Difference between revisions of "Frequently Asked Questions scratch"

From Linux-VServer

Jump to: navigation, search
m (scratch!)
 
m
Line 1: Line 1:
 
== A. General ==
 
== A. General ==
{{Question|Question=Credits||Details=
+
|Signature=derjohn}}{{Question|Question=Credits||Details=
 
#:This FAQ includes information taken from the FAQs of Jacques Gélinas and Paul Sladen.
 
#:This FAQ includes information taken from the FAQs of Jacques Gélinas and Paul Sladen.
{{Question|Question=Are there other FAQs available?||Details=
+
|Signature=derjohn}}{{Question|Question=Are there other FAQs available?||Details=
 
#:Yes. There are other (mostly older) FAQ's available:
 
#:Yes. There are other (mostly older) FAQ's available:
 
#*[http://www.solucorp.qc.ca/howto.hc?projet=vserver Jacques Gélinas FAQ]
 
#*[http://www.solucorp.qc.ca/howto.hc?projet=vserver Jacques Gélinas FAQ]
 
#*[http://www.paul.sladen.org/vserver/faq/ Paul Sladen's vserver FAQ]
 
#*[http://www.paul.sladen.org/vserver/faq/ Paul Sladen's vserver FAQ]
{{Question|Question=Where can I find a overview of Linux-VServer?||Details=
+
|Signature=derjohn}}{{Question|Question=Where can I find a overview of Linux-VServer?||Details=
 
#*((short presentation))
 
#*((short presentation))
 
#* [http://en.wikipedia.org/wiki/Linux-VServer Wikipedia Article]
 
#* [http://en.wikipedia.org/wiki/Linux-VServer Wikipedia Article]
 
#*ProjectOverview (an introduction to the VServer Project, by ChuckD)
 
#*ProjectOverview (an introduction to the VServer Project, by ChuckD)
 
#*[http://www.solucorp.qc.ca/miscprj/s_context.hc?prjstate=1&nodoc=0 Introduction by Jacques Gélinas]
 
#*[http://www.solucorp.qc.ca/miscprj/s_context.hc?prjstate=1&nodoc=0 Introduction by Jacques Gélinas]
{{Question|Question=How to verify that a setup is working properly?||Details=
+
|Signature=derjohn}}{{Question|Question=How to verify that a setup is working properly?||Details=
 
#*To verify that your setup works properly, there are some test scripts to check basic functionality.
 
#*To verify that your setup works properly, there are some test scripts to check basic functionality.
 
#: primarily [http://vserver.13thfloor.at/Stuff/SCRIPT/testme.sh testme.sh] and [http://vserver.13thfloor.at/Stuff/SCRIPT/testfs.sh testfs.sh] (see ((TestScripts)) for more details)
 
#: primarily [http://vserver.13thfloor.at/Stuff/SCRIPT/testme.sh testme.sh] and [http://vserver.13thfloor.at/Stuff/SCRIPT/testfs.sh testfs.sh] (see ((TestScripts)) for more details)
  
 
== B. Requirements ==
 
== B. Requirements ==
{{Question|Question=What hardware is supported by linux-vserver?||Details=
+
|Signature=derjohn}}{{Question|Question=What hardware is supported by linux-vserver?||Details=
 
#:The following platforms are supported in the stable versions of linux-vserver.
 
#:The following platforms are supported in the stable versions of linux-vserver.
 
#*alpha
 
#*alpha
Line 28: Line 28:
 
#*x86_64 (AMD64)
 
#*x86_64 (AMD64)
 
#*uml/xen
 
#*uml/xen
{{Question|Question=Which kernel versions are supported?||Details=
+
|Signature=derjohn}}{{Question|Question=Which kernel versions are supported?||Details=
 
#: recent 2.4 and 2.6 kernels (stable), recent 2.6 kernels (development).  
 
#: recent 2.4 and 2.6 kernels (stable), recent 2.6 kernels (development).  
 
#: Some ancient versions of Linux-VServer are backported to 2.2.x kernels. You can find more information [http://vserver.digitalangel.com.au/ here].
 
#: Some ancient versions of Linux-VServer are backported to 2.2.x kernels. You can find more information [http://vserver.digitalangel.com.au/ here].
{{Question|Question=Can I run Linux-vserver on my favorite distribution?||Details=
+
|Signature=derjohn}}{{Question|Question=Can I run Linux-vserver on my favorite distribution?||Details=
 
#:Linux-VServer was originally developed on Red Hat/Mandriva, but it is rather distribution independent. It runs fine with other distributions (Debian, SuSE). Some distributions run a patched kernel, which can make it a bit harder to build a new kernel with Linux-VServer support
 
#:Linux-VServer was originally developed on Red Hat/Mandriva, but it is rather distribution independent. It runs fine with other distributions (Debian, SuSE). Some distributions run a patched kernel, which can make it a bit harder to build a new kernel with Linux-VServer support
  
 
== C. Versions ==
 
== C. Versions ==
{{Question|Question=What's the latest version of Linux-VServer?||Details=
+
|Signature=derjohn}}{{Question|Question=What's the latest version of Linux-VServer?||Details=
 
#:You can find the [http://www.13thfloor.at/vserver/s_release latest stable 2.4 release] or [http://www.13thfloor.at/vserver/s_rel26 latest stable 2.6 release] as well as the [http://www.13thfloor.at/vserver/d_rel26 latest development release] at [http://www.13thfloor.at/vserver/ http://www.13thfloor.at/vserver/]
 
#:You can find the [http://www.13thfloor.at/vserver/s_release latest stable 2.4 release] or [http://www.13thfloor.at/vserver/s_rel26 latest stable 2.6 release] as well as the [http://www.13thfloor.at/vserver/d_rel26 latest development release] at [http://www.13thfloor.at/vserver/ http://www.13thfloor.at/vserver/]
 
#:Check out the ((Release FAQ)) for information on releases and version numbering
 
#:Check out the ((Release FAQ)) for information on releases and version numbering
{{Question|Question=Where can I find prereleases and release candidates?||Details=
+
|Signature=derjohn}}{{Question|Question=Where can I find prereleases and release candidates?||Details=
 
#:Check the [http://vserver.13thfloor.at/Experimental experimental area] for new patches.
 
#:Check the [http://vserver.13thfloor.at/Experimental experimental area] for new patches.
  
 
== D. Tools (util-vserver and vserver) ==
 
== D. Tools (util-vserver and vserver) ==
{{Question|Question=What do I need them for?||Details=
+
|Signature=derjohn}}{{Question|Question=What do I need them for?||Details=
 
#:These are the userspace tools for Linux-VServer. You need them to use the functionality of Linux-VServer.
 
#:These are the userspace tools for Linux-VServer. You need them to use the functionality of Linux-VServer.
{{Question|Question=What's the difference between vserver and util-vserver?||Details=
+
|Signature=derjohn}}{{Question|Question=What's the difference between vserver and util-vserver?||Details=
 
#:The vserver package are the 'legacy utilities', written by Jacques Gélinas.  
 
#:The vserver package are the 'legacy utilities', written by Jacques Gélinas.  
 
#:The util-vserver package is a reimplementation of these tools in C by Enrico Scholz, which follows the kernel development more closely.  
 
#:The util-vserver package is a reimplementation of these tools in C by Enrico Scholz, which follows the kernel development more closely.  
 
#:util-vserver tools are currently considered the mainstream tools (You can't use both packages on the same machine.)
 
#:util-vserver tools are currently considered the mainstream tools (You can't use both packages on the same machine.)
 
#:Both packages have their own version numbering. Don't let the version numbering confuse you.
 
#:Both packages have their own version numbering. Don't let the version numbering confuse you.
{{Question|Question=Which version of the tools packages do I need? Do I have to upgrade?||Details=
+
|Signature=derjohn}}{{Question|Question=Which version of the tools packages do I need? Do I have to upgrade?||Details=
 
*:It can be useful to have a recent version of the tools package installed on your box. It's a good idea to upgrade your tools when you upgrade your kernel. In the next list you find the versions you need to have at least, but it's a good idea to use more recent versions.
 
*:It can be useful to have a recent version of the tools package installed on your box. It's a good idea to upgrade your tools when you upgrade your kernel. In the next list you find the versions you need to have at least, but it's a good idea to use more recent versions.
 
#*linux-vserver 1.00
 
#*linux-vserver 1.00
Line 61: Line 61:
  
 
== E. Download ==
 
== E. Download ==
{{Question|Question=Where can I dowload the latest version of:||Details=
+
|Signature=derjohn}}{{Question|Question=Where can I dowload the latest version of:||Details=
 
#*[http://www.13thfloor.at/vserver/ The kernel patch]
 
#*[http://www.13thfloor.at/vserver/ The kernel patch]
 
#*[http://dns.solucorp.qc.ca/miscprj/s_context.hc?prjstate=1&nodoc=1 vserver]
 
#*[http://dns.solucorp.qc.ca/miscprj/s_context.hc?prjstate=1&nodoc=1 vserver]
 
#*[http://savannah.nongnu.org/files/?group=util-vserver util-vserver]
 
#*[http://savannah.nongnu.org/files/?group=util-vserver util-vserver]
{{Question|Question=Distribution specific packages||Details=
+
|Signature=derjohn}}{{Question|Question=Distribution specific packages||Details=
 
#*Red Hat
 
#*Red Hat
 
#**[http://dns.solucorp.qc.ca/miscprj/s_context.hc?prjstate=1&nodoc=1 vserver]
 
#**[http://dns.solucorp.qc.ca/miscprj/s_context.hc?prjstate=1&nodoc=1 vserver]
Line 78: Line 78:
  
 
== F. Network Usage? ==
 
== F. Network Usage? ==
{{Question|Question=Is IPv6 supported?||Details=
+
|Signature=derjohn}}{{Question|Question=Is IPv6 supported?||Details=
 
#:At this moment, only IPv4 (the current most frequently used standard) is supported.
 
#:At this moment, only IPv4 (the current most frequently used standard) is supported.
{{Question|Question=Can I put my vservers in different networks?||Details=
+
|Signature=derjohn}}{{Question|Question=Can I put my vservers in different networks?||Details=
 
#:Yes you can. You have to bind your vserver to a interface on the host machine, but you can choose the interface in the configuration file of your vserver (in /etc/vservers/SERVER.conf). Make sure your host server does have an interface in the network you need on your vserver.
 
#:Yes you can. You have to bind your vserver to a interface on the host machine, but you can choose the interface in the configuration file of your vserver (in /etc/vservers/SERVER.conf). Make sure your host server does have an interface in the network you need on your vserver.
{{Question|Question=Is it possible for a vserver to have a other default gateway than the host machine does use?||Details=
+
|Signature=derjohn}}{{Question|Question=Is it possible for a vserver to have a other default gateway than the host machine does use?||Details=
 
#:Yes. Use iproute2 to set the default gateway.
 
#:Yes. Use iproute2 to set the default gateway.
 
#:You can find more information on routing in linux-vserver in [http://archives.linux-vserver.org/200311/0470.html this posting] on the mailinglist.
 
#:You can find more information on routing in linux-vserver in [http://archives.linux-vserver.org/200311/0470.html this posting] on the mailinglist.
{{Question|Question=Can I use more than one IP address in a vserver||Details=
+
|Signature=derjohn}}{{Question|Question=Can I use more than one IP address in a vserver||Details=
 
#:Yes you can. Edit the configuration file of the vserver (/etc/vservers/SERVER.conf).
 
#:Yes you can. Edit the configuration file of the vserver (/etc/vservers/SERVER.conf).
 
#:In case you want to use example IP addresses on one interface
 
#:In case you want to use example IP addresses on one interface
Line 101: Line 101:
 
#:/etc/vserver/<vserver-name>/interfaces/1
 
#:/etc/vserver/<vserver-name>/interfaces/1
 
#:These subdirectories have to contain files with the options you want to set. See the [http://www.nongnu.org/util-vserver/doc/conf/configuration.html Flower page] for more info
 
#:These subdirectories have to contain files with the options you want to set. See the [http://www.nongnu.org/util-vserver/doc/conf/configuration.html Flower page] for more info
{{Question|Question=Is it possible to use the real device (eth0, eth1) instead of the device alias created by vserver?||Details=
+
|Signature=derjohn}}{{Question|Question=Is it possible to use the real device (eth0, eth1) instead of the device alias created by vserver?||Details=
 
#:Yes. Set up the IP aliases yourself on the host server
 
#:Yes. Set up the IP aliases yourself on the host server
 
#:*Set IPROOT= to those IPs
 
#:*Set IPROOT= to those IPs
 
#:*Unset IPROOTDEV so the vserver script won't try to setup the IP aliases.
 
#:*Unset IPROOTDEV so the vserver script won't try to setup the IP aliases.
{{Question|Question=Can I modify the behavior of my vservers?||Details=
+
|Signature=derjohn}}{{Question|Question=Can I modify the behavior of my vservers?||Details=
 
#:There are a number of capabilities and flags that you can modify listed [http://linux-vserver.org/Caps+and+Flags here] (and [http://savannah.nongnu.org/cgi-bin/viewcvs/util-vserver/util-vserver/lib/cflags-v13.c?rev=HEAD here (cflags-v13.c)]).
 
#:There are a number of capabilities and flags that you can modify listed [http://linux-vserver.org/Caps+and+Flags here] (and [http://savannah.nongnu.org/cgi-bin/viewcvs/util-vserver/util-vserver/lib/cflags-v13.c?rev=HEAD here (cflags-v13.c)]).
{{Question|Question=Were can I find more information on networking in Linux-VServer?||Details=
+
|Signature=derjohn}}{{Question|Question=Were can I find more information on networking in Linux-VServer?||Details=
 
#:You can find more information on the internals of networking in Linux-VServer [http://vserver.13thfloor.at/Stuff/VServer-IP-Setup-0.1.txt here].
 
#:You can find more information on the internals of networking in Linux-VServer [http://vserver.13thfloor.at/Stuff/VServer-IP-Setup-0.1.txt here].
  
 
== G. Software compatibility ==
 
== G. Software compatibility ==
{{Question|Question=Bind does not work in a vserver||Details=
+
|Signature=derjohn}}{{Question|Question=Bind does not work in a vserver||Details=
 
#* capset failed
 
#* capset failed
 
##* The bind package expect to have the capability CAP_SYS_RESOURCE.  
 
##* The bind package expect to have the capability CAP_SYS_RESOURCE.  
Line 124: Line 124:
 
##* putting "query-source address YOUR_VSERVER_IP;" in your named.conf solves this problem.
 
##* putting "query-source address YOUR_VSERVER_IP;" in your named.conf solves this problem.
 
#:
 
#:
{{Question|Question=Is DHCP possible in a vserver?||Details=
+
|Signature=derjohn}}{{Question|Question=Is DHCP possible in a vserver?||Details=
 
#:It's possible to run a DHCP server inside a vserver, but it required a CAP_NET_RAW capability.  
 
#:It's possible to run a DHCP server inside a vserver, but it required a CAP_NET_RAW capability.  
 
#:The solution for 2.6 kernel with new-style config is to add CAP_NET_RAW entry in the /etc/vserver/<vserver-name>/bcapabilities file, and it might be unnecessary to add 255.255.255.255 into bcast file, please read [http://www.nongnu.org/util-vserver/doc/conf/configuration.html The Great Flower Page] for more details. If you are still use the legacy config, please read the answer below.
 
#:The solution for 2.6 kernel with new-style config is to add CAP_NET_RAW entry in the /etc/vserver/<vserver-name>/bcapabilities file, and it might be unnecessary to add 255.255.255.255 into bcast file, please read [http://www.nongnu.org/util-vserver/doc/conf/configuration.html The Great Flower Page] for more details. If you are still use the legacy config, please read the answer below.
Line 135: Line 135:
 
#:The dhcpd case is probably very specific though.  
 
#:The dhcpd case is probably very specific though.  
 
#:
 
#:
{{Question|Question=NFS-server||Details=
+
|Signature=derjohn}}{{Question|Question=NFS-server||Details=
 
#:It's not posible to run a NFS-kernel server inside a vserver, to work securely this would need a lot of work.  
 
#:It's not posible to run a NFS-kernel server inside a vserver, to work securely this would need a lot of work.  
 
#:You can try to run the NFS userspace server, the traditional Linux user space NFS server and UNFS3 are both reported to work.
 
#:You can try to run the NFS userspace server, the traditional Linux user space NFS server and UNFS3 are both reported to work.
 
#:take a look at ((NFS and portmap)) if you have problems with your portmap
 
#:take a look at ((NFS and portmap)) if you have problems with your portmap
 
#:
 
#:
{{Question|Question=Run Level Based Distributions as Ververs (Red Hat and such ....)||Details=
+
|Signature=derjohn}}{{Question|Question=Run Level Based Distributions as Ververs (Red Hat and such ....)||Details=
 
#: If you see errors after the command vserver <name> stop like these:
 
#: If you see errors after the command vserver <name> stop like these:
 
#:
 
#:
Line 153: Line 153:
  
  
{{Question|Question=Vservers and X Windows||Details=
+
|Signature=derjohn}}{{Question|Question=Vservers and X Windows||Details=
 
#: Please see the ((Vservers and X)) page for information about this.
 
#: Please see the ((Vservers and X)) page for information about this.
  
{{Question|Question=sshd with X11-Forwarding in a vserver||Details=
+
|Signature=derjohn}}{{Question|Question=sshd with X11-Forwarding in a vserver||Details=
 
#: add ```'X11UseLocalhost no'``` to your sshd_config
 
#: add ```'X11UseLocalhost no'``` to your sshd_config
{{Question|Question=See also: [ProblematicPrograms]||Details=
+
|Signature=derjohn}}{{Question|Question=See also: [ProblematicPrograms]||Details=
 
== H. Help ==
 
== H. Help ==
{{Question|Question=Where can I find more information on the Linux-VServer project?||Details=
+
|Signature=derjohn}}{{Question|Question=Where can I find more information on the Linux-VServer project?||Details=
 
#:First have a look at the ((documentation)) section of the website. In case you can't find the answer here, have a look at the mailinglist archives. If this doesn't help jou, there is still a mailinglist and a IRC channel were you can ask for help.
 
#:First have a look at the ((documentation)) section of the website. In case you can't find the answer here, have a look at the mailinglist archives. If this doesn't help jou, there is still a mailinglist and a IRC channel were you can ask for help.
{{Question|Question=Does the Linux-VServer project have a mailing list?||Details=
+
|Signature=derjohn}}{{Question|Question=Does the Linux-VServer project have a mailing list?||Details=
 
#:Yes. You can subscribe [http://list.linux-vserver.org/mailman/listinfo/vserver here]. Archives are located [http://list.linux-vserver.org/archive/vserver/ here].
 
#:Yes. You can subscribe [http://list.linux-vserver.org/mailman/listinfo/vserver here]. Archives are located [http://list.linux-vserver.org/archive/vserver/ here].
{{Question|Question=Is there a IRC channel ||Details=
+
|Signature=derjohn}}{{Question|Question=Is there a IRC channel ||Details=
 
#:Yes, join #vserver on irc.oftc.net.
 
#:Yes, join #vserver on irc.oftc.net.
  
 
== I. Issues ==
 
== I. Issues ==
{{Question|Question=When starting or entering a vserver I get "''Error: /proc must be mounted''". 'vserver-stat' and 'vps' are failing with "''open("/proc/uptime"): No such file or directory''".  Sometimes, other files in /proc are mentioned. What can I do?||Details=
+
|Signature=derjohn}}{{Question|Question=When starting or entering a vserver I get "''Error: /proc must be mounted''". 'vserver-stat' and 'vps' are failing with "''open("/proc/uptime"): No such file or directory''".  Sometimes, other files in /proc are mentioned. What can I do?||Details=
 
#:Make sure that in devel and experimental the required proc entries are visible inside a vserver. With alpha utilities, execute the ||Details=vprocunhide||Details= script. See ((Proc-Security)) also.
 
#:Make sure that in devel and experimental the required proc entries are visible inside a vserver. With alpha utilities, execute the ||Details=vprocunhide||Details= script. See ((Proc-Security)) also.
{{Question|Question=Inside a vserver I can still use mknod to create devices, even without CAP_MKNOD capability. What's wrong? (this probably applies to all other capabilities but that was not tested)||Details=
+
|Signature=derjohn}}{{Question|Question=Inside a vserver I can still use mknod to create devices, even without CAP_MKNOD capability. What's wrong? (this probably applies to all other capabilities but that was not tested)||Details=
 
#:This is probably a problem in your kernel configuration. If you include "Enable different security models" (CONFIG_SECURITY), then make sure to also include "Default Linux Capabilities" (CONFIG_SECURITY_CAPABILITIES) or compile it as a module. In this latter case you must insert the 'capability' module into the kernel. This is for example true for current (2.6.8.1) debian kernel configurations.
 
#:This is probably a problem in your kernel configuration. If you include "Enable different security models" (CONFIG_SECURITY), then make sure to also include "Default Linux Capabilities" (CONFIG_SECURITY_CAPABILITIES) or compile it as a module. In this latter case you must insert the 'capability' module into the kernel. This is for example true for current (2.6.8.1) debian kernel configurations.
{{Question|Question=After stopping/restarting a vserver my network is gone! What the hell?||Details=
+
|Signature=derjohn}}{{Question|Question=After stopping/restarting a vserver my network is gone! What the hell?||Details=
 
#: See above.
 
#: See above.
{{Question|Question=Only root can access any files in the vserver||Details=
+
|Signature=derjohn}}{{Question|Question=Only root can access any files in the vserver||Details=
 
#: Check the permissions of the vserver's / directory. The 2.4 branch's chroot-escape blocker (chmod 0000 and chattr +t) is meant to be applied to the directory containing the vservers (for example /vservers) not the vservers' root directories themselves. If you revoked all permissions for a vserver's root directory, re-grant them with "chmod 0755 /path/to/vserver-root".
 
#: Check the permissions of the vserver's / directory. The 2.4 branch's chroot-escape blocker (chmod 0000 and chattr +t) is meant to be applied to the directory containing the vservers (for example /vservers) not the vservers' root directories themselves. If you revoked all permissions for a vserver's root directory, re-grant them with "chmod 0755 /path/to/vserver-root".
{{Question|Question="daemon() failed: Success" - What? Succesfully failing?||Details=
+
|Signature=derjohn}}{{Question|Question="daemon() failed: Success" - What? Succesfully failing?||Details=
 
#: Not really vserver related but here's the answer: Somebody replaced your /dev/null with a regular file, create a real /dev/null and it will start working again. We got no idea why the error message happens to be so funny(?).
 
#: Not really vserver related but here's the answer: Somebody replaced your /dev/null with a regular file, create a real /dev/null and it will start working again. We got no idea why the error message happens to be so funny(?).
{{Question|Question=When I start a vserver, "FATAL: kernel too old" message appears and vserver can't be started||Details=
+
|Signature=derjohn}}{{Question|Question=When I start a vserver, "FATAL: kernel too old" message appears and vserver can't be started||Details=
 
#:Edit your /etc/vservers/<vsname>/uts/release and define a value greater than kernel version
 
#:Edit your /etc/vservers/<vsname>/uts/release and define a value greater than kernel version
 
#:example, if you have a kernel "2.6.11", set "2005" for example  :-)
 
#:example, if you have a kernel "2.6.11", set "2005" for example  :-)
{{Question|Question=I switched from old to new configuration and now all my ip addresses are gone!||Details=
+
|Signature=derjohn}}{{Question|Question=I switched from old to new configuration and now all my ip addresses are gone!||Details=
 
#:They are not, ifconfig just doesn't show them. The new tools use 'iproute' instead of 'ifconfig' which allows you to use multiple interface addresses with the same label. In such cases, ifconfig shows only the first address for each label, which probably isn't available in the vserver. Unless you specify a name for an ip address, it will be given the interface name as label, eg. eth0, and ifconfig breaks. You can assign names to your interface addresses in the vserver configuration, see [http://www.nongnu.org/util-vserver/doc/conf/configuration.html The Great Flower Page] for details.
 
#:They are not, ifconfig just doesn't show them. The new tools use 'iproute' instead of 'ifconfig' which allows you to use multiple interface addresses with the same label. In such cases, ifconfig shows only the first address for each label, which probably isn't available in the vserver. Unless you specify a name for an ip address, it will be given the interface name as label, eg. eth0, and ifconfig breaks. You can assign names to your interface addresses in the vserver configuration, see [http://www.nongnu.org/util-vserver/doc/conf/configuration.html The Great Flower Page] for details.
 
#:Earlier, we said that the interface addresses were "nameless", this was wrong. As said above, the addresses in question actually all have the same name/label. Knowing this we could actually virtualize the ioctl interface which ifconfig uses in a meaningful way, making ifconfig show the vserver's ip addresses as expected, even when it shares its label with other ip addresses (of course only if there aren't multiple ip addresses in the same vserver that share the same label, but that's an ifconfig limitation, not a vserver bug). The [http://www.13thfloor.at/~doener/vserver/patches/diff-2.6.16.5-vs2.0.2-rc16-devinet_ioctl.diff patch] should apply to most Linux-VServer versions for kernel 2.6 and will probably be included in future versions.
 
#:Earlier, we said that the interface addresses were "nameless", this was wrong. As said above, the addresses in question actually all have the same name/label. Knowing this we could actually virtualize the ioctl interface which ifconfig uses in a meaningful way, making ifconfig show the vserver's ip addresses as expected, even when it shares its label with other ip addresses (of course only if there aren't multiple ip addresses in the same vserver that share the same label, but that's an ifconfig limitation, not a vserver bug). The [http://www.13thfloor.at/~doener/vserver/patches/diff-2.6.16.5-vs2.0.2-rc16-devinet_ioctl.diff patch] should apply to most Linux-VServer versions for kernel 2.6 and will probably be included in future versions.
{{Question|Question=When I enter/ssh into a vserver I can see all of the interfaces and interface aliases with ifconfig.||Details=
+
|Signature=derjohn}}{{Question|Question=When I enter/ssh into a vserver I can see all of the interfaces and interface aliases with ifconfig.||Details=
 
#:I experienced this after upgrading from a 2.4 to 2.6 kernel with vs-2.0 patch using legacy-method .conf files.  Upgrading from legacy-method to the new one (see [http://linux-vserver.org/Legacy-To-Newstyle-Config Converting From Legacy to New]) caused the problem to go away.
 
#:I experienced this after upgrading from a 2.4 to 2.6 kernel with vs-2.0 patch using legacy-method .conf files.  Upgrading from legacy-method to the new one (see [http://linux-vserver.org/Legacy-To-Newstyle-Config Converting From Legacy to New]) caused the problem to go away.
{{Question|Question=I keep my vserver roots on their own devices.  I can unmount them but the device (like drbd or lvm) remains in use until all of my vservers are killed off ("Someone has opened the device for RW access").||Details=
+
|Signature=derjohn}}{{Question|Question=I keep my vserver roots on their own devices.  I can unmount them but the device (like drbd or lvm) remains in use until all of my vservers are killed off ("Someone has opened the device for RW access").||Details=
 
#: When you mount something it is recorded in the current namespace.  When you start a vserver it makes copy of the namespace.  You can then unmount in the original  namespace without any problems, however the device is still in use.  This is because the device is still mounted in the new namespace.  You can do something like this: "vnamespace -e runningVserver umount /mnt/point". After this you should be able to remove the device (drbdadm secondary /dev/drbd0 or whatever).
 
#: When you mount something it is recorded in the current namespace.  When you start a vserver it makes copy of the namespace.  You can then unmount in the original  namespace without any problems, however the device is still in use.  This is because the device is still mounted in the new namespace.  You can do something like this: "vnamespace -e runningVserver umount /mnt/point". After this you should be able to remove the device (drbdadm secondary /dev/drbd0 or whatever).
 
#:More information:
 
#:More information:
Line 195: Line 195:
 
#*[http://www.gossamer-threads.com/lists/drbd/users/9282?page=last And this], a thread of related stuff.
 
#*[http://www.gossamer-threads.com/lists/drbd/users/9282?page=last And this], a thread of related stuff.
 
#:WARNING: if you use the kernel cleanup feature then make sure you know what you are doing.  I didn't, it was ugly.
 
#:WARNING: if you use the kernel cleanup feature then make sure you know what you are doing.  I didn't, it was ugly.
{{Question|Question=When I stop a vserver its network alias does not go away, I am getting 'RTNETLINK answers: Cannot assign requested address||Details='
+
|Signature=derjohn}}{{Question|Question=When I stop a vserver its network alias does not go away, I am getting 'RTNETLINK answers: Cannot assign requested address||Details='
 
#:Try running 'ip addr' and see if the interface names are being truncated (note: I came across a thread that seems to suggest that this might happen even if the interface name is not being truncated?).  The function that kills the interface specifies its name, if it is truncated then 'ip' will not be able to find the interface.
 
#:Try running 'ip addr' and see if the interface names are being truncated (note: I came across a thread that seems to suggest that this might happen even if the interface name is not being truncated?).  The function that kills the interface specifies its name, if it is truncated then 'ip' will not be able to find the interface.
 
#:Another cause might be that the IP was added (or already present at startup) with a different netmask, and therfore can not be removed properly
 
#:Another cause might be that the IP was added (or already present at startup) with a different netmask, and therfore can not be removed properly
Line 204: Line 204:
 
#:then ip will try to delete the interface by its IP alone.
 
#:then ip will try to delete the interface by its IP alone.
 
#:Anyone with a better solution is strongly encouraged to modify this entry.
 
#:Anyone with a better solution is strongly encouraged to modify this entry.
{{Question|Question=Why does the vserver run on a BSD fs (ufs) ?!||Details=
+
|Signature=derjohn}}{{Question|Question=Why does the vserver run on a BSD fs (ufs) ?!||Details=
 
#* I see something like: /dev/hdv1 / ufs defaults 0 0
 
#* I see something like: /dev/hdv1 / ufs defaults 0 0
 
#:The ufs part is correct and it is so to trick the quota tools to not try to lowlevel access the fs. The entry is FAKE anyway, ufs just solved this quota userland issue nicely (more or less).
 
#:The ufs part is correct and it is so to trick the quota tools to not try to lowlevel access the fs. The entry is FAKE anyway, ufs just solved this quota userland issue nicely (more or less).

Revision as of 00:57, 29 August 2006

Contents

A. General

|Signature=derjohn}}

Credits

#:This FAQ includes information taken from the FAQs of Jacques Gélinas and Paul Sladen.
derjohn


Are there other FAQs available?

#:Yes. There are other (mostly older) FAQ's available:
derjohn


Where can I find a overview of Linux-VServer?

#*((short presentation))
derjohn


How to verify that a setup is working properly?

#*To verify that your setup works properly, there are some test scripts to check basic functionality.
  1. primarily testme.sh and testfs.sh (see ((TestScripts)) for more details)
== B. Requirements ==
derjohn


What hardware is supported by linux-vserver?

#:The following platforms are supported in the stable versions of linux-vserver.
    • alpha
    • i386 and higher (and compatible)
    • ia32 / ia64
    • mips / mips64
    • hppa / hppa64
    • ppc / ppc64
    • sparc / sparc64
    • s390 / s390x
    • x86_64 (AMD64)
    • uml/xen
derjohn


Which kernel versions are supported?

#: recent 2.4 and 2.6 kernels (stable), recent 2.6 kernels (development).
  1. Some ancient versions of Linux-VServer are backported to 2.2.x kernels. You can find more information here.
derjohn


Can I run Linux-vserver on my favorite distribution?

#:Linux-VServer was originally developed on Red Hat/Mandriva, but it is rather distribution independent. It runs fine with other distributions (Debian, SuSE). Some distributions run a patched kernel, which can make it a bit harder to build a new kernel with Linux-VServer support == C. Versions ==
derjohn


What's the latest version of Linux-VServer?

#:You can find the latest stable 2.4 release or latest stable 2.6 release as well as the latest development release at http://www.13thfloor.at/vserver/
  1. Check out the ((Release FAQ)) for information on releases and version numbering
derjohn


Where can I find prereleases and release candidates?

#:Check the experimental area for new patches. == D. Tools (util-vserver and vserver) ==
derjohn


What do I need them for?

#:These are the userspace tools for Linux-VServer. You need them to use the functionality of Linux-VServer.
derjohn


What's the difference between vserver and util-vserver?

#:The vserver package are the 'legacy utilities', written by Jacques Gélinas.
  1. The util-vserver package is a reimplementation of these tools in C by Enrico Scholz, which follows the kernel development more closely.
    util-vserver tools are currently considered the mainstream tools (You can't use both packages on the same machine.)
    Both packages have their own version numbering. Don't let the version numbering confuse you.
derjohn


Which version of the tools packages do I need? Do I have to upgrade?

*:It can be useful to have a recent version of the tools package installed on your box. It's a good idea to upgrade your tools when you upgrade your kernel. In the next list you find the versions you need to have at least, but it's a good idea to use more recent versions.
    • linux-vserver 1.00
      • vserver 0.26
      • util-vserver 0.24
    • linux-vserver 1.20
      • vserver 0.28
      • util-vserver 0.25
    • linux-vserver 2.00
      • util-vserver 0.30 or 0.30.209
== E. Download ==
derjohn


Where can I dowload the latest version of:

derjohn


Distribution specific packages

#*Red Hat
== F. Network Usage? ==
derjohn


Is IPv6 supported?

#:At this moment, only IPv4 (the current most frequently used standard) is supported.
derjohn


Can I put my vservers in different networks?

#:Yes you can. You have to bind your vserver to a interface on the host machine, but you can choose the interface in the configuration file of your vserver (in /etc/vservers/SERVER.conf). Make sure your host server does have an interface in the network you need on your vserver.
derjohn


Is it possible for a vserver to have a other default gateway than the host machine does use?

#:Yes. Use iproute2 to set the default gateway.
  1. You can find more information on routing in linux-vserver in this posting on the mailinglist.
derjohn


Can I use more than one IP address in a vserver

#:Yes you can. Edit the configuration file of the vserver (/etc/vservers/SERVER.conf).
  1. In case you want to use example IP addresses on one interface
    1. IPROOT="10.1.2.3 10.1.2.12"
      IPROOTDEV="eth0"
    In case you want to use 2 or more interfaces
    1. IPROOT="eth0:10.1.2.3 eth1:10.1.2.12"
      IPROOTDEV=""
    In case you want to use IP-number in different subnets
    1. IPROOT="eth0:10.1.2.3/255.255.255.0 eth0:10.1.3.12/255.255.0.0"
      IPROOTDEV=""
    If you are using vserver 2.0+ you have to create subdirectories in /etc/vserver/<vserver-name>/interfaces/
    for each IP you want to use, i.e.
    /etc/vserver/<vserver-name>/interfaces/0
    /etc/vserver/<vserver-name>/interfaces/1
    These subdirectories have to contain files with the options you want to set. See the Flower page for more info
derjohn


Is it possible to use the real device (eth0, eth1) instead of the device alias created by vserver?

#:Yes. Set up the IP aliases yourself on the host server
    • Set IPROOT= to those IPs
    • Unset IPROOTDEV so the vserver script won't try to setup the IP aliases.
derjohn


Can I modify the behavior of my vservers?

#:There are a number of capabilities and flags that you can modify listed here (and here (cflags-v13.c)).
derjohn


Were can I find more information on networking in Linux-VServer?

#:You can find more information on the internals of networking in Linux-VServer here. == G. Software compatibility ==
derjohn


Bind does not work in a vserver

#* capset failed
      • The bind package expect to have the capability CAP_SYS_RESOURCE.
      It expects this because it was compiled this way on Linux and to increase its ulimit.
      • By default, a vserver does not have this capability for a good reason, you may have a look at 'man capabilities' to see how much control that capability allows.
      • A vserver starts with some ulimit values and can only reduce them, not enlarge them.
      • If you know what you are doing, you can give the capability to the vserver running bind.
      • A securer solution is to compile bind without that requirement by specifying './configure --disable-linux-caps'
      It looks like you only can run bind as root once you compile bind with this option, but this should be fine inside a vserver.
    • bind does not respond to queries
      • Bind seems to have problems with a query socket check. Bind believes the query is comming on a non-query socket, and doesn't answer the request.
      • putting "query-source address YOUR_VSERVER_IP;" in your named.conf solves this problem.
derjohn


Is DHCP possible in a vserver?

#:It's possible to run a DHCP server inside a vserver, but it required a CAP_NET_RAW capability.
  1. The solution for 2.6 kernel with new-style config is to add CAP_NET_RAW entry in the /etc/vserver/<vserver-name>/bcapabilities file, and it might be unnecessary to add 255.255.255.255 into bcast file, please read The Great Flower Page for more details. If you are still use the legacy config, please read the answer below.
    It's possible to run a DHCP server inside a vserver, but there is a catch. The set_ipv4root assigns one IP and one broadcast address to a vserver. UDP service listening to 0.0.0.0 (bind any) in a vserver are indeed listening to the vserver IP and vserver broadcast.
    This is all they will get. This is fine for most services.
    Unfortunately, dhcpd is receiving special broadcasts. Its clients are unaware of their IP number, so they are using special broadcast 255.255.255.255 address.
    A vserver generally runs with the broadcast address of the network device (the one used to setup the IP alias). This network device has a broadcast address which is never 255.255.255.255. Those special broadcast are not sent to the vserver. The solution is to set the IPROOTBCAST entry in the vserver configuration file like this IPROOTBCAST=255.255.255.255
    Restart your vserver and dhcpd will work. There is a catch (at least with 2.4.18ctx-9). If you are using other services in the save vserver, also relying on broadcast for proper operation (samba for one), they won't operate properly.
    One solution would be to enhance the semantics a little: A vserver would listen for its IP address, its broadcast address and also for 255.255.255.255.
    The dhcpd case is probably very specific though.
derjohn


NFS-server

#:It's not posible to run a NFS-kernel server inside a vserver, to work securely this would need a lot of work.
  1. You can try to run the NFS userspace server, the traditional Linux user space NFS server and UNFS3 are both reported to work.
    take a look at ((NFS and portmap)) if you have problems with your portmap
derjohn


Run Level Based Distributions as Ververs (Red Hat and such ....)

#: If you see errors after the command vserver <name> stop like these:
  1. Syncing hardware clock to system time hwclock is unable to get I/O port access: the iopl(3) call failed FAILED]
    Turning off swap: Not superuser. [FAILED]
    Turning off quotas: quotaoff: Can't stat() mounted device /dev/hdv1: No such file or directory
    Unmounting file systems: umount2: No such file or directory umount: /vservers: not found
    Then look for S* links in /etc/rc6.d/ and remove the one responsible for the errors. In RH9 it is called S01reboot
    A 'normal' server does some stuff on shutdown, like saving the time to the hwclock, or storing random pool data and finally invokes the reboot. Some of those actions are just not allowed in a vserver.
derjohn


Vservers and X Windows

#: Please see the ((Vservers and X)) page for information about this.
derjohn


sshd with X11-Forwarding in a vserver

#: add ```'X11UseLocalhost no'``` to your sshd_config
derjohn


See also: [ProblematicPrograms]

== H. Help ==
derjohn


Where can I find more information on the Linux-VServer project?

#:First have a look at the ((documentation)) section of the website. In case you can't find the answer here, have a look at the mailinglist archives. If this doesn't help jou, there is still a mailinglist and a IRC channel were you can ask for help.
derjohn


Does the Linux-VServer project have a mailing list?

#:Yes. You can subscribe here. Archives are located here.
derjohn


Is there a IRC channel

#:Yes, join #vserver on irc.oftc.net. == I. Issues ==
derjohn


When starting or entering a vserver I get "Error: /proc must be mounted". 'vserver-stat' and 'vps' are failing with "open("/proc/uptime"): No such file or directory". Sometimes, other files in /proc are mentioned. What can I do?

script. See ((Proc-Security)) also.
derjohn


Inside a vserver I can still use mknod to create devices, even without CAP_MKNOD capability. What's wrong? (this probably applies to all other capabilities but that was not tested)

#:This is probably a problem in your kernel configuration. If you include "Enable different security models" (CONFIG_SECURITY), then make sure to also include "Default Linux Capabilities" (CONFIG_SECURITY_CAPABILITIES) or compile it as a module. In this latter case you must insert the 'capability' module into the kernel. This is for example true for current (2.6.8.1) debian kernel configurations.
derjohn


After stopping/restarting a vserver my network is gone! What the hell?

#: See above.
derjohn


Only root can access any files in the vserver

#: Check the permissions of the vserver's / directory. The 2.4 branch's chroot-escape blocker (chmod 0000 and chattr +t) is meant to be applied to the directory containing the vservers (for example /vservers) not the vservers' root directories themselves. If you revoked all permissions for a vserver's root directory, re-grant them with "chmod 0755 /path/to/vserver-root".
derjohn


"daemon() failed: Success" - What? Succesfully failing?

#: Not really vserver related but here's the answer: Somebody replaced your /dev/null with a regular file, create a real /dev/null and it will start working again. We got no idea why the error message happens to be so funny(?).
derjohn


When I start a vserver, "FATAL: kernel too old" message appears and vserver can't be started

#:Edit your /etc/vservers/<vsname>/uts/release and define a value greater than kernel version
  1. example, if you have a kernel "2.6.11", set "2005" for example  :-)
derjohn


I switched from old to new configuration and now all my ip addresses are gone!

#:They are not, ifconfig just doesn't show them. The new tools use 'iproute' instead of 'ifconfig' which allows you to use multiple interface addresses with the same label. In such cases, ifconfig shows only the first address for each label, which probably isn't available in the vserver. Unless you specify a name for an ip address, it will be given the interface name as label, eg. eth0, and ifconfig breaks. You can assign names to your interface addresses in the vserver configuration, see The Great Flower Page for details.
  1. Earlier, we said that the interface addresses were "nameless", this was wrong. As said above, the addresses in question actually all have the same name/label. Knowing this we could actually virtualize the ioctl interface which ifconfig uses in a meaningful way, making ifconfig show the vserver's ip addresses as expected, even when it shares its label with other ip addresses (of course only if there aren't multiple ip addresses in the same vserver that share the same label, but that's an ifconfig limitation, not a vserver bug). The patch should apply to most Linux-VServer versions for kernel 2.6 and will probably be included in future versions.
derjohn


When I enter/ssh into a vserver I can see all of the interfaces and interface aliases with ifconfig.

#:I experienced this after upgrading from a 2.4 to 2.6 kernel with vs-2.0 patch using legacy-method .conf files. Upgrading from legacy-method to the new one (see Converting From Legacy to New) caused the problem to go away.
derjohn


I keep my vserver roots on their own devices. I can unmount them but the device (like drbd or lvm) remains in use until all of my vservers are killed off ("Someone has opened the device for RW access").

#: When you mount something it is recorded in the current namespace. When you start a vserver it makes copy of the namespace. You can then unmount in the original namespace without any problems, however the device is still in use. This is because the device is still mounted in the new namespace. You can do something like this: "vnamespace -e runningVserver umount /mnt/point". After this you should be able to remove the device (drbdadm secondary /dev/drbd0 or whatever).
  1. More information:
    WARNING: if you use the kernel cleanup feature then make sure you know what you are doing. I didn't, it was ugly.
derjohn


When I stop a vserver its network alias does not go away, I am getting 'RTNETLINK answers: Cannot assign requested address

'
  1. Try running 'ip addr' and see if the interface names are being truncated (note: I came across a thread that seems to suggest that this might happen even if the interface name is not being truncated?). The function that kills the interface specifies its name, if it is truncated then 'ip' will not be able to find the interface.
    Another cause might be that the IP was added (or already present at startup) with a different netmask, and therfore can not be removed properly
    My solution to this is very, very gross. Open up your vserver.functions file and find the disableInterfaces function. If you change
    IP_ADDR) $_IP addr del "$@";;
    to
    IP_ADDR) $(echo $_IP addr del "$@"
derjohn


{{Question|Question=Why does the vserver run on a BSD fs (ufs) ?!||Details=

    • I see something like: /dev/hdv1 / ufs defaults 0 0
    The ufs part is correct and it is so to trick the quota tools to not try to lowlevel access the fs. The entry is FAKE anyway, ufs just solved this quota userland issue nicely (more or less).
    • For details see: [1] and [2]
    • When I issue a ping it returns:
    [root@VServerGuest /]# ping 123.123.123.123
    connect: Invalid argument
    • When I issue a DNS lookup it returns:
    [root@VServerGuest /]# host www.yahoo.ca
    socket.c: internal_send: 222.222.222.222#53: Invalid argument
     ;; connection timed out; no servers could be reached
    • When I try to run vyum it returns:
    [root@VServerGuest /]# vyum VServerGuest -- check-update
    Cannot find a valid baseurl for repo: core
    Error: Cannot find a valid baseurl for repo: core
    Make sure that you have either a Public IP setup on the VServer Guest, or that you have a proper SNAT/DNAT rules setup on your VServer Host. After that, restart the vserver guest with the verbose option to see what your ipv4root is set to:
    [root@VServerGuest /]# vserver -v VServerGuest start
    ipv4root is now 127.0.0.10 111.111.111.111
    New security context is 49156
    You must make sure the order of the interfaces are correct. The very first Interface (decided upon by alphabetical order of the interface directory name) for the VServer is the default IP used for all network connections. This must be either a public IP or an IP that has been D/SNAT'd.
Personal tools