<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#ffffff">
> <i>I'm trying to compose a system, where lxc containers behave
like virtual hosts for a web server.</i>
<br>
<br>
It is possible to use shared, read-only mounts between the host
and containers. However, you will need to carefully consider your
security requirements and maintenance procedures.<br>
<br>
If you are using shared mounts, then upgrading software on one
container will update files in the other containers. That could be
a problem, because software updates usually include a post-install
script that is executed at the end of an upgrade (like a postinst
file in the .deb package). These scripts may restart a service,
update a configuration file in /etc/, or even prompt the user for
some input.<br>
<br>
So what will happen when you update the LAMP files on your
shared mount, but your LXC containers don't do a corresponding
server restart, or config migration? Things will probably break at
some point.<br>
<br>
Also, there are several security risks to consider. A shared
/home/ directory would also (implicitly) share everyone's
.ssh/authorized_keys files (which will grant OpenSSH access to all
your containers). You would also need to be sure that all SSL and
SSH host certs are independently managed. Using a single
certificate for many hosts is not secure. Apache and OpenSSH keep
their certs under /etc/, but Tomcat does not iirc.<br>
<br>
Also, UIDs and GIDs are shared on the filesystem, so a root user
in any container would be able to alter any file in any other
container (unless it's a read-only mount from an external fstab
file, and the "sys_admin" capability is dropped in your lxc.conf).
What's worse, if you have different /etc/passwd or /etc/group files
in the containers, then group id "121" might be the group "admin" in
one container, but something else entirely in another container.
The shared filesystem only stores the integer group ID, not the
actual group membership or resulting sudo permissions.<br>
<br>
Because of these complications, I have decided to give each LXC
container its own, full filesystem. Unfortunately that "wastes" a
few hundred megs of disk space for each container, because the files
are mostly redundant in /usr/, /var/, etc. However, disk space is
very cheap, and the value of having a standalone container is more
than worth it to me.<br>
<br>
<br>
> <i>Has anyone any experience with this technique?</i>
<br>
<br>
I include a sample configuration for a shared filesystem with my
container creation script. It is disabled by default, but you can
read through the configuration to get an idea. You can download it
from here:<br>
<br>
<a class="moz-txt-link-freetext" href="http://derek.simkowiak.net/lxc-ubuntu-x/">http://derek.simkowiak.net/lxc-ubuntu-x/</a><br>
<br>
<br>
Thanks,<br>
Derek Simkowiak<br>
<br>
On 12/12/2011 09:47 AM, István Király - LaKing wrote:
<blockquote
cite="mid:1323712025.64960.YahooMailNeo@web126104.mail.ne1.yahoo.com"
type="cite">
<pre wrap="">Hi folks.
I'm trying to compose a system, where lxc containers behave like virtual hosts for a web server.
As next step I would like to minimize container size. My question is, what the best, most elegant and fail proof technique for that?
At this moment I'm thinking of a "master container" and "slave containers" where the /usr folder for example in the slave containers is a mount from the master container. That gives a significant size drop already, from 400 to 40 megabytes.
I would like to keep the containers really minimal. 4 megabyte should be small enough.
Lets say only some important files in /etc ....
Has anyone any experience with this technique?
Thank you for sharing.
greetings,
István Király
<a class="moz-txt-link-abbreviated" href="mailto:LaKing@D250.hu">LaKing@D250.hu</a>
D250 Laboratories
<a class="moz-txt-link-abbreviated" href="http://www.D250.hu">www.D250.hu</a>
------------------------------------------------------------------------------
Learn Windows Azure Live! Tuesday, Dec 13, 2011
Microsoft is holding a special Learn Windows Azure training event for
developers. It will provide a great way to learn Windows Azure and what it
provides. You can attend the event by watching it streamed LIVE online.
Learn more at <a class="moz-txt-link-freetext" href="http://p.sf.net/sfu/ms-windowsazure">http://p.sf.net/sfu/ms-windowsazure</a>
_______________________________________________
Lxc-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Lxc-users@lists.sourceforge.net">Lxc-users@lists.sourceforge.net</a>
<a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/lxc-users">https://lists.sourceforge.net/lists/listinfo/lxc-users</a>
</pre>
</blockquote>
<br>
</body>
</html>