openSUSE Leap Documentation › Virtualization Guide › Managing Virtual Machines with LXC › Linux Containers
ContentsContents
Virtualization Guide
  1. About This Manual
  2. I Introduction
    1. 1 Virtualization Technology
    2. 2 Introduction to Xen Virtualization
    3. 3 Introduction to KVM Virtualization
    4. 4 Introduction to Linux Containers
    5. 5 Virtualization Tools
    6. 6 Installation of Virtualization Components
    7. 7 Supported Guests, Hosts and Features
  3. II Managing Virtual Machines with libvirt
    1. 8 Starting and Stopping libvirtd
    2. 9 Guest Installation
    3. 10 Basic VM Guest Management
    4. 11 Connecting and Authorizing
    5. 12 Managing Storage
    6. 13 Managing Networks
    7. 14 Configuring Virtual Machines
  4. III Hypervisor-Independent Features
    1. 15 Disk Cache Modes
    2. 16 VM Guest Clock Settings
    3. 17 libguestfs
  5. IV Managing Virtual Machines with Xen
    1. 18 Setting Up a Virtual Machine Host
    2. 19 Virtual Networking
    3. 20 Managing a Virtualization Environment
    4. 21 Block Devices in Xen
    5. 22 Virtualization: Configuration Options and Settings
    6. 23 Administrative Tasks
    7. 24 XenStore: Configuration Database Shared between Domains
    8. 25 Xen as a High-Availability Virtualization Host
  6. V Managing Virtual Machines with QEMU
    1. 26 QEMU Overview
    2. 27 Setting Up a KVM VM Host Server
    3. 28 Guest Installation
    4. 29 Running Virtual Machines with qemu-system-ARCH
    5. 30 Virtual Machine Administration Using QEMU Monitor
  7. VI Managing Virtual Machines with LXC
    1. 31 Linux Containers
    2. 32 Migration from LXC to libvirt-lxc
  8. Glossary
  9. A Virtual Machine Drivers
  10. B Appendix
  11. C XM, XL Toolstacks and Libvirt framework
  12. D GNU Licenses
Navigation←→
openSUSE Leap Documentation › Virtualization Guide › Managing Virtual Machines with LXC › Linux Containers
Top
←→
Applies to openSUSE Leap 42.1

31 Linux Containers

31.1 Setting Up LXC Distribution Containers
31.2 Setting Up LXC Application Containers
31.3 Securing a Container Using AppArmor
31.4 Differences Between the libvirt LXC Driver and LXC
31.5 For More Information

31.1 Setting Up LXC Distribution Containers

A container is a kind of “virtual machine” that can be started, stopped, frozen, or cloned (to name but a few tasks). To set up an LXC container, you first need to create a root file system containing the guest distribution:

Procedure 31.1: Creating a Root File System

There is currently no GUI to create a root file system. You will thus need to open a terminal and use virt-create-rootfs as root to populate the new root file system. In the following steps, the new root file system will be created in /path/to/rootfs.

Note that virt-create-rootfs needs a registration code to set up a SLE-12 root file system.

  1. Run the virt-create-rootfs command: 

    virt-create-rootfs --root /path/to/rootfs --distro SLES-12.0 -c registration code

  2. Change the root path to the root file system with the chroot command: 

    chroot /path/to/rootfs

  3. Change the password for user root with passwd.

  4. Create an operator user without root privileges: 

    useradd -m operator

  5. Change the operator's password: 

    passwd operator

  6. Leave the chroot environment with exit.

Procedure 31.2: Defining the Container Using YaST

  1. Open YaST and go to Virtualization › Create Virtual Machines to open the Virtual Machine Manager.

  2. If not already present, add a local LXC connection by clicking File, Add Connection. Select LXC (Linux Containers) as hypervisor and click the Connect button.

  3. Select the localhost (LXC) connection and click File New Virtual Machine menu.

    Select the Operating system container option and click the Forward button.

  4. Type the path to the root file system from Procedure 31.1, “Creating a Root File System” and click the Forward button.

  5. Choose the maximum amount of memory and CPUs to allocate to the container. Then click the Forward button.

  6. Type in a name for the container. This name will be used for all virsh commands on the container.

    Click Advanced options. Select the network to connect the container to and click the Finish button: the container will then be created and started. A console will also be automatically opened.

Warning
Warning: Container Network

To configure the container network, edit the /etc/sysconfig/network/ifcfg-* files. Make sure not to change the IPv6 setting: this would lead to errors while starting the network.

31.2 Setting Up LXC Application Containers

Libvirt also allows to run single applications instead of full blown Linux distributions in containers. In this example, bash will be started in its own container.

Procedure 31.3: Defining an Application Container Using YaST

  1. Open YaST and go to the Virtual Machine Manager module.

  2. If not already present, add the LXC connection by clicking File, Add Connection menu. Select LXC (Linux Containers) as hypervisor and click Connect.

  3. Select the localhost (LXC) connection and click File › New Virtual Machine.

    Select the Application container option and click Forward.

    Set the patch to the application to be launched. As an example, the field is filled with /bin/sh, which is fine to create a first container. Click Forward.

  4. Choose the maximum amount of memory and CPUs to allocate to the container. Click Forward.

  5. Type in a name for the container. This name will be used for all virsh commands on the container.

    Click Advanced options. Select the network to connect the container to and click Finish. The container will be created and started. A console will be opened automatically.

    Note that the container will be destroyed after the application has finished running.

31.3 Securing a Container Using AppArmor

By default, containers are not secured using AppArmor or SELinux. There is no graphical user interface to change the security model for a libvirt domain, but virsh will help.

  1. Edit the container XML configuration using virsh: 

    virsh -c lxc:/// edit mycontainer

  2. Add the following to the XML configuration, save it and exit the editor. 

    <domain>
    ...
    <seclabel type="dynamic" model="apparmor"/>
    ...
</domain>

  3. With this configuration, an AppArmor profile for the container will be created in the /etc/apparmor.d/libvirt directory. The default profile only allows the minimum applications to run in the container. This can be changed by modifying the libvirt-container-uuid file: this file is not overwritten by libvirt.

31.4 Differences Between the libvirt LXC Driver and LXC

SUSE Linux Enterprise Server 11 SP3 was shipping LXC, while SUSE Linux Enterprise Server 12 comes with the libvirt LXC driver, sometimes named libvirt-lxc to avoid confusion. The containers are not managed or configured in the same way in these tools. Here is a non-exhaustive list of differences.

The main difference comes from the fact that domain configuration in libvirt is an XML file, while LXC configuration is a properties file. Most of the LXC properties can be mapped to the domain XML. The properties that cannot be migrated are:

  • lxc.network.script.up: this script can be implemented using the /etc/libvirt/hooks/network libvirt hook, though the script will need to be adapted.

  • lxc.network.ipv*: libvirt cannot set the container network configuration from the domain configuration.

  • lxc.network.name: libvirt cannot set the container network card name.

  • lxc.devttydir: libvirt does not allow changing the location of the console devices.

  • lxc.console: there is currently no way to log the output of the console into a file on the host for libvirt LXC containers.

  • lxc.pivotdir: libvirt does not allow to fine-tune the directory used for the pivot_root. /.olroot is used.

  • lxc.rootfs.mount: libvirt does not allow to fine-tune this.

LXC VLAN networks automatically create the VLAN interface on the host and then move it into the guest namespace. libvirt-lxc configuration can mention a VLAN tag ID only for openvSwitch tap devices or PCI pass-through of SRIOV VF. The conversion tool actually needs the user to manually create the VLAN interface on the host side.

LXC rootfs can also be an image file, but LXC brute-forces the mount to try to detect the proper file system format. libvirt-lxc can mount image files of several formats, but the 'auto' value for the format parameter is explicitly not supported. This means that the generated configuration will need to be tweaked by the user to get a proper match in that case.

LXC can support any cgroup configuration, even future ones, while libvirt domain configuration, needs to map each of them.

LXC can mount block devices in the rootfs, but it cannot mount raw partition files: the file needs to be manually attached to a loop device. On the other hand libvirt-lxc can mount block devices, but also partition files of any format.

31.5 For More Information

LXC Container Driver

http://libvirt.org/drvlxc.html

→Chapter 32 Migration from LXC to libvirt-lxc←Part VI Managing Virtual Machines with LXC
Print this page

© 2018 SUSE