[lxc-users] Howto/Tutorial wanted: Running an application inside a container
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi everyone, I thought running a single application inside a container was one of the main advantages of lxc over 'full'virtualization like KVM. But it seems I fail to find a nice tutorial how to do this. Any hints? I found some sites, but the pages I found were pretty old (2012? 2011?), so I am not sure if they are still valid. I got this far with running apache inside the container: Create a rootfs containing empty directories for proc, sys, ... Copy over apache's config into the rootfs Create a config file that says: > lxc.network.type = veth lxc.network.flags = up lxc.network.link = > virbr0 lxc.network.hwaddr = 02:00:e4:28:dd:77 lxc.network.name = > eth0 lxc.rootfs = /some/path/to/Apache_Test4 lxc.utsname = > Apache_Test4 I can then run lxc-execute -n Apache_Test4 -f /path/to/the/config -- /usr/sbin/httpd2 And I get: > lxc-execute: Failed to find an lxc-init lxc-execute: invalid > sequence number 1. expected 4 lxc-execute: failed to spawn > 'Apache_Test4' lxc-execute: Device or resource busy - cgroup_rmdir: > failed to delete /sys/fs/cgroup/hugetlb/lxc/Apache_Test4 > lxc-execute: Device or resource busy - cgroup_rmdir: failed to > delete /sys/fs/cgroup/perf_event/lxc/Apache_Test4 lxc-execute: > Device or resource busy - cgroup_rmdir: failed to delete > /sys/fs/cgroup/blkio/lxc/Apache_Test4 lxc-execute: Device or > resource busy - cgroup_rmdir: failed to delete > /sys/fs/cgroup/net_cls/lxc/Apache_Test4 lxc-execute: Device or > resource busy - cgroup_rmdir: failed to delete > /sys/fs/cgroup/freezer/lxc/Apache_Test4 lxc-execute: Device or > resource busy - cgroup_rmdir: failed to delete > /sys/fs/cgroup/devices/lxc/Apache_Test4 lxc-execute: Device or > resource busy - cgroup_rmdir: failed to delete > /sys/fs/cgroup/memory/lxc/Apache_Test4 lxc-execute: Device or > resource busy - cgroup_rmdir: failed to delete > /sys/fs/cgroup/cpu,cpuacct/lxc/Apache_Test4 lxc-execute: Device or > resource busy - cgroup_rmdir: failed to delete > /sys/fs/cgroup/cpuset/lxc/Apache_Test4 And all the links I found for the "failed ...lxc-init" point me to installing lxc inside the container. Which is not possible, as it is no 'complete' OS inside. I also failed to find a file called lxc-init on my openSUSE host where I installed lxc 1.0.3. So, what to do? Outdated howtos? Errors on my side (I would not be surprised)? Did I understand something wrong? Thanks in advance! Regards, Johannes - -- Coming back to where you started is not the same as never leaving. (Terry Pratchett) -BEGIN PGP SIGNATURE- Version: GnuPG v2.0.22 (GNU/Linux) Comment: Using GnuPG with SeaMonkey - http://www.enigmail.net/ iEYEARECAAYFAlNubV4ACgkQzi3gQ/xETbLwHwCgmxy1EepZKJq++AuH4riXTPqW UvsAn27zXIfJlJPYVcUu2PHvDVjAaSMh =h5lp -END PGP SIGNATURE- ___ lxc-users mailing list lxc-users@lists.linuxcontainers.org http://lists.linuxcontainers.org/listinfo/lxc-users
Re: [lxc-users] Howto/Tutorial wanted: Running an application inside a container
On 05/10/2014 08:18 PM, Johannes Kastl wrote: > Hi everyone, > > I thought running a single application inside a container was one of > the main advantages of lxc over 'full'virtualization like KVM. But it > seems I fail to find a nice tutorial how to do this. Any hints? I cannot give you a useful answer to your question, but you might be interested in docker. tamas ___ lxc-users mailing list lxc-users@lists.linuxcontainers.org http://lists.linuxcontainers.org/listinfo/lxc-users
Re: [lxc-users] Howto/Tutorial wanted: Running an application inside a container
Quoting Johannes Kastl (m...@ojkastl.de): > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Hi everyone, > > I thought running a single application inside a container was one of > the main advantages of lxc over 'full'virtualization like KVM. But it > seems I fail to find a nice tutorial how to do this. Any hints? > > I found some sites, but the pages I found were pretty old (2012? > 2011?), so I am not sure if they are still valid. > > I got this far with running apache inside the container: > Create a rootfs containing empty directories for proc, sys, ... > Copy over apache's config into the rootfs > Create a config file that says: > > > lxc.network.type = veth lxc.network.flags = up lxc.network.link = > > virbr0 lxc.network.hwaddr = 02:00:e4:28:dd:77 lxc.network.name = > > eth0 lxc.rootfs = /some/path/to/Apache_Test4 lxc.utsname = > > Apache_Test4 > > I can then run > lxc-execute -n Apache_Test4 -f /path/to/the/config -- /usr/sbin/httpd2 > > And I get: > > lxc-execute: Failed to find an lxc-init lxc-execute: invalid > > sequence number 1. expected 4 lxc-execute: failed to spawn > > 'Apache_Test4' lxc-execute: Device or resource busy - cgroup_rmdir: > > failed to delete /sys/fs/cgroup/hugetlb/lxc/Apache_Test4 > > lxc-execute: Device or resource busy - cgroup_rmdir: failed to > > delete /sys/fs/cgroup/perf_event/lxc/Apache_Test4 lxc-execute: > > Device or resource busy - cgroup_rmdir: failed to delete > > /sys/fs/cgroup/blkio/lxc/Apache_Test4 lxc-execute: Device or > > resource busy - cgroup_rmdir: failed to delete > > /sys/fs/cgroup/net_cls/lxc/Apache_Test4 lxc-execute: Device or > > resource busy - cgroup_rmdir: failed to delete > > /sys/fs/cgroup/freezer/lxc/Apache_Test4 lxc-execute: Device or > > resource busy - cgroup_rmdir: failed to delete > > /sys/fs/cgroup/devices/lxc/Apache_Test4 lxc-execute: Device or > > resource busy - cgroup_rmdir: failed to delete > > /sys/fs/cgroup/memory/lxc/Apache_Test4 lxc-execute: Device or > > resource busy - cgroup_rmdir: failed to delete > > /sys/fs/cgroup/cpu,cpuacct/lxc/Apache_Test4 lxc-execute: Device or > > resource busy - cgroup_rmdir: failed to delete > > /sys/fs/cgroup/cpuset/lxc/Apache_Test4 > > And all the links I found for the "failed ...lxc-init" point me to > installing lxc inside the container. Which is not possible, as it is > no 'complete' OS inside. I also failed to find a file called lxc-init > on my openSUSE host where I installed lxc 1.0.3. I'm not sure why you're not finding it, but you can just git clone git://github.com/lxc/lxc cd lxc sh autogen.sh ./configure --prefix=/usr make -j4 sudo cp src/lxc/init.lxc /usr/sbin/ Now I'm not sure what lxc version you're on, but you should be safe if you just copy /usr/sbin/init.lxc to /sbin/lxc-init and /usr/lib/lxc/lxc-init. Check the libraries it linked again (ldd /usr/sbin/init.lxc) and make sure all the directories will be bind-mounted from the host into the container. If it still says it fails to find lxc-init, it could be because of a missing library, but also try lxc-start -n container -l trace -o outfile and look through outfile to see which filenames lxc tried to execute lxc-init as, then copy init.lxc there. ___ lxc-users mailing list lxc-users@lists.linuxcontainers.org http://lists.linuxcontainers.org/listinfo/lxc-users
Re: [lxc-users] Howto/Tutorial wanted: Running an application inside a container
On Sun, May 11, 2014 at 1:18 AM, Johannes Kastl wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Hi everyone, > > I thought running a single application inside a container was one of > the main advantages of lxc over 'full'virtualization like KVM. But it Sort of. You can set it in a way that a container runs (almost) nothing else, by disabling most background processess. Regardless, its resource usage will be more efficient. > seems I fail to find a nice tutorial how to do this. Any hints? https://www.stgraber.org/2014/02/09/lxc-1-0-gui-in-containers/ is a good example > I got this far with running apache inside the container: > Create a rootfs containing empty directories for proc, sys, ... > Copy over apache's config into the rootfs ... and that is probably your mistake. Am I right in assuming that your rootfs ONLY contains apache's config, WITHOUT any binary? The container need to have ALL files/directories needed to run the application. The easiest way would be to create a container with working full OS (e.g. using "lxc-create" with a template), or (slightly harder) bind-mount some parts of the host (e.g. /usr, /lib) in the container and copy over other parts (e.g. /etc, /var). > I can then run > lxc-execute -n Apache_Test4 -f /path/to/the/config -- /usr/sbin/httpd2 Personally I would NOT use lxc-execute. Had too many problems with it in the past. Better just use lxc-start and lxc-attach. > > And I get: >> lxc-execute: Failed to find an lxc-init lxc-execute: invalid >> sequence number 1. expected 4 lxc-execute: failed to spawn > And all the links I found for the "failed ...lxc-init" point me to > installing lxc inside the container. correct. > Which is not possible, as it is > no 'complete' OS inside. Like I mentioned above, it's easiest to just install full OS in the container, or bind-mount some parts of the host. If you're pressed for disk space, using something like btrfs/zfs snapshot/clone would help. This is an example of what happens when you run lxc-execute (in my case "build" is the container name), where the container is a working ubuntu rootfs (i.e. created with "lxc-create -t", and starts correctly when you run "lxc-start") and has lxc package installed # lxc-execute -n build -- bash root@build:/# ip ad li 1: lo: mtu 65536 qdisc noqueue state UNKNOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 17: eth0: mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:16:3e:37:ee:23 brd ff:ff:ff:ff:ff:ff inet6 fe80::216:3eff:fe37:ee23/64 scope link valid_lft forever preferred_lft forever root@build:/# df -h / Filesystem Size Used Avail Use% Mounted on rpool/lxc/build 201G 398M 200G 1% / As you can see, it sets up the correct rootfs for the container, and it creates the network interfaces, but it does NOT configure the interface IP. IP configuration is done as part of ubuntu startup scripts (init/upstart), and since lxc-execute does not invoke those, you end up with unconfigured interface. For the network interface part you can work around it by specifying it in the container config file, but you might need other things configured as well (e.g. iptables, dependent services like mysql, etc), which is why I would recommend lxc-start and lxc-attach over lxc-execute. -- Fajar ___ lxc-users mailing list lxc-users@lists.linuxcontainers.org http://lists.linuxcontainers.org/listinfo/lxc-users
Re: [lxc-users] Howto/Tutorial wanted: Running an application inside a container
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 10.05.2014 20:30 Tamas Papp wrote: > I cannot give you a useful answer to your question, but you might > be interested in docker. Thanks for the tip, I already am playing around with docker on another machine. I just thought I'd try em both and take what fits my needs better... Regards, Johannes - -- Ask a stupid question, and be a fool for 5 minutes. Don't ask, and be a fool for the rest of your life. -BEGIN PGP SIGNATURE- Version: GnuPG v2.0.22 (GNU/Linux) Comment: Using GnuPG with SeaMonkey - http://www.enigmail.net/ iEYEARECAAYFAlNvGycACgkQzi3gQ/xETbIHbgCfSjuUA9ve9w/euQbMU7rfVyjc jqYAnjATMswXJUnbEnClnvOKA3j5GtiC =Iuuh -END PGP SIGNATURE- ___ lxc-users mailing list lxc-users@lists.linuxcontainers.org http://lists.linuxcontainers.org/listinfo/lxc-users
Re: [lxc-users] Howto/Tutorial wanted: Running an application inside a container
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi Fajar, On 11.05.2014 07:10 Fajar A. Nugraha wrote: > On Sun, May 11, 2014 at 1:18 AM, Johannes Kastl > wrote: > https://www.stgraber.org/2014/02/09/lxc-1-0-gui-in-containers/ is a > good example Sorry, but that one talks about installing a complete OS in the container: > lxc-create -t download -n precise-gui -- -d ubuntu -r precise -a > i386 I might have used the wrong words in my question, I was not talking about running a complete OS, just (what I believe is called) a application container (in contrast to a system container). > ... and that is probably your mistake. Am I right in assuming that > your rootfs ONLY contains apache's config, WITHOUT any binary? Yes. > The container need to have ALL files/directories needed to run the > application. That might be the case, but I have not got as far as running apache, at least I thought, because of the lxc init error message... > The easiest way would be to create a container with working full > OS see above > Personally I would NOT use lxc-execute. Had too many problems with > it in the past. Better just use lxc-start and lxc-attach. Thanks for the tip, I have not read that before. > Like I mentioned above, it's easiest to just install full OS in > the container, or bind-mount some parts of the host. If you're > pressed for disk space, using something like btrfs/zfs > snapshot/clone would help. Basically I just wanted to avoid having to run a complete installation, cos that means e.g. keeping this one up to date as well. As disk space is not the main reason, having to run a complete OS just kind of takes away advantages LXC has in contrast to KVM... But bind-mounting seems like a good way, that way updates on the host are enough... Regards, Johannes - -- It is a mistake to think you can solve any major problems just with potatoes. (Douglas Adams) -BEGIN PGP SIGNATURE- Version: GnuPG v2.0.22 (GNU/Linux) Comment: Using GnuPG with SeaMonkey - http://www.enigmail.net/ iEYEARECAAYFAlNvtaoACgkQzi3gQ/xETbLGagCglQk3xmkbRrvLpDzE31IqveTc qJMAnAyZDPZF0oBRxAKCiHva2NebqQFz =K0S6 -END PGP SIGNATURE- ___ lxc-users mailing list lxc-users@lists.linuxcontainers.org http://lists.linuxcontainers.org/listinfo/lxc-users
Re: [lxc-users] Howto/Tutorial wanted: Running an application inside a container
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 11.05.2014 00:54 Serge Hallyn wrote: > I'm not sure why you're not finding it, but you can just > Now I'm not sure what lxc version you're on, but you should be safe > if you just copy /usr/sbin/init.lxc to /sbin/lxc-init and > /usr/lib/lxc/lxc-init. Just to be clear, I had not copied the init into the containers' rootfs, as I simply was looking for a file called lxc-init... I found init.lxc and will copy it, and see if it works... Regards, Johannes - -- Elisabeth's safe, just as I promised. And she's going to marry Norrington, just as she promised, and you are going to die for her, just as you promised. So we're all men of our word really, except Elizabeth, who is, in fact, a woman. (Pirates of the Caribbean) -BEGIN PGP SIGNATURE- Version: GnuPG v2.0.22 (GNU/Linux) Comment: Using GnuPG with SeaMonkey - http://www.enigmail.net/ iEYEARECAAYFAlNvti4ACgkQzi3gQ/xETbJ08wCeOBbDgxAbN9DMp4vn51oMJUGu APAAnj/gSecttsdMIA+DdsuIhZUaxNFF =+54M -END PGP SIGNATURE- ___ lxc-users mailing list lxc-users@lists.linuxcontainers.org http://lists.linuxcontainers.org/listinfo/lxc-users
Re: [lxc-users] Howto/Tutorial wanted: Running an application inside a container
On Mon, May 12, 2014 at 12:38 AM, Johannes Kastl wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Hi Fajar, > > On 11.05.2014 07:10 Fajar A. Nugraha wrote: >> On Sun, May 11, 2014 at 1:18 AM, Johannes Kastl >> wrote: >> https://www.stgraber.org/2014/02/09/lxc-1-0-gui-in-containers/ is a >> good example > > Sorry, but that one talks about installing a complete OS in the container: Correct. But the created container WOULD work to run only a single application as well with some minor modifications (e.g. specificing container networking options in the config file). >> Like I mentioned above, it's easiest to just install full OS in >> the container, or bind-mount some parts of the host. If you're >> pressed for disk space, using something like btrfs/zfs >> snapshot/clone would help. > > Basically I just wanted to avoid having to run a complete > installation, cos that means e.g. keeping this one up to date as well. > As disk space is not the main reason, having to run a complete OS just > kind of takes away advantages LXC has in contrast to KVM... > > But bind-mounting seems like a good way, that way updates on the host > are enough... This example should help you get started. It assumes: - you're using fully-up-to-date ubuntu trusty - you have /opt/container/root and /opt/containter/data directories, which are empty (e.g. freshly created by mkdir) First, create a new root for the container by using overlay of the host mount -t overlayfs -o lowerdir=/,upperdir=/opt/container/data overlayfs /opt/container/root Next, use this sample container config file to get started (I put this as /var/lib/lxc/host/config, so the container name will be "host") ### lxc.include = /usr/share/lxc/config/ubuntu.common.conf lxc.include = /usr/share/lxc/config/ubuntu.userns.conf lxc.arch = x86_64 lxc.utsname = container # use the overlay root lxc.rootfs = /opt/container/root # use hosts usr and lib, so updates on the host should propagate to the lxc.mount.entry = /usr usr none bind,ro lxc.mount.entry = /lib lib none bind,ro # use bash as init to prevent running full startup sequence on lxc-start lxc.mount.entry = /bin/bash sbin/init none bind,ro lxc.network.type = veth lxc.network.flags = up lxc.network.link = lxcbr0 lxc.network.hwaddr = 00:16:3e:ef:b5:6d lxc.network.veth.pair=v-container-0 #static network setup for veth in lxcbr0 lxc.network.ipv4=10.0.3.11/24 lxc.network.ipv4.gateway=10.0.3.1 ### Last, start an application (in my example, /usr/bin/top, which requires TERM to be set) like this: lxc-execute -n host -- env TERM=$TERM sudo -i /usr/bin/top It should, in most part, do what you want: start a container to run an application, then stop the container when the application exits. Again, personally I prefer to simply use full OS in the container (even with the consequence oh having to update it separately from the host) combined with lxc-start and lxc-attach. -- Fajar ___ lxc-users mailing list lxc-users@lists.linuxcontainers.org http://lists.linuxcontainers.org/listinfo/lxc-users
Re: [lxc-users] Howto/Tutorial wanted: Running an application inside a container
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello Fajar, On 12.05.2014 00:27 Fajar A. Nugraha wrote: > This example should help you get started. It assumes: Thanks for the nice example, I will give it a try. Just one thing, you overlayed the hosts / with another directory (/opt/container/data), which should contain the changes compared to /. But why do you bind-mount /usr and /lib into the container? This should be included with the overlayfs, or am I missing something? Regards, Johannes - -- A thing is not necessarily true because a man dies for it. (Oscar Wilde) -BEGIN PGP SIGNATURE- Version: GnuPG v2.0.22 (GNU/Linux) Comment: Using GnuPG with SeaMonkey - http://www.enigmail.net/ iEYEARECAAYFAlNzFFsACgkQzi3gQ/xETbKUrQCggLqZJ67KRdNL7jA0XNsd08wm Zi4AmwZj182CTkQ4WtbGwXt9wlV34VQZ =WS++ -END PGP SIGNATURE- ___ lxc-users mailing list lxc-users@lists.linuxcontainers.org http://lists.linuxcontainers.org/listinfo/lxc-users
Re: [lxc-users] Howto/Tutorial wanted: Running an application inside a container
On Wed, May 14, 2014 at 1:59 PM, Johannes Kastl wrote: > Just one thing, you overlayed the hosts / with another directory > (/opt/container/data), On further consideration, it might be better to set it as /var/lib/lxc/host/rootfs as the overlay mountpoint (to make it consistent with other containers) and /var/lib/lxc/host/overlay-data for to store the changes (so that it's in the same directory). Use whatever is best for you though. > which should contain the changes compared to /. > > But why do you bind-mount /usr and /lib into the container? This > should be included with the overlayfs, or am I missing something? > > That design is based on the assumptions that "most updates will replace current binaries, but you can still use old configuration/state". To be complete, I probably should've bind-mount read-only /bin and /sbin as well. Without the bind-mount, the container would be able to write things to it's own /usr and /lib, thus breaking the link with the host. This behavior is desired for some directories (e.g. /etc, /var), where you want the container to have it's own copy. However it is NOT desired if you want updates on the host to propagate to the container. So with the binary directories bind-mounted read-only: - the container will have (mostly) it's own writable root fs - updates on the CONTAINER (including new package installation) will FAIL due to read-only bind-mount. This is intended. - updates to binary directories on the HOST will also be seen by the CONTAINER. This is intended. -- Fajar ___ lxc-users mailing list lxc-users@lists.linuxcontainers.org http://lists.linuxcontainers.org/listinfo/lxc-users
Re: [lxc-users] Howto/Tutorial wanted: Running an application inside a container
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 14.05.14 09:33 Fajar A. Nugraha wrote: > Without the bind-mount, the container would be able to write things > to it's own /usr and /lib, thus breaking the link with the host. > This behavior is I did not think of that. Thanks for the fast answer. Regards, Johannes - -- Elisabeth's safe, just as I promised. And she's going to marry Norrington, just as she promised, and you are going to die for her, just as you promised. So we're all men of our word really, except Elizabeth, who is, in fact, a woman. (Pirates of the Caribbean) -BEGIN PGP SIGNATURE- Version: GnuPG v1 Comment: Using GnuPG with SeaMonkey - http://www.enigmail.net/ iEYEARECAAYFAlNzMX8ACgkQzi3gQ/xETbIVuwCfVDMk9VfRJ24yGcdv+dHk7Rg4 7mAAnjiw0eNj8AMay6fRyQiX2tJGKY16 =aNYC -END PGP SIGNATURE- ___ lxc-users mailing list lxc-users@lists.linuxcontainers.org http://lists.linuxcontainers.org/listinfo/lxc-users
Re: [lxc-users] Howto/Tutorial wanted: Running an application inside a container
Hello Fajar, On 12.05.2014 00:27 Fajar A. Nugraha wrote: > This example should help you get started. It assumes: Thanks for the nice example, I will give it a try. Hello, Johannes. Did you succeed with it? Especially with running host GUI apps inside a container... I can do nothing with > Error: cannot open display: :0 and so on.. -- Regards, Christian. ___ lxc-users mailing list lxc-users@lists.linuxcontainers.org http://lists.linuxcontainers.org/listinfo/lxc-users
Re: [lxc-users] Howto/Tutorial wanted: Running an application inside a container
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello Christian, On 09.06.14 12:41 frodox wrote: > Did you succeed with it? Especially with running host GUI apps > inside a container... I can do nothing with > Error: cannot open > display: :0 and so on.. Unfortunately, I had to stop the experiments halfway through due to lack of time... Regards, Johannes - -- If atheism is a religion, then bald is a hair colour. (Paul Quirk in alt.atheism.moderated) -BEGIN PGP SIGNATURE- Version: GnuPG v1 Comment: Using GnuPG with SeaMonkey - http://www.enigmail.net/ iEYEARECAAYFAlOVqacACgkQzi3gQ/xETbKuzACeMBh8Fh/E/AEmy4fShHmIdz0t 71kAmwfnXRiWCDAB3pXuhjmsMsSwoyoe =75Pv -END PGP SIGNATURE- ___ lxc-users mailing list lxc-users@lists.linuxcontainers.org http://lists.linuxcontainers.org/listinfo/lxc-users
