LXC

From air
Jump to: navigation, search

Définition

LXC pour LinuX Containers est une technologie de virtualisation de système ou de processus Linux basé sur l'isolation. LXC permet de lancée n'importe quelle distribution Linux récente à l'intérieur d'un conteneur. Ce conteneur peut être configuré pour limité l'accès au ressources physique de la machine hôte (CPU, Memoire, I/O,...) grace à l'utilisation des cgroups.


in english

LXC is a lightweight hypervisor allowing to run isolated appliances. Indeed, it provides a virtual environment that has its own process and network space. It is similar to a chroot. As LXC is implemented on given linux kernel, only operating systems that are compatible with the hosting kernel will be able to run. It is based on cgroups (control groups), a Linux kernel feature to manage ressources like CPU, memory and disk I/O by limiting resources, prioritizing groups, accounting (measuring), isolating (separate namespaces for groups, it means processes, network connections and files are not visible by other groups) and controling groups.


Etat actuel

LXC est actuellement (03/2013) en version 0.9 et son API n'est pas encore stabilisée. Cette technologie est intégrée au noyau Linux et à pour but de remplacer OpenVZ qui n'est pas adapter au version récente du noyau Linux. Son développement est actuellement très actif.

LXC et le Cloud Computing

LXC est pour le moment utilisé pour isolé des services sur un serveur ou dans le Cloud Computing au niveau PaaS comme Heroku[1] . Certaines fonctionnalités indispensable à la sécurité empêche LXC d'être utilisé dans le comme mécanisme de virtualisation pour les systèmes de IaaS.


LXC en pratique

Auteurs : Jordan Calvi (RICM4), Alexandre Maurice (RICM4), Michael Mercier (RICM5)

Installation

/!\ LXC as been set up succesfully on ubuntu 12.04 LTS as container launching does not works on Debian Wheeze testing OS. /!\


Packages installation

aptitude install lxc bridge-utils debootstrap
/?\ Conteners will be placed in /var/lib/lxc /?\


Mounting cgroups automatically : edit /etc/fstab and add the following

cgroup /sys/fs/cgroup cgroup defaults 0 0


Enabling previous modifications

mount -a


Checking everything is ok

lxc-checkconfig


Manipulation of containers

Creating a container running Ubuntu

lxc-create -t ubuntu -n ubuntu1
/!\ By default, the version of the guest OS is the same as the hosting one. /!\


Showing existing containers and thoses that are running

lxc-ls
/?\ The first line indicates existing containers and the second one thoses in running state. /?\


Obtaining information about ubuntu1

lxc-info -n ubuntu1


Starting the container

lxc-start -n ubuntu1


Connection to the container

lxc-console -n ubuntu1


Shutting down the container

lxc-stop -n ubuntu1


Exiting console

perform CTRL-a q


Deleting the container

lxc-destroy -n ubuntu1

Configuring the container

At boot time, a virtual machines reads the file /var/lib/lxc/{VM-name}/config to set up its configuration (root file system, number of TTY, limites, etc).

lxc.network.type=veth
lxc.network.link=lxcbr0
lxc.network.flags=up
lxc.network.hwaddr = 00:16:3e:24:e5:9a
lxc.utsname = ubuntu1

lxc.devttydir = lxc
lxc.tty = 4
lxc.pts = 1024
lxc.rootfs = /var/lib/lxc/ubuntu1/rootfs
lxc.mount  = /var/lib/lxc/ubuntu1/fstab
lxc.arch = amd64
lxc.cap.drop = sys_module mac_admin
lxc.pivotdir = lxc_putold

# uncomment the next line to run the container unconfined:
#lxc.aa_profile = unconfined

lxc.cgroup.devices.deny = a
# Allow any mknod (but not using the node)
lxc.cgroup.devices.allow = c *:* m
lxc.cgroup.devices.allow = b *:* m
# /dev/null and zero
lxc.cgroup.devices.allow = c 1:3 rwm
lxc.cgroup.devices.allow = c 1:5 rwm
# consoles
lxc.cgroup.devices.allow = c 5:1 rwm
lxc.cgroup.devices.allow = c 5:0 rwm
#lxc.cgroup.devices.allow = c 4:0 rwm
#lxc.cgroup.devices.allow = c 4:1 rwm
# /dev/{,u}random
lxc.cgroup.devices.allow = c 1:9 rwm
lxc.cgroup.devices.allow = c 1:8 rwm
lxc.cgroup.devices.allow = c 136:* rwm
lxc.cgroup.devices.allow = c 5:2 rwm
# rtc
lxc.cgroup.devices.allow = c 254:0 rwm
#fuse
lxc.cgroup.devices.allow = c 10:229 rwm
#tun
lxc.cgroup.devices.allow = c 10:200 rwm
#full
lxc.cgroup.devices.allow = c 1:7 rwm
#hpet
lxc.cgroup.devices.allow = c 10:228 rwm
#kvm
lxc.cgroup.devices.allow = c 10:232 rwm


Configuring default network and switch

see:

/etc/default/lxc

Liens externes

Site officiel