![[Home]](http://wiki.linux-vserver.org/skins/common/images/wiki.png)
We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the Wiki Team page for instructions how to help or browse through our new wiki at wiki.linux-vserver.org to find the information already migrated.
Q: What is a 'Guest'?
A: To talk about stuff, we need some naming. The physical machine is called 'Host' and the 'main' context running the Host Distro is called 'Host Context'. The virtual machine/distro is called 'Guest' and basically is a Distribution (Userspace) running inside a 'Guest Context'.
Q: What kind of Operating System (OS) can I run as guest?
A: With VServer you can only run Linux guests. The trick is that a guest does not run a kernel on its own (as XEN and UML do), it merely uses a virtualized host kernel-interface. VServer offers so called security contexts which make it possible to seperate one guest from each other, i.e. they cannot get data from each other. Imagine it as a chroot environment with much more security and features.
Q: Which distributions did you test?
A: Some. Check out the wiki for ready-made guest images. But you can easily build own guest images, e.g. with Debian's debootstrap. Checkout step-by-step Guide 2.6 how to do that.
Q: Is VServer comparabale to XEN/UML/QEMU?
A: Nope. XEN/UML/QEMU and VServer are just good friends. Because You ask, you probably know what XEN/UML/QEMU is. VServer does in contrary to XEN/UML/QEMU not "emulate" any Hardware you run a kernel on. You can run a VServer kernel in a XEN/UML/QEMU guest. This is confirmed to work at least with linux 2.6/vs2.0.
Q: Is VServer secure?
A: We hope so. It should be as least as secure as Linux is. We consider it much much more secure though.
Q: Performance?
A: For a single guest, we basically have native performance. Some tests showed insignificant overhead (about 1-2%) others ran faster than on an unpatched kernel. This is IMVHO significantly less than other solutions waste, especially if you have more than a single guest (because of the resource sharing).
Q: Is SMP Supported?
A: Yes, on all SMP capable kernel archs.
Q: Resource sharing?
A: Yes ....
Q: Resource limiting?
A: Yes, you can set max limits per guest, but you can only offer guaranteed resource availability with some ticks at the time. There is the possibility to ulimit and to rlimit. rlimit is a new feature of kernel 2.6/vs2.0.
Q: Why isn't there a device /dev/bla? within a guest
A: Device nodes allow Userspace to access hardware (or virtual resources). Creating a device node inside the guest's namespace will give access to that device, so for security reasons, the number of 'given' devices is small.
Q: What is Unification (vunify)?
A: Unification is Hard Links on Steroids. Guests can 'share' common files (usually binaries and libraries) in a secure way, by creating hard links with special properties (immutable but unlinkable (removable)). The tool to identify common files and to unify them is called vunify.
Q: What is vhashify?
A: the successor of vunify, a tool which does unification based on hash values (which allows to find common files in arbitrary pathes)
Q: How do I manage a multi-guest setup with vhashify?
A: for 'vhashify', just do
| mkdir /etc/vservers/.defaults/apps/vunify/hash /vservers/.hash
| ln -0s /vservers/.hash /etc/vservers/.defaults/apps/vunify/hash/root
--> do this once
| mkdir /etc/vservers/.../apps/vunify # vhashify reuses vunify configuration
--> do this for every vserver
Q: With which VS version should I begin?
A: If you are new to VServer I recommend to try 2.0.+. Take "aplha utils" Version 0.30.210. In Debian Sid there appeared well running version of it recently. (It's a .209 at the time of writing).
Q: is there a way to implement "user/group quota" per VServer?
A: Yes, but not on a shared partition for now. You need to put the guest on a separate partition, setup a vroot device (to make the quota access secure), copy that into the guest, and adjust the mtab line inside the guest.
Q: what about "Quota" for a context?
A: context quotas are now called Disk Limits (so that we can tell them apart from the user/group quotas :). they are supported out of the box (with vs2.0) for all major filesystems (ext2/3, reiserfs, xfs, jfs)
Q: Does it support IPv6?
A: Currently not. Some developer has to move his ... to reimplement this functionality from the V4 code (I read that on the ML ;)). Will probably be superseded by the ngnet (next generation networking) soon.
Q: I can't do all I want with the network interfaces inside the guest?
A: For now the networking is 'Host Business'. You can set the capability icmp_raw in the context of the guest, or even the capability CAP_NET_RAW (which would even allow to sniff interfaces of other guests!). Likely to change with ngnet.
Q: Is there a web-based interface for vserver? that will allow creation/deletion/configuration etc. of vserver guests?
A. No. Maybe you like craete one?
Q: What is old-style and new-style config?
A. Old-style config refers to a single text-file that contains all the config. With new-style config the config is split into several directories and files. You should probably go for new-style config if you are asking.
Q: What is the "great flower page"?
A. Well, this page contains all config options for vserver in version > 1.9 (I think .. I joined linux-vserver in version 2, so I don't know for sure). The name of the page is derivived from the stylesheet(s) it contains: It displays background pictures of a very great flower, so regard it as highly optimized. It was designed by a non-designer, who asks us to create a better one. I played with the thought of creating a complete new theme for that page - but actually we all got used to the name "great flower page", so we stick to it. If you are unable to read it clearly, feel invited to joim the IRC channel #vserver, we may tell you how to ;)
Q: How do I add may IPs to a vserver?
A: First of all a guest only supports up to 16 IP (There is a 64-IP patch available, which is in "derjohn's kernel", you need extra util-vserver anyway).
Here is a little helper-script that adds a list of IPs defined in a text file, one per line.
#!/bin/bash
j=1
for i in `cat myiplist`; do
j=$(($j+1))
mkdir $j
echo $i > $j/ip
echo $i > $j/ip-old
echo "24" > $j/prefix
done
Q: If my host has only one public IP, can I use RFC1918 IP (e.g. 192.168.foo.bar) for the guests?
A: Yes, use iptables with SNAT to masquerade it. iptables -t nat -I POSTROUTING -s $VSERVER_NETZ ! -d $VSERVER_NETZ -j SNAT --to $EXT_IP
See: http://www.tgunkel.de/it/software/doc/linux_server.de#h3-Vserver_Masquerading_SNAT (THX, [MUPPETS]Gonzo)
Q: If I shutdown my vserver guest, the whole ethX on the host is shut down? What happened?
A: When you shut down a vserver (i.e. vserver foo stop), it's IP is brought down on the host too. If this IP happens to be the primary IP of the host, the kernel will not only bring down the primary IP, but also all secondary IP addresses. But in very recent kernels, there is an option settable which prevents that nasty feature. It's called "alias promotion". You may set it via sysctl by adding "net.ipv4.conf.all.promote_secondaries = 0" in /etc/sysctl.conf or via sysctl command line.
Q: On Debian Sarge (stable) there may only util-vserver 0.30-204 available, which has been told to be buggy (I didnt check the version for longer time) How do I complile a local version of alpha util-vserver .210 on Debian?
A:
apt-get build-dep util-vserver ./configure --prefix=/usr/local/ --enable-release \ --mandir=/usr/local/share/man \ --infodir=/usr/local/share/info \ --sysconfdir=/etc --enable-dietlibc \ --localstatedir=/var \ --with-vrootdir=/var/lib/vservers make make install-distribution (Which does a make install + setting a symlink ln -s /usr/local/lib/util-vserver/vshelper /sbin/vshelper )
To test which version you are running:
# which vserver /usr/local/sbin/vserver
This sould point to ..local...
Q: I use derjohn's kernel or a differnet kernel with a more-than-16-IPs-per-guest-patch and can't use more than 16 IPs. Why?
A: You need to patch util-vserver, too. So you obviously need to recomplile util-vserver (see above). In the util-vserver directory there are header files in the ./kernel/ directory. Patch like this:
kernel/network.h:#define NB_IPV4ROOT 64
BTW: The initial patches can be found here: http://vserver.13thfloor.at/Experimental/VARIOUS/util-vserver-0.30.196-net64.diff.bz2 and http://vserver.13thfloor.at/Experimental/VARIOUS/delta-2.6.9-vs1.9.3-net64.diff
Q: I run a Debian Host and want to build an Ubuntu guest. Howto?
A: Simple ;) Assume you want to build a breezy guest on a sid host with IP 192.168.0.2 and hostname vubuntu, then do:
vserver vubuntu build --force -m debootstrap --hostname vubuntu.myvservers.net --netdev eth0 --interface 192.168.0.2/24 \ --context 42 -- -d breezy -m http://de.archive.ubuntu.com/ubuntu
Well, sid's debootstrap knows how to bootstrap Ubuntu linux. Make sure to have a current debootstrap package: apt-get update ; apt-get install debootstrap. The knowledge how to build ubuntu 'breezy bader' (which you probably want to be your guest at the time of writing) has been added recently.
Q: How do I make a vserver guest start by default?
A: At least on Debian, I can tell you how to do it with new-style config. If your guest is called "derjohn" and you want it to be started somewhere at the of your bootstrap process, then do:
echo "default" > /etc/vservers/derjohn/apps/init/mark
If you want to start it earlier, please read the init script "/etc/init.d/vserver-default" how to do it. In most cases you don't need to change this. On Debian the vservers are started at "90", so after most other stuff is up (networking etc.).
Besides that I created a small helper script for managing the autostart foo: vserver-autostart
Q: My host works, but when I start a guest it says that it has a problem with chbind.
A: You are probably using util-vserver <= 0.30.209, which does use dynamic network contexts internally (With 0.30.210 this fact changed). So if you compiled your kernel without dynamic contexts, you may start guests, but you can't use network context.The solution is either to switch to .210 util (or Hollow's toolset) or compile the kernel with dynamic network contexts.
SE Keyword: invalid option `nid' testme.sh
Q: When I try to ssh to the guest, I log into the host, even if I installed sshd on the guest. Whats wrong here?
A: Look at /etc/ssh/sshd_config of the host:
Port 22 # Use these options to restrict which interfaces/protocols sshd will bind to #ListenAddress ::
And now change the setting to
Port 22 # Use these options to restrict which interfaces/protocols sshd will bind to ListenAddress your.hosts.ip.here # not the guests IP!
Then '/etc/init.d/ssh restart' on the host, after that on the guest (if you did apt-get install ssh on the guest already)
Do I have to explain more? If the hosts sshd binds all available IP addresses on port 22 (The hosts 'sees' even all addresses of the guests!). So if the guest starts it's sshd, it cant bind to port 22 anymore. You need to change that setting only on the host.
(BTW: A similar approach has to be done for a lot of daemons, e.g. Apache. If the daemon does not support an explicit bind, you may use the chbind command to 'hide' ip adresses from the daemon before starting)
Q: I did everything right, but the application foo does not start. What's up there?
A: Before asking on the IRC channel, please check out the 'problematic programs' page:
Q: How can I reboot/halt guests?
A: It depends.
For vserver with legacy-interfaces support, you have to replace /sbin/halt in guests with vreboot and start rebootmgr in host. You also need to have a dummy <guest>.conf file in /etc/vservers for each guests. Please have a look at /etc/init.d/rebootmgr.
Vserver with native interface untilizes /dev/initctl. No changes are needed in guests. Just make sure that REBOOT capability is adjusted in guests.
Q: Do I really need the legacy-interfaces? What are these legacy-interfaces?
A: Since vserver is on-going projects, new features might replace old ones, some might still on development. Legacy-interfaces are still available for backward compability (which might be removed someday). See Q: How can I reboot/halt guests?
Q: Is vserver "preempt" safe?
A: I have vserver running on linux kernel with preemption. But is it safe???