<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hi all,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We are trying to convert our libvirt-lxc containers to LXC containers on CentOS 7 due to race conditions that are causing a lot of instability during our testing of the former. I am currently testing against LXC 1.0.9 because it was easily
available to me in the EPEL repo, but I hope to upgrade to an LXC 2.x.x version in the future.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">For the most part, this is working great. I can even run lxc-start or lxc-autostart manually and see everything—including our five veth interfaces—successfully come online for the container.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The problem, however, is that if I allow the default lxc.service systemd service, or my custom systemd service, to automatically start the container on boot, only a single interface comes online (as in, gets an IP address…though I can attach
to the container and do an ip addr show and see that all interfaces are up, just with no IP addresses). Further, if I try to restart the container manually after systemd automatically starts the container, only a single interface continues to come online.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I currently have SELinux disabled to try to eliminate at least one possibly source of issue. Thinking that maybe networking isn’t up yet (even though the services require networking-online.service), I have tried adding in a four minute
delay prior to letting the service attempt to auto-start LXC containers to no avail.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Interestingly, after disabling all the above-discussed LXC services, I also tried using the @reboot “hack” to run lxc-autostart as root to no avail.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">For what it is worth, this container (and others that will follow) can/should be run as root (unprivledged?). We plan to use SELinux to “sandbox” them.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’ll paste the current configuration file I’m working with below. If there are specific log files that would be nice to see as well, please let me know. Any help/pointers/etc would be deeply appreciated.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks so much,<o:p></o:p></p>
<p class="MsoNormal">Luke<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">================================================================================<o:p></o:p></p>
<p class="MsoNormal"># Distribution configuration<o:p></o:p></p>
<p class="MsoNormal">lxc.include = /usr/share/lxc/config/centos.common.conf<o:p></o:p></p>
<p class="MsoNormal">lxc.arch = x86_64<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"># Container specific configuration<o:p></o:p></p>
<p class="MsoNormal">lxc.rootfs = /var/lib/libvirt/filesystems/newcontainer<o:p></o:p></p>
<p class="MsoNormal">lxc.utsname = newcontainer<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"># SELinux context<o:p></o:p></p>
<p class="MsoNormal">#lxc.se_context = system_u:system_r:virtd_lxc_t:s0-s0:c0.c1023<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">lxc.logfile = /newcontainer.log<o:p></o:p></p>
<p class="MsoNormal">lxc.loglevel = 1<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"># Enable auto start<o:p></o:p></p>
<p class="MsoNormal">lxc.start.auto = 1<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"># Set up some system limits<o:p></o:p></p>
<p class="MsoNormal">#lxc.cgroup.memory.limit_in_bytes = 488282K<o:p></o:p></p>
<p class="MsoNormal">#lxc.cgroup.memory.memsw.limit_in_bytes = 500000K<o:p></o:p></p>
<p class="MsoNormal">#lxc.cgroup.cpuset.cpus = 0<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"># Network configuration<o:p></o:p></p>
<p class="MsoNormal">lxc.network.0.type = veth<o:p></o:p></p>
<p class="MsoNormal">lxc.network.0.flags = up<o:p></o:p></p>
<p class="MsoNormal">lxc.network.0.link = br-base<o:p></o:p></p>
<p class="MsoNormal">lxc.network.0.hwaddr = 52:54:00:af:83:80<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">lxc.network.1.type = veth<o:p></o:p></p>
<p class="MsoNormal">lxc.network.1.flags = up<o:p></o:p></p>
<p class="MsoNormal">lxc.network.1.link = br-eth0<o:p></o:p></p>
<p class="MsoNormal">lxc.network.1.hwaddr = 52:54:00:6e:5a:47<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">lxc.network.2.type = veth<o:p></o:p></p>
<p class="MsoNormal">lxc.network.2.flags = up<o:p></o:p></p>
<p class="MsoNormal">lxc.network.2.link = br-eth2<o:p></o:p></p>
<p class="MsoNormal">lxc.network.2.hwaddr = 52:54:00:4d:b5:6e<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">lxc.network.3.type = veth<o:p></o:p></p>
<p class="MsoNormal">lxc.network.3.flags = up<o:p></o:p></p>
<p class="MsoNormal">lxc.network.3.link = br-eth3<o:p></o:p></p>
<p class="MsoNormal">lxc.network.3.hwaddr = 52:54:00:eb:a3:24<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">lxc.network.4.type = veth<o:p></o:p></p>
<p class="MsoNormal">lxc.network.4.flags = up<o:p></o:p></p>
<p class="MsoNormal">lxc.network.4.link = br-eth4<o:p></o:p></p>
<p class="MsoNormal">lxc.network.4.hwaddr = 52:54:00:ec:a4:4a<o:p></o:p></p>
<p class="MsoNormal">================================================================================<o:p></o:p></p>
</div>
<p style="font-size:x-small;"><br>
This E-mail is confidential. It may also be legally privileged. If you are not the addressee you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the
sender immediately by return E-mail.<br>
<br>
Internet communications cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions.<br>
</p>
</body>
</html>