g. with Debian's debootstrap. Checkout ((step-by-step Guide 2.6)) how to do that.|Signature=derjohn}}<br />
<br />
{{Question|Question=Is VServer comparable to XEN/UML/QEMU?||Details=<br />
A: Nope. XEN/UML/QEMU and VServer are just good friends. Because you ask, you probably know what XEN/UML/QEMU are. VServer in contrary to XEN/UML/QEMU not "emulate" any hardware you run a kernel on. You can run a VServer kernel in a XEN/UML/QEMU guest. This is confirmed to work at least with Linux 2.6/vs2.0.|Signature=derjohn}}<br />
<br />
{{Question|Question=Is VServer secure?||Details=<br />
A: We hope so. It should be as least as secure as Linux is. We consider it much much more secure though.|Signature=derjohn}}<br />
<br />
{{Question|Question=Performance?||Details=<br />
A: For a single guest, we basically have native performance. Some tests showed insignificant overhead (about 1-2%) others ran faster than on an unpatched kernel. This is IMVHO significantly less than other solutions waste, especially if you have more than a single guest (because of the resource sharing).|Signature=derjohn}}<br />
<br />
{{Question|Question=Is SMP Supported?||Details=<br />
A: Yes, on all SMP capable kernel architectures.|Signature=derjohn}}<br />
<br />
{{Question|Question=Resource sharing?||Details=<br />
A: Yes ....<br />
* memory: Dynamically.<br />
* CPU usage: Dynamically (token bucket)|Signature=derjohn}}<br />
<br />
{{Question|Question=Resource limiting?||Details=<br />
A: Yes, you can set maximum limits per guest, but you can only offer guaranteed resource availability with some ticks at the time. There is the possibility to ulimit and to rlimit. Rlimit is a new feature of kernel 2.6/vs2.0.|Signature=derjohn}}<br />
<br />
{{Question|Question=Disk I/O limiting? Is that possible?||Details=<br />
A: Well, since vs2.1.1 linux-vserver supports a mechanism called 'I/O scheduling', which appeared in the 2.6 mainline some time ago. The mainline kernel offers several I/O schedulers:<br />
<br />
<pre><br />
# cat /sys/block/hdc/queue/scheduler<br />
noop [anticipatory] deadline cfq<br />
</pre><br />
<br />
The default is anticipatory a.k.a. "AS". When running several guests on a host you probably want the I/O performance shared in a fair way among the different guests. The kernel comes with a "completely fair queueing" scheduler, CFQ, which can do that. (More on schedulers can be found at http://lwn.net/Articles/114770/)<br />
<br />
This is how to set the scheduler to "cfq" manually:<br />
<pre><br />
root# echo "cfq" > /sys/block/hdc/queue/scheduler<br />
root# cat /sys/block/hdc/queue/scheduler<br />
noop anticipatory deadline [cfq]<br />
</pre><br />
<br />
Keep in mind that you have to do it on all physical discs. So if you run an md-softraid, do it to all physical /dev/hdXYZ discs!<br />
<br />
If you run Debian there is a predefined way to set the /sys values at boot-time:<br />
<br />
<pre><br />
# apt-get install sysfsutils<br />
[...]<br />
<br />
# cat /etc/sysfs.conf | grep cfq<br />
block/sda/queue/scheduler = cfq<br />
block/sdc/queue/scheduler = cfq<br />
<br />
# /etc/init.d/sysfsutils restart<br />
</pre><br />
<br />
For non-vserver processes and CFQ you can set by which key the kernel decides about the fairness:<br />
<br />
<pre><br />
cat /sys/block/hdc/queue/iosched/key_type<br />
pgid [tgid] uid gid<br />
</pre><br />
Hint: The 'key_type'-feature has been removed in the mainline kernel recently. Don't look for it any longer :(<br />
<br />
The default is tgid, which means to share fairly among process groups. Think every guest is treated like a own process group. It's not possible to set a scheduler strategy within a guest. All processes belonging to the same guest are treated like "noop" within the guest. So: If you run apache and some ftp-server within the _same_ guest, there is no fair scheduling between them, but there is fair scheduling between the whole guest and all other guests.<br />
<br />
And: It's possible to tune the scheduler parameters in several ways. Have a look at /sys/block/hdc/queue/....<br />
<br />
You need a very recent Version of VS devel, e.g. the 2.1.1-rc18 can do it. Some older version have that feature too, then it got lost and was reinvented. So: Go and get a rc18 - only in 'devel', not stable!|Signature=derjohn}}<br />
<br />
{{Question|Question=Why isn't there a device /dev/bla? within a guest||Details=<br />
A: Device nodes allow Userspace to access hardware (or virtual resources). Creating a device node inside the guest's namespace will give access to that device, so for security reasons, the number of 'given' devices is small.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is Unification (vunify)?||Details=<br />
A: Unification is Hard Links on Steroids. Guests can 'share' common files (usually binaries and libraries) in a secure way, by creating hard links with special properties (immutable but unlinkable (removable)). The tool to identify common files and to unify them is called vunify.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is vhashify?||Details=<br />
A: The successor of vunify, a tool which does unification based on hash values (which allows to find common files in arbitrary paths.)|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I manage a multi-guest setup with vhashify?||Details=<br />
A: For 'vhashify', just do these once:<br />
<br />
<pre><br />
mkdir /etc/vservers/.defaults/apps/vunify/hash /vservers/.hash<br />
ln -0s /vservers/.hash /etc/vservers/.defaults/apps/vunify/hash/root<br />
</pre><br />
<br />
Then, do this one line per vserver:<br />
<br />
<pre><br />
mkdir /etc/vservers/<vservername>/apps/vunify # vhashify reuses vunify configuration<br />
</pre><br />
<br />
<br />
The command 'ln' creates a link between two files. "ln -s" creates a symbolic link -- two files are linked by name. "ln -0s" uses a Vserver extention to create a unified link.|Signature=derjohn}}<br />
<br />
{{Question|Question=With which VS version should I begin?||Details=<br />
A: If you are new to VServer I recommend to try 2.0.+. Take "alpha utils" Version 0.30.210. In Debian Sid there appeared well running version of it recently. (It's a .210 at the time of writing).|Signature=derjohn}}<br />
<br />
{{Question|Question=is there a way to implement "user/group quota" per VServer?||Details=<br />
A: Yes, but not on a shared partition for now. You need to put the guest on a separate partition, setup a vroot device (to make the quota access secure), copy that into the guest, and adjust the mtab line inside the guest.|Signature=derjohn}}<br />
<br />
{{Question|Question=what about "Quota" for a context?||Details=<br />
A: Context quotas are now called Disk Limits (so that we can tell them apart from the user/group quotas :). They are supported out of the box (with vs2.0) for all major filesystems (Ext2/3, ReiserFS, XFS, JFS)|Signature=derjohn}}<br />
<br />
{{Question|Question=Does it support IPv6?||Details=<br />
A: Currently not. Some developer has to move his ... to reimplement this functionality from the V4 code (I read that on the ML ;)). Will probably be superseded by the ngnet (next generation networking) soon. There is a Wiki page regarding this: http://linux-vserver.org/IPv6|Signature=derjohn}}<br />
<br />
{{Question|Question=I can't do all I want with the network interfaces inside the guest?||Details=<br />
A: For now the networking is 'Host Business' -- the host is a router, and each guest is a server. You can set the capability ICMP_RAW in the context of the guest, or even the capability CAP_NET_RAW (which would even allow to sniff interfaces of other guests!). Likely to change with ngnet. |Signature=derjohn}}<br />
<br />
{{Question|Question=Is there a web-based interface for vserver that will allow creation/deletion/configuration etc. of vserver guests?||Details=<br />
A. [Update] Errrh, there is http://OpenVPS.org which is a set of scripts with a web-interface for webhosters/ISPs. <br />
A. [Update] Errrh, there is http://Openvcp.org which is a distributed system (agent!) with a web-interface, with which you can build/remove guests! cool stuff! beta, try out!|Signature=derjohn}}<br />
<br />
{{Question|Question=What is old-style and new-style config?||Details=<br />
A. Old-style config refers to a single text-file that contains all the configuration settings. With new-style config the configuration is split into several directories and files. You should probably go for new-style config if you are asking.|Signature=derjohn}}<br />
<br />
{{Question|Question=What is the "great flower page"?||Details=<br />
A. Well, this page contains all configation options for vserver in version > 1.9 (I think .. I joined Linux-VServer in version 2, so I don't know for sure). The name of the page is derivived from the stylesheet(s) it contains: It displays background pictures of a very great flower, so regard it as highly optimized. It was designed by a non-designer, who asks us to create a better one. I played with the thought of creating a complete new theme for that page - but actually we all got used to the name "great flower page", so we stick to it. If you are unable to read it clearly, feel invited to join the IRC channel #vserver, we may tell you how to ;)|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I add several IPs to a vserver? ||Details=<br />
A: First of all a single guest vserver only supports up to 16 IPs (There is a 64-IP patch available, which is in "derjohn's kernel", you need extra util-vserver anyway).<br />
Here is a little helper-script that adds a list of IPs defined in a text file, one per line.<br />
<pre><br />
#!/bin/bash<br />
j=1<br />
for i in `cat myiplist`; do<br />
j=$(($j+1))<br />
mkdir $j<br />
echo $i > $j/ip<br />
echo $i > $j/ip-old<br />
echo "24" > $j/prefix<br />
done<br />
</pre>|Signature=derjohn}}<br />
<br />
{{Question|Question=If my host has only one a single public IP, can I use RFC1918 IP (e.g. 192.168.foo.bar) for the guest vservers?||Details=<br />
A: Yes, use iptables with SNAT to masquerade it. <br />
<pre><br />
iptables -t nat -I POSTROUTING -s $VSERVER_NETZ ! -d $VSERVER_NETZ -j SNAT --to $EXT_IP<br />
</pre><br />
See: HowtoPrivateNetworking and <br />
http://www.tgunkel.de/it/software/doc/linux_server#h3-Vserver_Masquerading_SNAT (THX, [MUPPETS]Gonzo)|Signature=derjohn}}<br />
<br />
{{Question|Question=If I shut down my vserver guest, the whole Internet interface ethX on the host is shut down. What happened? ||Details=<br />
A: When you shut down a guest (''i.e. vserver foo stop''), the IP is brought down on the host also. If this IP happens to be the primary IP of the host, the kernel will not only bring down the primary IP, but also all secondary IP addresses. But in very recent kernels, there is an option ''settable'' which prevents that nasty feature. It's called "alias promotion". You may set it via sysctl by adding ''net.ipv4.conf.all.promote_secondaries=1'' in /etc/sysctl.conf or via sysctl command line.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=On Debian Sarge (stable) only util-vserver is 0.30-204 available, which has been reported to be buggy (I didnt check the version for longer time) How do I compile a local version of alpha util-vserver .210 on Debian?||Details=<br />
A:<br />
<pre><br />
apt-get build-dep util-vserver<br />
<br />
./configure --prefix=/usr/local/ --enable-release \<br />
--mandir=/usr/local/share/man \<br />
--infodir=/usr/local/share/info \<br />
--sysconfdir=/etc --enable-dietlibc \<br />
--localstatedir=/var \<br />
--with-vrootdir=/var/lib/vservers<br />
<br />
make<br />
<br />
make install-distribution<br />
(Which does a make install + setting a symlink ln -s /usr/local/lib/util-vserver/vshelper /sbin/vshelper )<br />
<br />
</pre><br />
<br />
To test which version you are running:<br />
<pre><br />
# which vserver<br />
/usr/local/sbin/vserver<br />
<br />
</pre><br />
<br />
This should point to ..local...<br />
<br />
If you dont want to build it yourself: On www.backports.org there are backported (for sarge) linux-images (2.6.16) with vserver-patch enabled and a updated util-vserver package as well.<br />
|Signature=derjohn}}<br />
<br />
{{Question|Question=I use derjohn's kernel or a differnet kernel with a more-than-16-IPs-per-guest-patch and can't use more than 16 IPs. Why?||Details=<br />
A: You need to patch util-vserver, too. So you obviously need to recompile util-vserver (see above). In the util-vserver directory there are header files in the ./kernel/ directory. Patch like this:<br />
<br />
<pre><br />
kernel/network.h:#define NB_IPV4ROOT 64<br />
</pre><br />
<br />
BTW: The initial patches can be found here: http://vserver.13thfloor.at/Experimental/VARIOUS/util-vserver-0.30.196-net64.diff.bz2 and http://vserver.13thfloor.at/Experimental/VARIOUS/delta-2.6.9-vs1.9.3-net64.diff<br />
|Signature=unknown}}<br />
<br />
{{Question|Question=I run a Debian host and want to build an Ubuntu guest. Howto?||Details=<br />
A: Simple ;) Assume you want to build a breezy guest on a sid host with IP 192.168.0.2 and hostname vubuntu, then do:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu<br />
</pre><br />
<br />
[UPDATE] Currently there are problems in building breezy under unclear circumstances, which seems to have to do with udev. If the above didnt work, try:<br />
<pre><br />
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \<br />
--context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu -- --exclude=udev<br />
</pre><br />
In very recent versions of the utils, the problem should not occur anymore (it has to do with the 'secure-mount' if you look in the MLs)<br />
<br />
Well, sid's debootstrap knows how to bootstrap Ubuntu linux. Make sure to have a current debootstrap package: <br />
<pre><br />
apt-get update<br />
apt-get install debootstrap<br />
</pre><br />
The knowledge how to build ubuntu 'breezy badger' (which you probably want to be your guest at the time of writing) has been added recently.|Signature=derjohn}}<br />
<br />
{{Question|Question=How do I make a vserver guest start by default?||Details=<br />
A: At least on Debian, I can tell you how to do it with the new-style config. If your guest is called "derjohn" and you want it to be started somewhere at the of your bootstrap process, then do:<br />
<pre><br />
echo "default" > /etc/vservers/derjohn/apps/init/mark<br />
</pre><br />
If you want to start it earlier, please read the init script "/etc/init.d/vserver-default" to find out how to do it. In most cases you don't need to change this. On Debian the vservers are started at "90", so after most other stuff is up (networking etc.).<br />
<br />
Besides that I created a small helper script for managing the autostart foo: ((vserver-autostart))|Signature=derjohn}}<br />
<br />
{{Question|Question=My host works, but when I start a guest it says that it has a problem with chbind.||Details=<br />
A: You are probably using util-vserver <= 0.30.209, which does use dynamic network contexts internally (With 0.30.210 this fact changed). So if you compiled your kernel without dynamic contexts, you may start guests, but you can't use the network context.The solution is either to switch to .210 util (or Hollow's toolset) or compile the kernel with dynamic network contexts.<br />
SE Keyword: invalid option `nid' testme.sh|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=When I try to ssh to the guest, I log into the host, even if I installed sshd on the guest. What's wrong here?||Details=<br />
A: Look at /etc/ssh/sshd_config of the host:<br />
<br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
#ListenAddress ::<br />
</pre><br />
<br />
And now change the setting to <br />
<pre><br />
Port 22<br />
# Use these options to restrict which interfaces/protocols sshd will bind to<br />
ListenAddress your.hosts.ip.here # not the guests IP! <br />
</pre><br />
<br />
Then '/etc/init.d/ssh restart' on the host, after that on the guest (if you did apt-get install ssh on the guest already.)<br />
<br />
Do I have to explain more? If the hosts sshd binds all available IP addresses on port 22 (The hosts 'sees' even all addresses of the guests!). So if the guest starts its sshd, it cant bind to port 22 any more. You need to change that setting only on the host. <br />
(BTW: A similar approach has to be done for a lot of daemons, e.g. Apache. If the daemon does not support an explicit bind, you may use the chbind command to 'hide' IP addresses from the daemon before starting.)|Signature=derjohn}}<br />
<br />
{{Question|Question=I did everything right, but the application foo does not start. What's up there?||Details=<br />
A: Before asking on the IRC channel, please check out the 'problematic programs' page:<br />
[[Problematic Programs]]|Signature=derjohn}}<br />
<br />
{{Question|Question=Bind9 does not like to start in my guest.||Details=<br />
A: Check out the 'problematic programs' page:<br />
((ProblematicPrograms)) and/or get my [((ProblematicPrograms)) and/or get my [http://linux-vserver.derjohn.de/bind9-packages/bind9-capacheck_9.3.2-2_i386.deb vserver-guest-ready Debian package] for Debian Sid guests from that URL: http://linux-vserver.derjohn.de/bind9-packages/bind9-capacheck_9.3.2-2_i386.deb and check out the [http://linux-vserver.derjohn.de/bind9-packages/README.txt readme]. (Hint: This is fresh stuff. The give me Feedback)<br />
<br />
[UPDATE] Since VServer Devel 2.1.1-rc18 you do not need to patch the userland tools anymore. The capabilities are masked.|Signature=derjohn}}<br />
<br />
{{Question|Question=Which guest vservers are running?||Details=<br />
A: {{vserver-stat}}. Example output:<br />
<pre><br />
CTX PROC VSZ RSS userTIME sysTIME UPTIME NAME<br />
0 77 965.1M 334.6M 14m14s18 2m28s69 1h33m46 root server<br />
49152 7 14M 5.2M 0m00s40 0m00s30 1h30m15 chiffon<br />
</pre>|Signature=derjohn}}<br />
<br />
<br />
<br />
{{Question|Question=How can I reboot/halt guests?||Details=<br />
A: It depends. <br />
For vserver with legacy-interfaces support, you have to replace {{/sbin/halt}} in guests with vreboot and start rebootmgr in host. You also need to have a dummy <guest>.conf file in /etc/vservers for each guest. Please have a look at /etc/init.d/rebootmgr.<br />
Vserver with native interface utilizes /dev/initctl. No changes are needed in guests. Just make sure that REBOOT capability is adjusted in guests.|Signature=derjohn}}<br />
<br />
{{Question|Question=Do I really need the legacy-interfaces? What are these legacy-interfaces?||Details=<br />
A: Since vserver is an ongoing project, new features might replace old ones, some might still on development. Legacy-interfaces are available for backward compability (which might be removed someday). See Q: How can I reboot/halt guests?|Signature=derjohn}}<br />
<br />
{{Question|Question= I have a vserver running on a Linux kernel with preemption. Is VServer "preempt" safe?||Details=<br />
A: There are no known issues about running vserver on a preemption enabled kernel. I would like to add, that the vserver kernelhackers would probably exclude that option in 'make menuconfig' if there would be an incompatibility. Just my $.02 :)|Signature=derjohn}}<br />
<br />
{{Question|Question=Is this a new project? When was it started?||Details=<br />
A: The first public occurance of linux-vserver was Oct 2001. The initial mail can be found here: http://www.cs.helsinki.fi/linux/linux-kernel/2001-40/1065.html<br />
So you can expect a mature software product wich does it's magic quite well (And hey, we have a version > 2.0 ! )|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=Can I run an OpenVPN Server in a guest?||Details=<br />
A: Yes. I don't want to provide an in-depth OpenVPN tutorial, but want to show how I made OpenVPN work in a guest as server. I was not able to run it with a tun devive, due to a buglet in util-vserver and kernel when it comes to settings a an ip address a point to point link: If you add "ip addr add <ip> peer <mypeer> dev tun0" there is no way to map the tun0 interface into a guest, even not with a 'nodev' option. (bug confirmed to be reproducible by daniel_hoczac)<br />
<br />
First of all you have to prepare the host with a persistent tuntap interface in tap-mode. The tools we need come from the uml-utilities.<br />
Then you need to create a device /dev/net/tun, which the OpenVPN userspace daemon reads. Well assume 10.10.10.100 is the server IP, and 10.10.10.101 is the client ip - to be cool be choose a /31 netmask (255.255.255.254), so we have a net without broadcast and don't waste IPs :)<br />
<br />
On the host do: <br />
<pre><br />
# apt-get install uml-utilities<br />
# cd /var/lib/vserver/<myopenvpnserver>/dev/<br />
# ./MAKEDEV tun<br />
(creates the dev/net/tun device accessible by te guest - even a tap interface need /dev/net/tun !)<br />
# tunctl -t tap0<br />
(creates the network device 'tap0' persistently)<br />
</pre><br />
<br />
Then add the ip to the guest:<br />
<pre><br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/ip<br />
10.10.10.100<br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/prefix<br />
31<br />
# cat /etc/vservers/<myopenvpnserver>/interfaces/1/dev<br />
tap0<br />
(This kind of config brings the ip when the vserver is started - only the tap0 interface has to exist already, see above!)<br />
</pre><br />
<br />
Here is a sample config for the guest (which is acting as a server):<br />
<br />
Install OpenVPN package on server and client, in the Debian case:<br />
<pre><br />
# apt-get install openvpn<br />
</pre><br />
<br />
The server's conf looks like that:<br />
<pre><br />
# port and interface specs<br />
<br />
# behave like a ssl-webserver<br />
port 443<br />
proto tcp-server<br />
<br />
# tap device? (keep in mind you need /dev/net/tun !)<br />
dev tap0<br />
<br />
# now the ips we will use for the tunnel<br />
ifconfig 10.10.10.100 255.255.255.254<br />
ifconfig-noexec<br />
<br />
# the server part<br />
<br />
# Keep VPN connections, even if the client IP changes<br />
float<br />
<br />
# use compression (may also even obfuscate content filters)<br />
comp-lzo<br />
<br />
# use a static key - create it with 'openvpn --genkey --secret static.key'<br />
secret static.key<br />
<br />
# dont reload the key after a SIGUSR1<br />
persist-key<br />
<br />
# check alive all 10 secs<br />
keepalive 10 60<br />
<br />
# verbosity level (from 1 to 9, 9 is max log level)<br />
verb 4<br />
status openvpn-status.log<br />
</pre><br />
<br />
The client's conf may look like that (This example even makes the tunnel the clients default address):<br />
<pre><br />
# cat /etc/openvpn/client.conf<br />
# port and interface specs<br />
<br />
# the following is not necessary, if you bring up openvpn via Debian's init script:<br />
daemon ovpn-my-clients-name<br />
<br />
# behave like a ssl-webserver<br />
port 443<br />
proto tcp-client<br />
remote %%%<insert-the-guest-primary-public-ip-here>%%%%<br />
# what device tun ot tap?<br />
dev tap<br />
<br />
# now the ips we will use for the tunnel<br />
ifconfig 10.10.10.101 255.255.255.254<br />
<br />
# Keep VPN connections, even if the client IP changes<br />
float<br />
mssfix<br />
<br />
# use compression (may also even obfuscate content filters)<br />
comp-lzo<br />
<br />
# use a static key<br />
secret static.key<br />
<br />
# dont reload the key after a SIGUSR1<br />
persist-key<br />
<br />
# check alive all 10 secs<br />
keepalive 10 60<br />
<br />
# verbosity level (from 1 to 9, 9 is max log level)<br />
verb 4<br />
<br />
# set the default route<br />
route-gateway 10.10.10.100<br />
redirect-gateway def1<br />
# to add special routes you can do it wihtin the openvpn client conf:<br />
# route <dest> <mask> <gateway><br />
<br />
# if you need to connect via proxy (like squid)<br />
# http-proxy s p [up] [auth] : Connect to remote host through an HTTP proxy at<br />
# address s and port p. If proxy authentication is required,<br />
# up is a file containing username/password on 2 lines, or<br />
# 'stdin' to prompt from console. Add auth='ntlm' if<br />
# the proxy requires NTLM authentication.<br />
<br />
# http-proxy s p [up] [auth]<br />
<br />
<br />
# http-proxy-option type [parm] : Set extended HTTP proxy options.<br />
# Repeat to set multiple options.<br />
# VERSION version (default=1.0)<br />
# AGENT user-agent<br />
<br />
# http-proxy-option type [parm]<br />
</pre><br />
<br />
In the next lesson I will talk about OpenVPN's server mode, which can deal with with multiple clients connecting to one ip and one port (i.e. you only need one guest for tons or 'roadwarriros'), tls connections and pki.<br />
<br />
Contributions welcome. :)|Signature=derjohn}}<br />
<br />
{{Question|Question=32 vs 64 Bit? What should I take?||Details=<br />
A: If you have the choice make the host a 64 bit one. You can run a guest as 32 bit or as 64 bit on a 64 bit host. To run it as 32 bit, you need to compile the x86_64 (a.k.a. AMD64) with the following options:<br />
<br />
<pre><br />
[*] Kernel support for ELF binaries<br />
<M> Kernel support for MISC binaries<br />
[*] IA32 Emulation <---- without that, the entire 32bit API is not present<br />
<M> IA32 a.out support <br />
</pre><br />
<br />
You can force the guest to behave like a 32 environment like this:<br />
<pre><br />
echo linux_32bit > /etc/vservers/$NAME/personality<br />
echo i686 > /etc/vservers/$NAME/uts/machine<br />
</pre><br />
(thanks cehteh for the hint!)<br />
<br />
But you can force debootstrap to but 32 bit binaries into the guest by 'export ARCH=i386';<br />
<pre><br />
export ARCH=i386 ; vserver build .... <br />
</pre>|Signature=derjohn}}<br />
<br />
{{Question|Question=I want to (re)mount a partition in a running guest ... but the guest has no rights (capability) to (re)mount?||Details=<br />
A: I'll explain. I take as example your /tmp partition within the guest is too small, what will be likely the case if you stay with the 16MB default (vserver build mounts /tmp as 16 MB tempfs!).<br />
<pre><br />
# vnamespace -e XID mount -t tmpfs -o remount,size=256m,mode=1777 none /var/lib/vservers/<guest>/tmp/<br />
</pre><br />
Be warned that the guest will not recognize the change, as the /etc/mtab file is not updated when you mount like this. To permanently change the mount, edit /etc/vserver/<guest>/fstab on the host.|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=How do I limit a guests RAM? I want to prevent OOM situations on the host!||Details=<br />
A: First you can read [http://linux-vserver.org/Memory+Allocation] and [Memory Limits].<br />
<br />
If you want a recipe, do that:<br />
1. Check the size of memory pages. On x86 and x86_64 is usually 4 KB per page.<br />
2. Create /etc/vserver/<guest>/rlimits/<br />
3. Check your physical memory size on the host, e.g. with "free -m". maxram = kilobytes/pagesize.<br />
4. Limit the guests physical RAM to value smaller then maxram:<br />
<br />
<pre><br />
echo %%insertYourPagesHereSmallerThanMaxram%% > /etc/vserver/<guest>/rlimits/rss<br />
</pre><br />
<br />
5. Check your swapspace, e.g. with 'swapon -s'. maxswap = swapkilobytes/pagesize.<br />
6. Limit the guest's maximum number of as pages to a value smaller than (maxram+maxswap):<br />
<br />
<pre><br />
echo %%desiredvalue%% > /etc/vserver/<guest>/rlimits/as<br />
</pre><br />
<br />
It should be clear this can still lead to OOM situations. Example: You have two guests and your as limit per guest is greater than 50% of (maxram+maxswap). If both guests request their maximum at the same point in time, there will be not enough mem .....|Signature=derjohn}}<br />
<br />
<br />
{{Question|Question=Were can I get newer versions of VServer as ready made packages for Debian?||Details=<br />
A: Here you go: http://linux-vserver.derjohn.de/ . There is also some stuff on backports.org, but my kernels are always 'devel' branch.|Signature=derjohn}}<br />
<br />
{{Question|Question=Can I use iptables ?||Details=<br />
Yes but right now only on the host (rootserver). Please realize that all traffic is local and will not touch the forward chain.|Signature=BeginnerFAQ}}<br />
<br />
{{Question|Question=Trying to connect to a vserver from the host or another vserver on the same host fails||Details=<br />
strace shows<br />
<pre> <br />
sin_addr=inet_addr("xx.xx.xx.xx")}, yy) = -1 EINVAL (Invalid argument)<br />
</pre><br />
A: The host/guest cannot communicate with another guest on same host.<br />
* check all netmasks on all interfaces (do they overlap) ?<br />
* check policy routing (disable it temporary) ?<br />
* check that lo is up (Networking within a host/guest always uses lo interface)<br />
|Signature=CommonProblems}}<br />
<br />
{{Question|Question=#1 ERROR: capset(): Operation not permitted||Details=capabilities are not enabled in kernel-setup<br />
please check that CONFIG_SECURITY_CAPABILITIES is loaded or included in the kernel. ( check with "cat /path_to_kernel/.config | grep -i cap ")<br />
(2.6.11.5-vs-1.9.5 + 0.30-205)|Signature=IrcQuestions}}<br />
<br />
{{Question|Question=How can I make 'vserver start' mount the root filesystem||Details=<br />
mount it via /etc/vservers/vserver-name/fstab, make sure to set the option 'dev' e.g.:<br />
<pre>/dev/drbd0 / xfs rw,dev 0 0</pre><br />
util-vserver 210 won't be able to find some scripts for the reboot, add into /etc/vservers/vserver-name/apps/init/cmd.stop<br />
<pre>/etc/init.d/rc<br />
6</pre><br />
|Signature=AdrianReyer}}<br />
<br />
{{Question|Question=How do I tag a guest's directory with xid?||Details=<br />
Tagging the guest's files gives you serveral advantages, e.g. the accoutung will work properly.<br />
Filesystem XID tagging only works on supported filesystem. Those are currently: ext2/3, reiserfs/reiser3, xfs and jfs.<br />
To activate the XID tagging you have to mount the filesystem with "-o tagxid". Attention: It's _not_ possible to "-o remount,tagxid", you have to mount it freshly. The guests will tag their files automatiaclly. If you copy files in from the host, you have to tag them manually like this:<br />
<pre>chxid -c xid -R /var/lib/vservers/<guest></pre><br />
Note: Context 0 and 1 will see all files, guests will only be able to acess untagged files and their own XID. They can see other XID files but no information about the file, e.g. no owner, no group, no permissions.<br />
|Signature=derjohn_and_gonzo_and_are}}<br />
<br />
More FAQs to be merged;<br />
[http://www.linux-vserver.org/Frequently_Asked_Questions_scratch]<br />
<br />
{{Question|Question=My mysqld running in a guest behaves strangely and is awfully slow/locks up||Details=<br />
This can be related to /tmp being too small. mysqld stores temporary tables in /tmp and as such, if a lot of queries happen and /tmp runs full this can cause one query to lock up whilst creating the tmp table and all other queries waiting to acquire the lock. There are two possible solutions to that problem: a.) Modify /etc/vservers/vserver-name/fstab and assign more memory to the tmpfs of /tmp and b.) remove the /tmp entry from /etc/vservers/vserver-name/fstab completly. Especially on database servers with a rather high load the second one might be the preferred method.|Signature=sp}}</div>62.253.128.13