We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the Wiki Team page for instructions how to help or browse through our new wiki at wiki.linux-vserver.org to find the information already migrated.

Depreciation Warning!

This document describes the "legacy" configuration method. Don't use this to configure a production system.

Credits

This document is based on other linux-vserver documentation and mailinglist posting.

Some documentation regarding to the configuration of vservers is taken from the vskel documentation.

Preface

In this document we will try to provide system administrators a guide for installing, configuring and maintaining virtual servers using the linux-vserver project.

In this guide we will try to cover the differcences between the linux distributions.

A. Introduction

The linux-vserver project lets you run virtual linux servers on top of a linux machine. It uses a patch kernel and an tools package.

B. Installation

1. Requirements

  • alpha
  • i386 and higher (and compatible)
  • ia32 / ia64
  • mips / mips64
  • parisc (HP PA-RISC)
  • ppc / ppc64
  • sparc / sparc64
  • x86_64 (AMD64)
  • uml

2. Download

3. Patching the kernel

After downloading the linux kernel and the vserver kernel patch, you have can apply the patch to the kernel source and build you own kernel.

3.1. Standard kernel compile

3.2. Debian

You can install a kernel as described in previous section, our you can use some of the debian tools. Debian contains a tool, kernel-package, which lets you build a kernel and put it in a debian package.

In case you use the kernel source included in the debian distribution, you can download linux-vserver patch (version 1.9.5.3 as of 26-05-2005) for it [here], or just apt-get install kernel-patch-vserver.

In case you have many servers, you should look at the kernellab tool to manage you kernel configurations.

If you're using Ubuntu 5.04 (hoary), the patch is in the kernel-patch-ctx package. (version 1.29)

3.3. Redhat

3.4.

C. Configuration host server

1. Configuring vserver

After installing a customized kernel and the vserver or util-vserver tools, you can find the configuration options in the file:

/etc/vservers.conf

configuration options:

2. Daemons on the host server

The daemons running on the host server will by default bind to all interfaces on the machine, including the alias interfaces used by the vservers.

This will result in conflicts between the daemons running on the host system and the daemons running in the vservers. To solve this, we have to bind the daemons running on the host server to the IP-number of the host server. This can be done by using the wrapper scripts provided by the vserver tools or util-vserver packages. A alternative can be changing the configuration of the daemons. Some daemons (ssh, xinetd) have a configuration option to bind the on one interfaces.

2.1. Startup wrapper scripts

On systems using system V startup scripts (like redhat), you can use wrapper scripts to bind the daemons to one interface. Replace inetd with xinetd.

2.2. Configuring daemons

Use this option in case the startup wrapper scripts don't work on your distribution, or you don't want to change the startup scripts of your daemons.

D. Virtual hosts

1. Installation

The script newvserver is used to create a new vserver. Some distribution specific packages include customized version of this tool (we know the debian package of vserver does include a customised version).

Run newvserver -h or newvserver --help to get the help.

2. Configuration

2.1. Configuration file

Each virtual server has one configuration file controlling its behavior. The configuration is located in /etc/vservers and has the name of the vserver followed by the extension .conf.

This is a pseudo shell script where variable are setup using shell assignment (VAR=value). The script is simply sourced by the vserver(8) utility. Here are the various variables you can set:

You don't have to set all of these options (only hostname, domain and IP-number are required)

The syntax is: [device[.vlan]:]IP[/netmask]
The netmask may be specified in quad notation (255.255.255.0) or by telling the number of bits assigned to the network part (A class C network is a /24 network with 24 bits assigned to identify the network and 8 (32-24) bits assigned to identify the host.
If the device is omitted, the IPROOTDEV devices is used. If the netmask is omitted, the device netmask is used.
Examples:
IPROOT="1.2.3.4"
IPROOT="1.2.3.4 2.3.4.5"
IPROOT="eth0:1.2.3.4 eth1:2.3.4.5"
IPROOT="eth0:10.1.2.3/255.255.255.0 eth0:10.1.3.12/255.255.255.128"
(see http://vserver.13thfloor.at/Stuff/VServer-IP-Setup-0.1.txt for details, e.g. how to not create an alias at all)
The next capabilities are enabled by default.
CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH, CAP_FOWNER, CAP_FSETID, CAP_KILL, CAP_SETGID, CAP_SETUID, CAP_NET_BIND_SERVICE, CAP_SYS_CHROOT, CAP_SYS_PTRACE, CAP_SYS_TTY_CONFIG, CAP_LEASE
You can extend the list of capabilities with the next capabilities. This does make the host system less secure. Use these options only if you need them for the configuration of a vserver.
  • CAP_SETPCAP
transfering permitted capabilities
  • CAP_LINUX_IMMUTABLE
modifying immutable and iunlink flags
  • CAP_NET_BROADCAST
allow network broadcasting/multicasting
  • CAP_NET_ADMIN
network interface configuration setting promiscuous mode (sniffing), multicasting and routing tables
  • CAP_NET_RAW
use of raw and packet sockets
  • CAP_IPC_LOCK, CAP_IPC_OWNER
ipc owner check and mlock
  • CAP_SYS_MODULE
insert and removal of kernel modules
  • CAP_SYS_RAWIO
ioperm/iopl access and usb messages
  • CAP_SYS_PACCT
process accounting
  • CAP_SYS_ADMIN
this list would be too long, it basically alows to do everything else, not mentioned in another capability.
  • CAP_SYS_BOOT
allow reboot/halt
  • CAP_SYS_NICE
allow raising priorities, and scheduler stuff
  • CAP_SYS_RESOURCE
override resource limits, override quota and reserved space modify data journaling, consoles, keymap
  • CAP_SYS_TIME
manipulation of the system clock
  • CAP_MKNOD
creation of kernel nodes (Required to run a systemimager-server in a vserver.)
Example:
S_CAPS="CAP_NET_RAW" # allows raw sockets. Let the vserver send raw packet over the network (Enable ping and traceroute for one)
S_CAPS="CAP_SYS_RESOURCE" # This allows a application inside a vserver to enlarge its ulimit values. You need this to run bind9.
S_CAPS="CAP_SYS_ADMIN" # Let the vserver do many things, including mounting devices and network shares.
S_CAPS=""

2.2. Startup scripts

To run a command on the host server at startop or shutdown of a vserver, you can put a script in /etc/vservers/.

You have to give it the same name as your vserver and .sh as extention. (call it vserver1.sh for you server1)

example:

This script lets you map a directory on a other disk in you vserver (you can use it to share a directory between virtual servers.

(you have to put a #!/bin/sh on the first line of the script)

case $1 in

pre-start)

mount --bind /home2/home /vservers/server1/home
;;
post-start)
;;
pre-stop)
;;
post-stop)
umount /vservers/server1/home
;;
esac

E. Administation of linux-vserver

1. The tools

2. Configuration files and startup scripts.

3. Daemons

F. Configuration tips

security

stability

1 - Contrary to what the FAQ says, it *is* possible to run ntpd within a vserver. See VirtualiseNTP.

G. References