http://linux-vserver.org/index.php?title=Running_runit-supervised_services_inside_a_vserver&feed=atom&action=historyRunning runit-supervised services inside a vserver - Revision history2024-03-28T17:52:59ZRevision history for this page on the wikiMediaWiki 1.20.2http://linux-vserver.org/index.php?title=Running_runit-supervised_services_inside_a_vserver&diff=5019&oldid=prevGlenn: catspec2011-10-21T21:15:03Z<p>catspec</p>
<table class='diff diff-contentalign-left'>
<col class='diff-marker' />
<col class='diff-content' />
<col class='diff-marker' />
<col class='diff-content' />
<tr style='vertical-align: top;'>
<td colspan='2' style="background-color: white; color:black;">← Older revision</td>
<td colspan='2' style="background-color: white; color:black;">Revision as of 21:15, 21 October 2011</td>
</tr><tr><td colspan="2" class="diff-lineno">Line 216:</td>
<td colspan="2" class="diff-lineno">Line 216:</td></tr>
<tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>--[[User:KornAndras|Guy-]] 12:18, 28 September 2008 (CET)</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>--[[User:KornAndras|Guy-]] 12:18, 28 September 2008 (CET)</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div>[[Category:<del class="diffchange diffchange-inline">Documentation</del>]]</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>[[Category:<ins class="diffchange diffchange-inline">Software under linux-vserver</ins>]]</div></td></tr>
</table>Glennhttp://linux-vserver.org/index.php?title=Running_runit-supervised_services_inside_a_vserver&diff=4829&oldid=prevGlenn: spelling2011-10-21T18:59:48Z<p>spelling</p>
<table class='diff diff-contentalign-left'>
<col class='diff-marker' />
<col class='diff-content' />
<col class='diff-marker' />
<col class='diff-content' />
<tr style='vertical-align: top;'>
<td colspan='2' style="background-color: white; color:black;">← Older revision</td>
<td colspan='2' style="background-color: white; color:black;">Revision as of 18:59, 21 October 2011</td>
</tr><tr><td colspan="2" class="diff-lineno">Line 216:</td>
<td colspan="2" class="diff-lineno">Line 216:</td></tr>
<tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>--[[User:KornAndras|Guy-]] 12:18, 28 September 2008 (CET)</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>--[[User:KornAndras|Guy-]] 12:18, 28 September 2008 (CET)</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div>[[Category:<del class="diffchange diffchange-inline">Documentaion</del>]]</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>[[Category:<ins class="diffchange diffchange-inline">Documentation</ins>]]</div></td></tr>
</table>Glennhttp://linux-vserver.org/index.php?title=Running_runit-supervised_services_inside_a_vserver&diff=4813&oldid=prevGlenn: +cat2011-10-21T18:52:27Z<p>+cat</p>
<table class='diff diff-contentalign-left'>
<col class='diff-marker' />
<col class='diff-content' />
<col class='diff-marker' />
<col class='diff-content' />
<tr style='vertical-align: top;'>
<td colspan='2' style="background-color: white; color:black;">← Older revision</td>
<td colspan='2' style="background-color: white; color:black;">Revision as of 18:52, 21 October 2011</td>
</tr><tr><td colspan="2" class="diff-lineno">Line 215:</td>
<td colspan="2" class="diff-lineno">Line 215:</td></tr>
<tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td></tr>
<tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>--[[User:KornAndras|Guy-]] 12:18, 28 September 2008 (CET)</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>--[[User:KornAndras|Guy-]] 12:18, 28 September 2008 (CET)</div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;"></ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;">[[Category:Documentaion]]</ins></div></td></tr>
</table>Glennhttp://linux-vserver.org/index.php?title=Running_runit-supervised_services_inside_a_vserver&diff=4085&oldid=prevKornAndras: Undo vandalism: revision 4084 by 200.166.248.132 (Talk)2009-11-23T19:57:09Z<p>Undo vandalism: revision 4084 by <a href="/Special:Contributions/200.166.248.132" title="Special:Contributions/200.166.248.132">200.166.248.132</a> (<a href="/index.php?title=User_talk:200.166.248.132&action=edit&redlink=1" class="new" title="User talk:200.166.248.132 (page does not exist)">Talk</a>)</p>
<table class='diff diff-contentalign-left'>
<col class='diff-marker' />
<col class='diff-content' />
<col class='diff-marker' />
<col class='diff-content' />
<tr style='vertical-align: top;'>
<td colspan='2' style="background-color: white; color:black;">← Older revision</td>
<td colspan='2' style="background-color: white; color:black;">Revision as of 19:57, 23 November 2009</td>
</tr><tr><td colspan="2" class="diff-lineno">Line 1:</td>
<td colspan="2" class="diff-lineno">Line 1:</td></tr>
<tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>This page describes a setup where you have a [http://smarden.org/runit runit] installation on the host and use it to directly supervise services running in vserver guests.</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>This page describes a setup where you have a [http://smarden.org/runit runit] installation on the host and use it to directly supervise services running in vserver guests.</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del class="diffchange diffchange-inline">wTRnHL </del>http://<del class="diffchange diffchange-inline">j8Jw83mNs0doPpsqvjrcns5</del>.<del class="diffchange diffchange-inline">info</del></div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">== Motivation and goals ==</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">This is what I wanted to achieve:</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">* Partition a physical server with many responsibilities into vservers that can easily be upgraded individually without breaking any unrelated stuff.</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">* Each service or small set of services should run in its own vserver.</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">* Services should be supervised (started, stopped and managed) by [</ins>http://<ins class="diffchange diffchange-inline">smarden.org/runit runit].</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">* Service logs should accumulate on the host, not the guests.</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">** <tt>svlogd</tt> rotates them nicely and can invoke my <tt>multilogcheck</tt> script to alert me of unusual events as a postprocessor, but</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">** I don't want to install <tt>multilogcheck</tt> inside every vserver because it's messy.</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">** I don't like syslog. There are many problems with it, but I won't go into that here.</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">*** Therefore, services mostly log to stdout and thus to svlogd.</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">*** For services that absolutely must use syslog, I provide [http://smarden.org/socklog socklog].</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">*** Again, I don't want a separate <tt>socklog</tt> instance in every vserver.</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">*** Alas, <tt>socklog</tt> is unable to listen on more than one Unix domain socket.</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">**** Luckily, <tt>socat</tt> can be used to relay syslog messages from the vservers to the master <tt>socklog</tt> on the host. (<tt>syslog-ng</tt> would also have done the job nicely.)</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">**** It's also possible to bind mount the <tt>/dev/log</tt> socket in every guest; however, I'm afraid this breaks if you restart socklog after a guest is up. Workaround: make <tt>/dev/log</tt> a symlink to, say, <tt>/var/run/syslog/socket</tt> everywhere and bind mount the host's <tt>/var/run/syslog</tt> directory in the guests; that way the socket will still be available even if socklog unlinks and recreates it.</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">* It should be straightforward and next to transparent to manage the services running in vservers.</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">** With <tt>runit</tt>, it's easy to delegate management rights of a service to users (chown and chmod some files in the pertinent <tt>supervise</tt> directory). This should continue to work</ins>.</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td></tr>
<tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>== Prerequisites ==</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>== Prerequisites ==</div></td></tr>
</table>KornAndrashttp://linux-vserver.org/index.php?title=Running_runit-supervised_services_inside_a_vserver&diff=4084&oldid=prev200.166.248.132: /* Motivation and goals */2009-11-23T18:21:06Z<p><span dir="auto"><span class="autocomment">Motivation and goals</span></span></p>
<table class='diff diff-contentalign-left'>
<col class='diff-marker' />
<col class='diff-content' />
<col class='diff-marker' />
<col class='diff-content' />
<tr style='vertical-align: top;'>
<td colspan='2' style="background-color: white; color:black;">← Older revision</td>
<td colspan='2' style="background-color: white; color:black;">Revision as of 18:21, 23 November 2009</td>
</tr><tr><td colspan="2" class="diff-lineno">Line 1:</td>
<td colspan="2" class="diff-lineno">Line 1:</td></tr>
<tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>This page describes a setup where you have a [http://smarden.org/runit runit] installation on the host and use it to directly supervise services running in vserver guests.</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>This page describes a setup where you have a [http://smarden.org/runit runit] installation on the host and use it to directly supervise services running in vserver guests.</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del class="diffchange diffchange-inline">== Motivation and goals ==</del></div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">wTRnHL </ins>http://<ins class="diffchange diffchange-inline">j8Jw83mNs0doPpsqvjrcns5</ins>.<ins class="diffchange diffchange-inline">info</ins></div></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div> </div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div></div></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del class="diffchange diffchange-inline">This is what I wanted to achieve:</del></div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div></div></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div> </div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div></div></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del class="diffchange diffchange-inline">* Partition a physical server with many responsibilities into vservers that can easily be upgraded individually without breaking any unrelated stuff.</del></div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div></div></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del class="diffchange diffchange-inline">* Each service or small set of services should run in its own vserver.</del></div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div></div></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del class="diffchange diffchange-inline">* Services should be supervised (started, stopped and managed) by [</del>http://<del class="diffchange diffchange-inline">smarden.org/runit runit].</del></div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div></div></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del class="diffchange diffchange-inline">* Service logs should accumulate on the host, not the guests.</del></div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div></div></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del class="diffchange diffchange-inline">** <tt>svlogd</tt> rotates them nicely and can invoke my <tt>multilogcheck</tt> script to alert me of unusual events as a postprocessor, but</del></div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div></div></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del class="diffchange diffchange-inline">** I don't want to install <tt>multilogcheck</tt> inside every vserver because it's messy.</del></div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div></div></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del class="diffchange diffchange-inline">** I don't like syslog. There are many problems with it, but I won't go into that here.</del></div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div></div></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del class="diffchange diffchange-inline">*** Therefore, services mostly log to stdout and thus to svlogd.</del></div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div></div></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del class="diffchange diffchange-inline">*** For services that absolutely must use syslog, I provide [http://smarden.org/socklog socklog].</del></div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div></div></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del class="diffchange diffchange-inline">*** Again, I don't want a separate <tt>socklog</tt> instance in every vserver.</del></div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div></div></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del class="diffchange diffchange-inline">*** Alas, <tt>socklog</tt> is unable to listen on more than one Unix domain socket.</del></div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div></div></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del class="diffchange diffchange-inline">**** Luckily, <tt>socat</tt> can be used to relay syslog messages from the vservers to the master <tt>socklog</tt> on the host. (<tt>syslog-ng</tt> would also have done the job nicely.)</del></div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div></div></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del class="diffchange diffchange-inline">**** It's also possible to bind mount the <tt>/dev/log</tt> socket in every guest; however, I'm afraid this breaks if you restart socklog after a guest is up. Workaround: make <tt>/dev/log</tt> a symlink to, say, <tt>/var/run/syslog/socket</tt> everywhere and bind mount the host's <tt>/var/run/syslog</tt> directory in the guests; that way the socket will still be available even if socklog unlinks and recreates it.</del></div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div></div></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del class="diffchange diffchange-inline">* It should be straightforward and next to transparent to manage the services running in vservers.</del></div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div></div></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del class="diffchange diffchange-inline">** With <tt>runit</tt>, it's easy to delegate management rights of a service to users (chown and chmod some files in the pertinent <tt>supervise</tt> directory). This should continue to work</del>.</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div></div></td></tr>
<tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td></tr>
<tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>== Prerequisites ==</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>== Prerequisites ==</div></td></tr>
</table>200.166.248.132http://linux-vserver.org/index.php?title=Running_runit-supervised_services_inside_a_vserver&diff=3313&oldid=prevKornAndras: /* Running services */ disadvantages2008-09-28T10:19:09Z<p><span dir="auto"><span class="autocomment">Running services: </span> disadvantages</span></p>
<table class='diff diff-contentalign-left'>
<col class='diff-marker' />
<col class='diff-content' />
<col class='diff-marker' />
<col class='diff-content' />
<tr style='vertical-align: top;'>
<td colspan='2' style="background-color: white; color:black;">← Older revision</td>
<td colspan='2' style="background-color: white; color:black;">Revision as of 10:19, 28 September 2008</td>
</tr><tr><td colspan="2" class="diff-lineno">Line 199:</td>
<td colspan="2" class="diff-lineno">Line 199:</td></tr>
<tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td></tr>
<tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>Comments and additions welcome.</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>Comments and additions welcome.</div></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div>--[[User:KornAndras|Guy-]] <del class="diffchange diffchange-inline">03</del>:<del class="diffchange diffchange-inline">29</del>, <del class="diffchange diffchange-inline">2 February 2007 </del>(CET)</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">== Disadvantages ==</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">The most significant problem with this approach (as opposed to using initstyle plain and a separate runit instance in each vserver) is that it's no longer straightforward to manage the services running in vservers from inside the vservers; package management scripts can't stop them for upgrades, for example (unless you modify the initscripts in quite horrible ways).</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">Initial setup is also slightly more complicated.</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">These have to be weighed against the advantages of:</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">* having fewer superfluous processes (like a separate <tt>runit</tt> and <tt>runsvdir</tt> in each vserver);</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">* being able to manage the services easily from the host;</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">* avoiding the need to run <tt>sshd</tt> inside each guest in order to be able to easily delegate service management privileges to others.</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">Nowadays I tend to think the initstyle plain method is better after all.</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>--[[User:KornAndras|Guy-]] <ins class="diffchange diffchange-inline">12</ins>:<ins class="diffchange diffchange-inline">18</ins>, <ins class="diffchange diffchange-inline">28 September 2008 </ins>(CET)</div></td></tr>
</table>KornAndrashttp://linux-vserver.org/index.php?title=Running_runit-supervised_services_inside_a_vserver&diff=3312&oldid=prevKornAndras: /* Motivation and goals */ bind mounting /dev/log socket is also possible2008-09-28T10:05:48Z<p><span dir="auto"><span class="autocomment">Motivation and goals: </span> bind mounting /dev/log socket is also possible</span></p>
<table class='diff diff-contentalign-left'>
<col class='diff-marker' />
<col class='diff-content' />
<col class='diff-marker' />
<col class='diff-content' />
<tr style='vertical-align: top;'>
<td colspan='2' style="background-color: white; color:black;">← Older revision</td>
<td colspan='2' style="background-color: white; color:black;">Revision as of 10:05, 28 September 2008</td>
</tr><tr><td colspan="2" class="diff-lineno">Line 17:</td>
<td colspan="2" class="diff-lineno">Line 17:</td></tr>
<tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>*** Alas, <tt>socklog</tt> is unable to listen on more than one Unix domain socket.</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>*** Alas, <tt>socklog</tt> is unable to listen on more than one Unix domain socket.</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>**** Luckily, <tt>socat</tt> can be used to relay syslog messages from the vservers to the master <tt>socklog</tt> on the host. (<tt>syslog-ng</tt> would also have done the job nicely.)</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>**** Luckily, <tt>socat</tt> can be used to relay syslog messages from the vservers to the master <tt>socklog</tt> on the host. (<tt>syslog-ng</tt> would also have done the job nicely.)</div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;">**** It's also possible to bind mount the <tt>/dev/log</tt> socket in every guest; however, I'm afraid this breaks if you restart socklog after a guest is up. Workaround: make <tt>/dev/log</tt> a symlink to, say, <tt>/var/run/syslog/socket</tt> everywhere and bind mount the host's <tt>/var/run/syslog</tt> directory in the guests; that way the socket will still be available even if socklog unlinks and recreates it.</ins></div></td></tr>
<tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>* It should be straightforward and next to transparent to manage the services running in vservers.</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>* It should be straightforward and next to transparent to manage the services running in vservers.</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>** With <tt>runit</tt>, it's easy to delegate management rights of a service to users (chown and chmod some files in the pertinent <tt>supervise</tt> directory). This should continue to work.</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>** With <tt>runit</tt>, it's easy to delegate management rights of a service to users (chown and chmod some files in the pertinent <tt>supervise</tt> directory). This should continue to work.</div></td></tr>
</table>KornAndrashttp://linux-vserver.org/index.php?title=Running_runit-supervised_services_inside_a_vserver&diff=2583&oldid=prevKornAndras: typo fix2007-06-28T13:11:30Z<p>typo fix</p>
<table class='diff diff-contentalign-left'>
<col class='diff-marker' />
<col class='diff-content' />
<col class='diff-marker' />
<col class='diff-content' />
<tr style='vertical-align: top;'>
<td colspan='2' style="background-color: white; color:black;">← Older revision</td>
<td colspan='2' style="background-color: white; color:black;">Revision as of 13:11, 28 June 2007</td>
</tr><tr><td colspan="2" class="diff-lineno">Line 1:</td>
<td colspan="2" class="diff-lineno">Line 1:</td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div>This page describes a setup where you have a [http://smarden.org/runit runit] installation on the host and use it to directly <del class="diffchange diffchange-inline">supervies </del>services running in vserver guests.</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>This page describes a setup where you have a [http://smarden.org/runit runit] installation on the host and use it to directly <ins class="diffchange diffchange-inline">supervise </ins>services running in vserver guests.</div></td></tr>
<tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td></tr>
<tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>== Motivation and goals ==</div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div>== Motivation and goals ==</div></td></tr>
</table>KornAndrashttp://linux-vserver.org/index.php?title=Running_runit-supervised_services_inside_a_vserver&diff=2273&oldid=prevKornAndras: Initial version2007-02-02T02:29:31Z<p>Initial version</p>
<p><b>New page</b></p><div>This page describes a setup where you have a [http://smarden.org/runit runit] installation on the host and use it to directly supervies services running in vserver guests.<br />
<br />
== Motivation and goals ==<br />
<br />
This is what I wanted to achieve:<br />
<br />
* Partition a physical server with many responsibilities into vservers that can easily be upgraded individually without breaking any unrelated stuff.<br />
* Each service or small set of services should run in its own vserver.<br />
* Services should be supervised (started, stopped and managed) by [http://smarden.org/runit runit].<br />
* Service logs should accumulate on the host, not the guests.<br />
** <tt>svlogd</tt> rotates them nicely and can invoke my <tt>multilogcheck</tt> script to alert me of unusual events as a postprocessor, but<br />
** I don't want to install <tt>multilogcheck</tt> inside every vserver because it's messy.<br />
** I don't like syslog. There are many problems with it, but I won't go into that here.<br />
*** Therefore, services mostly log to stdout and thus to svlogd.<br />
*** For services that absolutely must use syslog, I provide [http://smarden.org/socklog socklog].<br />
*** Again, I don't want a separate <tt>socklog</tt> instance in every vserver.<br />
*** Alas, <tt>socklog</tt> is unable to listen on more than one Unix domain socket.<br />
**** Luckily, <tt>socat</tt> can be used to relay syslog messages from the vservers to the master <tt>socklog</tt> on the host. (<tt>syslog-ng</tt> would also have done the job nicely.)<br />
* It should be straightforward and next to transparent to manage the services running in vservers.<br />
** With <tt>runit</tt>, it's easy to delegate management rights of a service to users (chown and chmod some files in the pertinent <tt>supervise</tt> directory). This should continue to work.<br />
<br />
== Prerequisites ==<br />
<br />
# A fairly recent vserver kernel with support for persistent contexts (I used 2.6.19.2-vs2.2.0-rc8.7).<br />
# A recent version of util-vserver that supports persistent contexts correctly (I used [http://people.linux-vserver.org/~dhozac/p/uv/experimental/util-vserver-0.30.213-rc1.tar.bz2 0.30.213-rc1]).<br />
# Daniel_Hozac's [http://people.linux-vserver.org/~dhozac/t/signal-relay.c signal-relay] program.<br />
<br />
== The big picture ==<br />
<br />
Let's see how it all fits together.<br />
<br />
We'd like to achieve something like this (output of <tt>vps axfu</tt>):<br />
<br />
<pre><br />
USER PID CONTEXT %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND<br />
root 1 0 MAIN 0.0 0.0 104 16 ? Ss Jan29 0:06 runit<br />
root 4188 0 MAIN 0.0 0.0 132 32 ? Ss Jan29 0:10 runsvdir -P /var/service log: .......................................................<br />
root 4250 0 MAIN 0.0 0.0 108 28 ? Ss Jan29 0:00 \_ runsv vserver-logrelay-squid<br />
log 4256 0 MAIN 0.0 0.0 128 44 ? S Jan29 0:00 | \_ svlogd -t /var/log/sv/vserver-logrelay-squid<br />
logrelay 3106 0 MAIN 0.0 0.1 25428 1944 ? S 00:44 0:00 | \_ socat -d -d -d -D -ls -u UNIX-LISTEN:/etc/vservers/squid/vdir/dev/log,unlink-early,nonblock,mode=666,setuid=logrelay UNIX-CONNECT:/dev/log,type=2,nonblock,forever<br />
root 19272 0 MAIN 0.0 0.0 108 28 ? Ss Feb01 0:00 \_ runsv squid<br />
log 19273 0 MAIN 0.0 0.0 128 44 ? S Feb01 0:00 | \_ svlogd -t /var/log/sv/squid<br />
root 10324 0 MAIN 0.0 0.0 5728 364 ? S Feb01 0:00 | \_ signal-relay vserver squid exec squid -N -D -sYC<br />
proxy 10334 2 squid 0.0 0.5 24968 8036 ? Sl Feb01 0:01 | \_ squid -N -D -sYC<br />
root 24219 0 MAIN 0.0 0.0 108 32 ? Ss 02:02 0:00 \_ runsv nmbd<br />
root 24220 0 MAIN 0.0 0.0 5732 376 ? S 02:02 0:00 | \_ signal-relay vserver samba exec /usr/sbin/nmbd -F<br />
root 24230 3 samba 0.0 0.1 30080 2360 ? Ss 02:02 0:00 | \_ /usr/sbin/nmbd -F<br />
root 24251 3 samba 0.0 0.0 32172 1496 ? S 02:02 0:00 | \_ /usr/sbin/nmbd -F<br />
root 24253 0 MAIN 0.0 0.0 108 28 ? Ss 02:02 0:00 \_ runsv smbd<br />
root 24254 0 MAIN 0.0 0.0 5732 376 ? S 02:02 0:00 | \_ signal-relay vserver samba exec /usr/sbin/smbd -F<br />
root 24268 3 samba 0.0 0.2 41888 3404 ? Ss 02:02 0:00 | \_ /usr/sbin/smbd -F<br />
root 24289 3 samba 0.0 0.0 41888 1232 ? S 02:02 0:00 | \_ /usr/sbin/smbd -F<br />
root 29625 0 MAIN 0.0 0.0 104 28 ? Ss 02:22 0:00 \_ runsv cron-squid<br />
root 29626 0 MAIN 0.0 0.0 5732 376 ? S 02:22 0:00 \_ signal-relay vserver squid exec cron -f<br />
root 29637 2 squid 0.0 0.0 11492 1060 ? S 02:22 0:00 \_ cron -f<br />
</pre><br />
<br />
For service supervision to work, we must be able to send signals to our services. Specifically, <tt>runsv</tt> must be able to send signals to its children.<br />
Alas, it's not prepared to send signals across context boundaries, which is where <tt>signal-relay</tt> comes in.<br />
<br />
=== <tt>signal-relay</tt> ===<br />
<br />
<tt>signal-relay</tt> is a small program not unlike <tt>runit</tt>'s <tt>chpst</tt> that does the following:<br />
<br />
* it forks a child;<br />
** inside the child, it execs the program specified on its command line;<br />
* in the parent, it sets up signal handlers for every signal that relay the signal to the child, even if the child is running in a different context;<br />
* if the child exits, <tt>signal-relay</tt> exits.<br />
* (It can also put the child into its own process group; use the <tt>-P</tt> switch. Sending signals to process groups in a different context doesn't work yet, though.)<br />
<br />
=== Setting up the vservers ===<br />
<br />
When we start a service for runit, we want the command that starts the service to stay in the foreground until the moment the service dies. <tt>vserver exec</tt> looks just right, but there is a catch: it only works for vservers that have been "started". <tt>vserver start</tt>, however, doesn't fit very well into the <tt>runit</tt> way of doing things. You can set it up as a service (this is discussed in [[util-vserver:InitStyles]]), but it seems superfluous to leave some processes around just to keep a vserver "started" so that we can run services in it.<br />
<br />
What we need is a way of basically doing "start vserver <guest> if it's not started, then exec program <service> inside it". Normally, a context with no processes running inside it is destroyed by the kernel; thus, just setting <tt>/etc/vservers/guest/apps/init/cmd.start</tt> to <tt>/bin/true</tt> isn't going to work; we would need something that stays around for a while, like a script that calls <tt>sleep 1m &</tt>. This would make <tt>vserver start</tt> happy, so in our service run script, we could do something like<br />
<br />
<pre><br />
vserver guest status || vserver guest start<br />
exec signal-relay vserver guest exec /path/to/service-program<br />
</pre><br />
<br />
A more elegant solution is to make the guest context ''persistent''. This way it sticks around even if there are no processes left in it.<br />
<br />
<pre><br />
cd /etc/vservers/guest<br />
echo persistent >>flags<br />
echo persistent >>nflags<br />
echo /bin/true >apps/init/cmd.start<br />
</pre><br />
<br />
(I ''guess'' <tt>nflags</tt> is for the network context.)<br />
<br />
Now, <tt>vserver guest start</tt> should be able to "start" our vserver (set up all of its state), and exit without leaving stray processes around.<br />
<br />
== Running services ==<br />
<br />
Say you have a vserver called <tt>squid</tt>, and you want to run your <tt>squid</tt> proxy inside it to keep it insulated from the other processes on the system, and vice versa.<br />
<br />
In our current setup, the following run script will do the trick (it borrows a bit from Debian's initscript and uses the Debian defaults file):<br />
<br />
<pre><br />
#!/bin/sh<br />
exec 2>&1<br />
<br />
# Set a default for max. filedescriptors<br />
SQUID_MAXFD=4096<br />
<br />
# Figure out the name of the service we're running as<br />
SVNAME=$(basename $(pwd))<br />
<br />
# Read the configfile of this service; if it sets VSERVERNAME, we'll assume we have to run inside the specified vserver<br />
CONFIG=/etc/default/"$SVNAME"<br />
[ -r "$CONFIG" ] && . "$CONFIG"<br />
<br />
# Source Debian defaults<br />
[ -n "$VSERVERNAME" ] && VROOT="/etc/vservers/$VSERVERNAME/vdir" || VROOT=/<br />
[ -r "$VROOT/etc/default/squid" ] && . "$VROOT/etc/default/squid"<br />
<br />
[ "$SQUID_MAXFD" -gt 4096 ] && SQUID_MAXFD=4096<br />
<br />
if test -f /proc/sys/fs/file-max; then<br />
global_file_max=$(cat /proc/sys/fs/file-max)<br />
minimal_file_max=$(($SQUID_MAXFD + 4096))<br />
[ "$global_file_max" -lt "$minimal_file_max" ] && echo "$minimal_file_max" >/proc/sys/fs/file-max<br />
fi<br />
<br />
if [ ! "$VSERVERNAME" = "" ]; then<br />
VSERVERARGS="signal-relay vserver $VSERVERNAME exec"<br />
vserver "$VSERVERNAME" status || vserver "$VSERVERNAME" start # start the vserver if necessary<br />
fi<br />
<br />
exec chpst -o"$SQUID_MAXFD" $VSERVERARGS squid -N -D -sYC<br />
</pre><br />
<br />
This script is generic in the sense that it works with or without a vserver setup.<br />
<br />
You can run an <tt>svlogd</tt> for this service like you normally would; or you could have all your <tt>svlogd</tt>s run in a different vserver.<br />
<br />
A run script for <tt>cron</tt> that automatically figures out if it should run in a vserver:<br />
<br />
<pre><br />
#!/bin/sh<br />
exec 2>&1<br />
DEPENDENCIES=""<br />
RLIMIT="chpst -t 172800"<br />
SVNAME=$(basename $(pwd))<br />
CONFIG=/etc/default/"$SVNAME"<br />
<br />
# Assume part after dash is name of vserver<br />
if [ ! "${SVNAME/*-/}" = "$SVNAME" ]; then<br />
VSERVERNAME="${SVNAME/*-/}"<br />
fi<br />
<br />
# By default, we depend on the socklog service if it exists<br />
[ -e /service/socklog ] && DEPENDENCIES=socklog<br />
<br />
# And also on the logrelay service of the pertinent vserver<br />
[ -e /service/vserver-logrelay-"$VSERVERNAME" ] && DEPENDENCIES="$DEPENDENCIES vserver-logrelay-$VSERVERNAME"<br />
<br />
# Can override VSERVERNAME, RLIMIT and DEPENDENCIES here if necessary<br />
[ -r "$CONFIG" ] && . "$CONFIG"<br />
<br />
if [ ! "$VSERVERNAME" = "" ]; then<br />
VSERVERARGS="signal-relay vserver $VSERVERNAME exec"<br />
vserver "$VSERVERNAME" status || vserver "$VSERVERNAME" start<br />
fi<br />
<br />
if [ -n "$DEPENDENCIES" ]; then<br />
sv start $DEPENDENCIES || exit 1<br />
fi<br />
<br />
exec $RLIMIT $VSERVERARGS cron -f<br />
</pre><br />
<br />
Now, if you place this run script in a service directory called <tt>cron-squid</tt>, it will run a cron daemon in the <tt>squid</tt> guest. This takes care of rotating the squid logs under <tt>/var/log/squid</tt>, for example; although this could also be done on the host with a few kludges.<br />
<br />
The vserver-logrelay-template/run script looks like this:<br />
<br />
<pre><br />
#!/bin/sh<br />
exec 2>&1<br />
SVNAME=$(basename $(pwd))<br />
RUNASUSER=logrelay<br />
MODE=666<br />
VSERVERNAME=$(echo $SVNAME | sed 's/vserver-logrelay-//')<br />
[ -r "/etc/default/$SVNAME" ] && . "/etc/default/$SVNAME"<br />
<br />
exec socat -d -d -d -D -ls -u \<br />
UNIX-LISTEN:/etc/vservers/$VSERVERNAME/vdir/dev/log,unlink-early,nonblock,mode=$MODE,setuid=$RUNASUSER \<br />
UNIX-CONNECT:/dev/log,type=2,nonblock,forever<br />
</pre><br />
<br />
This will pass syslog messages from a vserver to the syslog of the host by acting as a syslog server for the <tt>/dev/log</tt> socket of the guest. Thus, you don't need to run a <tt>syslogd</tt> inside the vserver and you don't need to migrate to <tt>syslog-ng</tt> from <tt>socklog</tt> on the host.<br />
<br />
Symlink this run script into a service directory called <tt>vserver-logrelay-squid</tt>.<br />
<br />
Unfortunately, <tt>socat</tt> has a largish memory footprint; something more lightweight could, perhaps, be used.<br />
<br />
Comments and additions welcome.<br />
--[[User:KornAndras|Guy-]] 03:29, 2 February 2007 (CET)</div>KornAndras