<img style="border: none; background:none; width: 0; height: 0;" src="https://share.polymail.io/v2/z/a/NWIxNmU0NzZhM2Q0/QrTH4P-S94osQO18tsMpQndayqTSQqOA8ZxP-IyZEVLbuVOoGuHHABvW_FmzdpbVBSwKK1I3TLUzvQo-l3Z15iFWbnlt9ZND9wOlXXEzq8DNZ_HZj5xtMfLj0QXrjSL-9_Z8ij1G0ClezUgYFURr7qJ3Baqu2_UufPcDlLRW.png" alt="" width="0px" height="0px" border="0" /><div></div>
<div>Content of the omitted include:</div><div><br></div><div><div># Default pivot location</div><div>lxc.pivotdir = lxc_putold</div><div><br></div><div># Default mount entries</div><div>lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0</div><div>lxc.mount.entry = sysfs sys sysfs defaults 0 0</div><div>lxc.mount.entry = /sys/fs/fuse/connections sys/fs/fuse/connections none bind,optional 0 0</div><div>lxc.mount.entry = /sys/kernel/debug sys/kernel/debug none bind,optional 0 0</div><div>lxc.mount.entry = /sys/kernel/security sys/kernel/security none bind,optional 0 0</div><div>lxc.mount.entry = /sys/fs/pstore sys/fs/pstore none bind,optional 0 0</div><div><br></div><div># Default console settings</div><div>lxc.devttydir = lxc</div><div>lxc.tty = 4</div><div>lxc.pts = 1024</div><div><br></div><div># Default capabilities</div><div>lxc.cap.drop = sys_module mac_admin mac_override sys_time</div><div><br></div><div># When using LXC with apparmor, the container will be confined by default.</div><div># If you wish for it to instead run unconfined, copy the following line</div><div># (uncommented) to the container's configuration file.</div><div>#lxc.aa_profile = unconfined</div><div><br></div><div># To support container nesting on an Ubuntu host while retaining most of</div><div># apparmor's added security, use the following two lines instead.</div><div>#lxc.aa_profile = lxc-container-default-with-nesting</div><div>#lxc.mount.auto = cgroup:mixed</div><div><br></div><div># Uncomment the following line to autodetect squid-deb-proxy configuration on the</div><div># host and forward it to the guest at start time.</div><div>#lxc.hook.pre-start = /usr/share/lxc/hooks/squid-deb-proxy-client</div><div><br></div><div># If you wish to allow mounting block filesystems, then use the following</div><div># line instead, and make sure to grant access to the block device and/or loop</div><div># devices below in lxc.cgroup.devices.allow.</div><div>#lxc.aa_profile = lxc-container-default-with-mounting</div><div><br></div><div># Default cgroup limits</div><div>lxc.cgroup.devices.deny = a</div><div>## Allow any mknod (but not using the node)</div><div>lxc.cgroup.devices.allow = c *:* m</div><div>lxc.cgroup.devices.allow = b *:* m</div><div>## /dev/null and zero</div><div>lxc.cgroup.devices.allow = c 1:3 rwm</div><div>lxc.cgroup.devices.allow = c 1:5 rwm</div><div>## consoles</div><div>lxc.cgroup.devices.allow = c 5:0 rwm</div><div>lxc.cgroup.devices.allow = c 5:1 rwm</div><div>## /dev/{,u}random</div><div>lxc.cgroup.devices.allow = c 1:8 rwm</div><div>lxc.cgroup.devices.allow = c 1:9 rwm</div><div>## /dev/pts/*</div><div>lxc.cgroup.devices.allow = c 5:2 rwm</div><div>lxc.cgroup.devices.allow = c 136:* rwm</div><div>## rtc</div><div>lxc.cgroup.devices.allow = c 254:0 rm</div><div>## fuse</div><div>lxc.cgroup.devices.allow = c 10:229 rwm</div><div>## tun</div><div>lxc.cgroup.devices.allow = c 10:200 rwm</div><div>## full</div><div>lxc.cgroup.devices.allow = c 1:7 rwm</div><div>## hpet</div><div>lxc.cgroup.devices.allow = c 10:228 rwm</div><div>## kvm</div><div>lxc.cgroup.devices.allow = c 10:232 rwm</div><div>## To use loop devices, copy the following line to the container's</div><div>## configuration file (uncommented).</div><div>#lxc.cgroup.devices.allow = b 7:* rwm</div><div><br></div><div># Blacklist some syscalls which are not safe in privileged</div><div># containers</div><div>lxc.seccomp = /usr/share/lxc/config/common.seccomp</div><br>
</div>
<div id="psignature"><div>Martín</div></div>
<div class="gmail_extra"><br/><div class="gmail_quote"><div dir="ltr">On Tue, Jun 05, 2018 at 4:28 PM fmartin91@gmail.com <<a href="mailto:fmartin91@gmail.com">fmartin91@gmail.com</a>> wrote:<br/></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><style><![CDATA[a, pre, code, a:link, body { word-wrap: break-word !important; }]]></style>
<div> </div>
<div>
I omitted this line that is probably important!</div>
<div><br/></div>
<div>
<div># Common configuration</div>
<div>lxc.include = /usr/share/lxc/config/ubuntu.common.conf</div>
<br/>
</div>
<div>Best,</div>
<div id="psignature"><div>Martín</div></div>
<br/><div class="gmail_quote"><div dir="ltr">On Tue, Jun 05, 2018 at 4:24 PM "Stéphane Graber" <stgraber> <<a href="mailto:" st="" graber="">">"Stéphane Graber" <stgraber> </stgraber></a>> wrote:<br/></stgraber></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><style><![CDATA[<![CDATA[a, pre, code, a:link, body { word-wrap: break-word !important; }]]]]><![CDATA[>]]></style><p>Is that all you have or is there some lines before that?
<br/>
</p><br/>On Tue, Jun 05, 2018 at 12:16:48PM -0700, Martín Fernández wrote:
<br/>> Stéphane,
<br/>>
<br/>> I think this could be the issue in the configuration:
<br/>>
<br/>> ```
<br/>> # Container specific configuration
<br/>> lxc.rootfs = /dev/Main/app1-dev
<br/>> lxc.mount = /var/lib/lxc/app1-dev/fstab
<br/>> lxc.utsname = app1-dev
<br/>> lxc.arch = amd64
<br/>> ```
<br/>>
<br/>> Best,
<br/>> Martín
<br/>>
<br/>> On Tue, Jun 05, 2018 at 4:14 PM "Stéphane Graber" < ">"Stéphane Graber" > wrote:
<br/>>
<br/>> >
<br/>> >
<br/>> >
<br/>> > /var/lib/lxc/ /config for the container you're testing things with.
<br/>> >
<br/>> >
<br/>> >
<br/>> >
<br/>> > On Tue, Jun 05, 2018 at 12:09:52PM -0700, Martín Fernández wrote:
<br/>> > > Stéphane,
<br/>> > >
<br/>> > > Not sure what configuration file you are talking about. Configuration
<br/>> > file under /etc/lxc/default.conf looks like this:
<br/>> > >
<br/>> > > ```
<br/>> > > lxc.network.type = veth
<br/>> > > <a href="http://lxc.network.link">lxc.network.link</a> ( <a href="http://lxc.network.link">http://lxc.network.link</a> ) = br0
<br/>> > > lxc.network.flags = up
<br/>> > > lxc.network.hwaddr = XXXXX
<br/>> > > ```
<br/>> > >
<br/>> > > Any lxc-* command that I could use to introspect the containers and get
<br/>> > more information to troubleshoot ?
<br/>> > >
<br/>> > > Thanks again!
<br/>> > >
<br/>> > > Best,
<br/>> > > Martín
<br/>> > >
<br/>> > > On Tue, Jun 05, 2018 at 4:05 PM "Stéphane Graber" < ">"Stéphane Graber"
<br/>> > > wrote:
<br/>> > >
<br/>> > > >
<br/>> > > >
<br/>> > > >
<br/>> > > > What's your container's config like?
<br/>> > > >
<br/>> > > > I wonder if it's somehow missing the include (usually indirect through
<br/>> >
<br/>> > > > common.conf) that's needed for the lxcfs hook.
<br/>> > > >
<br/>> > > >
<br/>> > > >
<br/>> > > > On Tue, Jun 05, 2018 at 11:57:39AM -0700, Martín Fernández wrote:
<br/>> > > > > Stéphane,
<br/>> > > > >
<br/>> > > > > `grep lxcfs /proc/1/mountinfo` doesn’t return any output.
<br/>> > > > >
<br/>> > > > > On the other hand, /var/lib/lxcfs/ shows `cgroup` and `proc`
<br/>> > folders
<br/>> > > > with multiple files.
<br/>> > > > >
<br/>> > > > > Best,
<br/>> > > > > Martín
<br/>> > > > >
<br/>> > > > > On Tue, Jun 05, 2018 at 3:54 PM "Stéphane Graber" < ">"Stéphane
<br/>> > Graber"
<br/>> > > > > wrote:
<br/>> > > > >
<br/>> > > > > >
<br/>> > > > > >
<br/>> > > > > >
<br/>> > > > > > What do you see if you run "grep lxcfs /proc/1/mountinfo" inside
<br/>> > the
<br/>> > > > > > container?
<br/>> > > > > >
<br/>> > > > > > And do you see the lxcfs tree at /var/lib/lxcfs/ on the host?
<br/>> > > > > >
<br/>> > > > > >
<br/>> > > > > >
<br/>> > > > > > On Tue, Jun 05, 2018 at 11:50:51AM -0700, Martín Fernández wrote:
<br/>> > > > > > > Stéphane,
<br/>> > > > > > >
<br/>> > > > > > > I just got time to do my work on lxcfs. Installed lxcfs running
<br/>> > on a
<br/>> > > >
<br/>> > > > > > Ubuntu 14.04 box, installed version is 2.0.8.
<br/>> > > > > > >
<br/>> > > > > > > I restarted one of our containers and “I think” I see wrong
<br/>> > output
<br/>> > > > when
<br/>> > > > > > running `free` for example.
<br/>> > > > > > >
<br/>> > > > > > > lxc-info shows 1GB of memory usage and `free` shows 24GB of
<br/>> > memory
<br/>> > > > usage
<br/>> > > > > > which is the same as the host memory usage. Anything I could be
<br/>> > > > missing ?
<br/>> > > > > > >
<br/>> > > > > > > Short version of the process done would be:
<br/>> > > > > > >
<br/>> > > > > > > - apt-get install lxcfs
<br/>> > > > > > > - sudo init 0 (in container)
<br/>> > > > > > > - lxc-start -n container-name -d
<br/>> > > > > > >
<br/>> > > > > > > Best,
<br/>> > > > > > > Martín
<br/>> > > > > > >
<br/>> > > > > > > On Thu, May 31, 2018 at 12:39 AM "Stéphane Graber" < ">"Stéphane
<br/>> >
<br/>> > > > Graber"
<br/>> > > > > > > wrote:
<br/>> > > > > > >
<br/>> > > > > > > >
<br/>> > > > > > > >
<br/>> > > > > > > >
<br/>> > > > > > > > On Wed, May 30, 2018 at 07:16:04PM -0700, Martín Fernández
<br/>> > wrote:
<br/>> > > > > > > > > Stéphane,
<br/>> > > > > > > > >
<br/>> > > > > > > > > Thank you very much for the quick reply!
<br/>> > > > > > > > >
<br/>> > > > > > > > > What are you are saying is pretty awesome! That would make
<br/>> > it
<br/>> > > > super
<br/>> > > > > > easy
<br/>> > > > > > > > to start using it. Is there any constraint in terms of what
<br/>> > > > versions
<br/>> > > > > > of
<br/>> > > > > > > > LXC are supported ? I can run LXCFS with LXC 1.0.10 ?
<br/>> > > > > > > >
<br/>> > > > > > > > 1.0.10 should be fine though we certainly don't have all that
<br/>> > many
<br/>> > > >
<br/>> > > > > > users
<br/>> > > > > > > > of that release now that it's two LTS ago :)
<br/>> > > > > > > >
<br/>> > > > > > > > In any case, it'll be safe to install LXCFS, then create a
<br/>> > test
<br/>> > > > > > > > container, confirm it behaves and if it does then start
<br/>> > restarting
<br/>> > > >
<br/>> > > > > > your
<br/>> > > > > > > > existing containers, if it doesn't, let us know and we'll try
<br/>> > to
<br/>> > > > > > figure
<br/>> > > > > > > > out why.
<br/>> > > > > > > >
<br/>> > > > > > > > > In order to understand a little bit more about how LXCFS
<br/>> > works,
<br/>> > > > does
<br/>> > > > > >
<br/>> > > > > > > > LXCFS hook into LXC starting process and mount /proc/* files ?
<br/>> >
<br/>> > > > > > > >
<br/>> > > > > > > > That's correct, LXCFS when installed will create a tree at
<br/>> > > > > > > > /var/lib/lxcfs those files then get bind-mounted on top of the
<br/>> >
<br/>> > > > > > > > containers /proc/* files through a LXC startup hook.
<br/>> > > > > > > >
<br/>> > > > > > > > > Thank you very much again!
<br/>> > > > > > > > >
<br/>> > > > > > > > > Best,
<br/>> > > > > > > > > Martín
<br/>> > > > > > > > >
<br/>> > > > > > > > > On Wed, May 30, 2018 at 10:52 PM "Stéphane Graber" <
<br/>> > ">"Stéphane
<br/>> > > >
<br/>> > > > > > Graber"
<br/>> > > > > > > > > wrote:
<br/>> > > > > > > > >
<br/>> > > > > > > > > >
<br/>> > > > > > > > > >
<br/>> > > > > > > > > >
<br/>> > > > > > > > > > _______________________________________________
<br/>> > > > > > > > > > lxc-users mailing list
<br/>> > > > > > > > > > <a href="mailto:lxc-users@lists.linuxcontainers.org">lxc-users@lists.linuxcontainers.org</a>
<br/>> > > > > > > > > > <a href="http://lists.linuxcontainers.org/listinfo/lxc-users">http://lists.linuxcontainers.org/listinfo/lxc-users</a>
<br/>> > > > > > > > > >
<br/>> > > > > > > > > >
<br/>> > > > > > > > > >
<br/>> > > > > > > > > > On Wed, May 30, 2018 at 05:08:59PM -0700, Martín Fernández
<br/>> >
<br/>> > > > wrote:
<br/>> > > > > > > > > > > Hello,
<br/>> > > > > > > > > > >
<br/>> > > > > > > > > > > We are using LXC to virtualize containers in multiple of
<br/>> > our
<br/>> > > >
<br/>> > > > > > hosts.
<br/>> > > > > > > > We
<br/>> > > > > > > > > > have been running with LXC for a while now.
<br/>> > > > > > > > > > >
<br/>> > > > > > > > > > > We started adding monitoring tools to our systems and
<br/>> > found
<br/>> > > > the
<br/>> > > > > > > > known
<br/>> > > > > > > > > > issue that LXC containers show the host information on
<br/>> > > > > > /proc/meminfo
<br/>> > > > > > > > and
<br/>> > > > > > > > > > /proc/cpuinfo.
<br/>> > > > > > > > > > >
<br/>> > > > > > > > > > > I found that LXCFS solves the problems mentioned above.
<br/>> > What
<br/>> > > >
<br/>> > > > > > would
<br/>> > > > > > > > be
<br/>> > > > > > > > > > required to setup LXCFS in my hosts ? Would I need to
<br/>> > reboot
<br/>> > > > all
<br/>> > > > > > the
<br/>> > > > > > > > > > containers ? Do I need to restore my containers filesystem
<br/>> > ?
<br/>> > > > Is
<br/>> > > > > > there
<br/>> > > > > > > > any
<br/>> > > > > > > > > > guide/documentation around it ?
<br/>> > > > > > > > > > >
<br/>> > > > > > > > > > > Thanks before hand!
<br/>> > > > > > > > > > >
<br/>> > > > > > > > > > > Best,
<br/>> > > > > > > > > > > Martín
<br/>> > > > > > > > > >
<br/>> > > > > > > > > > Hey there,
<br/>> > > > > > > > > >
<br/>> > > > > > > > > > You should just need to install lxcfs and then any
<br/>> > container
<br/>> > > > you
<br/>> > > > > > start
<br/>> > > > > > > >
<br/>> > > > > > > > > > or restart will be using it. There's no way to set it up
<br/>> > > > against a
<br/>> > > > > >
<br/>> > > > > > > > > > running container, but there's also no need to restart all
<br/>> >
<br/>> > > > your
<br/>> > > > > > > > > > containers immediately, you can slowly roll it out if that
<br/>> >
<br/>> > > > helps.
<br/>> > > > > > > > > >
<br/>> > > > > > > > > > And no changes needed to the containers, it gets setup
<br/>> > > > > > automatically
<br/>> > > > > > > > > > through a lxc hook when the container starts.
<br/>> > > > > > > > > >
<br/>> > > > > > > > > >
<br/>> > > > > > > > > > --
<br/>> > > > > > > > > > Stéphane Graber
<br/>> > > > > > > > > > Ubuntu developer
<br/>> > > > > > > > > > <a href="http://www.ubuntu.com">http://www.ubuntu.com</a>
<br/>> > > > > > > > > >
<br/>> > > > > > > > > >
<br/>> > > > > > > > > >
<br/>> > > > > > > >
<br/>> > > > > > > > --
<br/>> > > > > > > > Stéphane Graber
<br/>> > > > > > > > Ubuntu developer
<br/>> > > > > > > > <a href="http://www.ubuntu.com">http://www.ubuntu.com</a>
<br/>> > > > > > > >
<br/>> > > > > > > >
<br/>> > > > > > > >
<br/>> > > > > >
<br/>> > > > > > --
<br/>> > > > > > Stéphane Graber
<br/>> > > > > > Ubuntu developer
<br/>> > > > > > <a href="http://www.ubuntu.com">http://www.ubuntu.com</a>
<br/>> > > > > >
<br/>> > > >
<br/>> > > > --
<br/>> > > > Stéphane Graber
<br/>> > > > Ubuntu developer
<br/>> > > > <a href="http://www.ubuntu.com">http://www.ubuntu.com</a>
<br/>> > > >
<br/>> >
<br/>> > --
<br/>> > Stéphane Graber
<br/>> > Ubuntu developer
<br/>> > <a href="http://www.ubuntu.com">http://www.ubuntu.com</a>
<br/>> >
<br/>
<br/>--
<br/>Stéphane Graber
<br/>Ubuntu developer
<br/><a href="http://www.ubuntu.com">http://www.ubuntu.com</a>
<br/></blockquote></div></blockquote></div><br/></div><br/>