We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the Wiki Team page for instructions how to help or browse through our new wiki at wiki.linux-vserver.org to find the information already migrated.

Vserver on Arch Linux

WARNING: You will need knowledge of Arch Linux's pacman, abs and init system. This is not an Arch tutorial

Overview

[Arch Linux] is ideal for running as the host and for VServers.

What makes it ideal for the host server is its low foot print and simplicity. On the downside, Arch Linux does not include a VServer kernel or utilities. However, if you are confident building your own kernel and using ABS (the Arch Build System), it is excellent.

Arch is ideal for VServers because it is trivial to install an instance of Arch Linux into a target directory and does not require Arch on the host system.

Building dietlibc

First for more secure chroots and compatibility you need dietlibc

pkgname=dietlibc
pkgver=0.29
pkgrel=1
pkgdesc="A libc that is optimized for small size"
url="http://www.fefe.de/dietlibc/"
depends=()
makedepends=()
conflicts=()
replaces=()
install=dietlibc.install
source=(http://www.kernel.org/pub/linux/libs/dietlibc/$pkgname-$pkgver.tar.gz)
md5sums=('84059c71d6f559f8c4ca4df03a7a541f')

build()
{
  mkdir -p $startdir/pkg/usr/bin $startdir/pkg/usr/man/man1
  cd $startdir/src/$pkgname-$pkgver
  make || return 1
  make prefix=$startdir/pkg/usr/lib/dietlibc install || return 1
  mv $startdir/pkg/usr/lib/dietlibc/bin/*   $startdir/pkg/usr/bin
  rm -r $startdir/pkg/usr/lib/dietlibc/{man,bin}
  #install bin-i386/diet $startdir/pkg/usr/bin
  cp diet.1 $startdir/pkg/usr/man/man1

  find $startdir/pkg -name '*.la' -exec rm {} \;
}

After you have compiled the dietlibc package and added it, make a soft link to /opt like this: ln -s /usr/lib/dietlibc /opt/diet

This is needed later by the util-vserver package.

Building beecrypt

pkgname=beecrypt
pkgver=4.1.2
pkgrel=1
pkgdesc="A general purpose cryptography library"
url="http://beecrypt.sourceforge.net/"
depends=('gcc')
makedepends=()
source=(http://puzzle.dl.sourceforge.net/sourceforge/beecrypt/$pkgname-$pkgver.tar.gz)
md5sums=('820d26437843ab0a6a8a5151a73a657c')

build() {
  cd $startdir/src/$pkgname-$pkgver
  ./configure --prefix=/usr
  make || return 1
  make DESTDIR=$startdir/pkg install
  find $startdir/pkg -name '*.la' -exec rm {} \;
}

Building util-vserver on the Host

The following PKGBUILD will download, package and install util-vserver version 0.30.208. It should be only a matter of changing the version number to make it work with later versions, assuming nothing major changes in the build process.

pkgname=util-vserver
pkgver=0.30.208
pkgrel=2
pkgdesc="The util-vserver project provides tools for kernels with the security context patch."
url="http://savannah.nongnu.org/projects/util-vserver/"
source=(http://www.13thfloor.at/~ensc/util-vserver/files/alpha/${pkgname}-${pkgver}.tar.bz2)
makedepends=(vconfig iproute)
md5sums=('4453ad0ae7f351fec651d6904e00521f')

build()
{
  cd $startdir/src/$pkgname-$pkgver
  ./configure --prefix=/usr --sysconfdir=/etc --with-initrddir=/etc/rc.d --localstatedir=/var --enable-dietlibc --enable-beecrypt
  make || return 1
  make DESTDIR=$startdir/pkg install || return 1
  # Move the v_* scripts out of the init dir, as Arch does not support SYSV style init scripts
  install -m755 -d $startdir/pkg/usr/libexec/vserver
  mv $startdir/pkg/etc/rc.d/v_* $startdir/pkg/usr/libexec/vserver
  find $startdir/pkg -name '*.la' -exec rm {} \;
}

Once built and installed, add vprocunhide and vservers-default to DAEMONS in /etc/rc.conf.

Creating an Arch Linux VServer

Download [archbootstrap] (this script will run on any GNU/Linux host system with wget), choose appropriate values for name, interface and {{context}, pick some vserver flags (or just use the ones below) then use the following shell commands to create your vserver:

(choose a mirror close to you, as archbootstrap will download all base packages)

# name=test
# interface=eth0:72.36.180.187/29
# context=5
# vserver ${name} build -m skeleton --context ${context} --interface ${interface} \
   --flags lock,virt_mem,virt_uptime,virt_cpu,virt_load,sched_hard,hide_netif --initstyle plain
# echo default > /etc/vservers/${name}/apps/init/mark
# archbootstrap /vservers/${name} ftp://ftp.archlinux.de/pub/archlinux
...

If you don't have a public ip to spare for your vserver guest, then you must create guest with private ip, like 192.168.103 for example. Then in order to allow guest to access the Internet, you will have to set up proper NAT rule for your host's iptables. Assuming that you are using addresses like in previous example, a working NAT rule is this:

iptables -t nat -I POSTROUTING -s 192.168.0.0/24 -j SNAT --to x.x.x.x

where the last one is your host's public ip, assuming that it can access the Internet directly. You can now test if NAT rule succeeded by using this command: iptables -t nat -L

It should display an output like this:

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
SNAT       all  --  192.168.0.0/24       anywhere            to:x.x.x.x

Remeber to copy /etc/resolv.conf to /vservers/${name}/etc to be able to use domain names instead of just ip addresses.

If you plan to set up servers to your guest, it would also be useful to have localhost in there. This can be achieved by creating a new folder in /etc/vservers/name/interfaces/ - name the folder 1, for example, if the previous one that exists there is 0. Then create there files named ip, dev and prefix.

To ip write 127.0.0.1, to dev write lo and to prefix write 32.

Start your vserver:

# vserver ${name} start

Check it has started

# vserver-stat

Then enter the guest (vserver name enter) and at first create iproute package (it is at /var/abs/network/iproute) - you will need it to see ip addresses and other needful information. Add the package and now to see how networking is working use this command ip addr show and try to ping the world.

That is pretty much it. You will probably want to edit /vservers/test/etc/rc.conf to remove interface configuration and set your hostname.

All the usual vserver commands should work as you would expect, but don't forget to modify host service config files so they don't bind to INADDR_ANY.

Note: the value in /etc/vservers/${name}/apps/init/mark must be default if you wish your vservers to start at boot using the vservers-default init script.