LXC Fun

LXC Fun

   {{{title}}}

{{{body}}}

Linux Containers, or LXC, is a Linux feature that allows Linux to run one or more isolated virtual systems (with their own network interfaces, process namespace, user namespace, and power state) using a single Linux kernel on a single server. To learn more take a look at the LXC article.

In this Howto you will be shown how to create containers, how to start, stop, freeze and unfreeze them and also some more fun parts like snapshoting and clonig. To have all this working you will have to have your lxc store (/var/lib/lxc/ and /var/lib/lxcsnaps) to be on a btrfs filesystem.

Creating containers

Creating containers is quite easy using lxc-templates. They are located in the /usr/share/lxc/templates directory. You can find many distribution templates like archlinux, centos, debian, fedora, opensuse, ubuntu, gentoo and some more there. There is also an unofficial funtoo template that can be found at https://github.com/golodhrim/lxc-funtoo/blob/master/lxc-funtoo. The script creates funtoo container, however I was not able to use it with lxc-create script from the lxc utils. You have to run it as a stand-alone script.

So how do you create other containers? I am going to use a debian container for this howto. You will have to emerge debootstrap.

root # emerge -av debootstrap

 * IMPORTANT: 8 news items need reading for repository 'gentoo'.
 * Use eselect news to read news items.


These are the packages that would be merged, in order:

Calculating dependencies... done!
[ebuild  N     ] dev-perl/TimeDate-2.300.0  31 kB
[ebuild  N     ] app-arch/dpkg-1.17.10  USE="bzip2 lzma nls unicode update-alternatives zlib -dselect {-test}" 4,100 kB
[ebuild  N     ] dev-util/debootstrap-1.0.59  96 kB

Total: 3 packages (3 new), Size of downloads: 4,226 kB

Would you like to merge these packages? [Yes/No]

After installing debootstrap, you can create your debian container using:

root # lxc-create -B btrfs -n vm1 -t debian
debootstrap is /usr/bin/debootstrap
Checking cache download in /var/cache/lxc/debian/rootfs-wheezy-armhf ... 
Copying rootfs to /var/lib/lxc/vm1/rootfs...Generating locales (this might take a while)...
  en_US.UTF-8... done
Generation complete.
update-rc.d: using dependency based boot sequencing
update-rc.d: using dependency based boot sequencing
update-rc.d: using dependency based boot sequencing
update-rc.d: using dependency based boot sequencing
Creating SSH2 RSA key; this may take some time ...
Creating SSH2 DSA key; this may take some time ...
Creating SSH2 ECDSA key; this may take some time ...
invoke-rc.d: policy-rc.d denied execution of restart.
Timezone in container is not configured. Adjust it manually.
Root password is 'root', please change !

We will see that the lxc-create command created a subvolume on BTRFS backing file system (-B switch took care of this).

root # btrfs sub list /
---- snip ----
ID 1143 gen 437 top level 5 path var/lib/lxc/vm1/rootfs
---- snip ----

Now you are ready to do all the fun stuff with your LXCs.

Starting/stoping containers

To start a previously created container use the lxc utils:

root # lxc-start -n vm1 -d
root # lxc-info -n vm1
Name:           vm1
State:          RUNNING
PID:            29742
IP:             172.16.65.234
CPU use:        2.92 seconds
BlkIO use:      260.00 KiB
Memory use:     2.99 MiB
KMem use:       0 bytes
Link:           vethTN4NGU
 TX bytes:      2.33 KiB
 RX bytes:      39.54 KiB
 Total bytes:   41.87 KiB
root # lxc-attach -n vm1
root # root@vm1:~#
root # root@vm1:~# exit
root # lxc-stop -n vm1
Name:           vm1
State:          STOPPED

Freezing/unfreezing containers

The command lxc-freeze freezes all the processes running inside the container. The processes will be blocked until they are explicitly thawed by the lxc-unfreeze command. To freeze a previously started container use the lxc utils:

root # lxc-freeze -n vm1
root # lxc-info -n vm1
Name:           vm1
State:          FROZEN
PID:            6817
IP:             172.16.65.234
CPU use:        2.78 seconds
BlkIO use:      0 bytes
Memory use:     2.47 MiB
KMem use:       0 bytes
Link:           veth7E1J8R
 TX bytes:      1.45 KiB
 RX bytes:      3.85 KiB
 Total bytes:   5.31 KiB
root # lxc-unfreeze -n vm1
root # lxc-info -n vm1
Name:           vm1
State:          RUNNING
PID:            6817
IP:             172.16.65.234
CPU use:        2.78 seconds
BlkIO use:      0 bytes
Memory use:     2.47 MiB
KMem use:       0 bytes
Link:           veth7E1J8R
 TX bytes:      1.58 KiB
 RX bytes:      11.13 KiB
 Total bytes:   12.71 KiB

Clones and snapshots

Now the really nice features of LXC are snapshots of containers and also creating clones of containers. The command lxc-snapshot creates snapshot under /var/lib/lxcsnaps/ directory, this directory must also reside on a BTRFS filesystem. To snapshot a previously created container use the lxc utils:

root # lxc-snapshot -n vm1
root # lxc-snapshot -L -n vm1                                                                                                         
snap0 (/var/lib/lxcsnaps/vm1) 2014:11:15 14:01:18
root # btrfs sub list /
--- snip ---
ID 1144 gen 448 top level 1136 path var/lib/lxcsnaps/vm1/snap0/rootfs
--- snip ---

You can also add comments (using a comment file and -c switch). Lets pretend something didn't go well after an upgrade. No big deal if you remembered to create a snapshot before the upgrade. Now you can restore the container to the last good state.

root # btrfs sub list /
--- snip ---
ID ''1143'' gen 437 top level 5 path var/lib/lxc/vm1/rootfs
ID 1144 gen 448 top level 1136 path var/lib/lxcsnaps/vm1/snap0/rootfs
--- snip ---
root # lxc-snapshot -L -n vm1                                                                                                         
snap0 (/var/lib/lxcsnaps/vm1) 2014:11:15 14:01:18
root # lxc-snapshot -n vm1 -r snap0
root # lxc-snapshot -L -n vm1                                                                                                         
snap0 (/var/lib/lxcsnaps/vm1) 2014:11:15 14:01:18
root # btrfs sub list /
--- snip ---
ID 1144 gen 448 top level 1136 path var/lib/lxcsnaps/vm1/snap0/rootfs
ID ''1147'' gen 453 top level 5 path var/lib/lxc/vm1/rootfs
--- snip ---

Notice the ID change in btrfs subvolume list command (ID in italics). BTRFS took care of the lxc-snapshot call and restored the snapshot contained in the lxcsnaps/vm1/snap0 directory.

Now clones are containers that are exactly the same as the originating container. So for example you will configure a basic LAMP stack (LXC Apache Mariadb PHP) in one container and want to use different container for different websites. So after doing all the hard work of setting up LAMP you just clone the container using lxc tools.

root # btrfs sub list /
--- snip ---
ID 1144 gen 448 top level 1136 path var/lib/lxcsnaps/vm1/snap0/rootfs
ID 1147 gen 453 top level 5 path var/lib/lxc/vm1/rootfs
--- snip ---
root # lxc-clone -B btrfs -s vm1 vm2
Created container vm2 as snapshot of vm1
root # btrfs sub list /
--- snip ---
ID 1144 gen 448 top level 1136 path var/lib/lxcsnaps/vm1/snap0/rootfs
ID 1147 gen 455 top level 5 path var/lib/lxc/vm1/rootfs
ID 1148 gen 455 top level 5 path var/lib/lxc/vm2/rootfs
--- snip ---

Cgroups control

Get or set the value of a state object (for example, 'cpuset.cpus') in the container's cgroup for the corresponding subsystem.

• TODO

Managing devices

• TODO

Monitoring containers

There is a utility lxc-top that shows some basic information about running containers.

root # lxc-top
Container            CPU      CPU      CPU      BlkIO        Mem
Name                Used      Sys     User      Total       Used
vm1                 3.16     3.00     0.95   13.05 MB   12.70 MB
vm2                 0.14     0.06     0.10    0.00     372.00 KB
vm3                 3.39     2.09     1.98  868.00 KB    1.44 MB
vm4                 3.15     2.01     1.71    0.00     912.00 KB
TOTAL (4 )          9.84     7.16     4.74   13.89 MB   15.40 MB

Web GUI

There are a few web GUIs available for LXC. LXC-Web-Panel is a simple one that does the work good. You can get it from https://github.com/trick77/LXC-Web-Panel (it is a fork of LXC-Web-Panel from https://github.com/lxc-webpanel/LXC-Web-Panel, but supports LXC 1.0). You need flask (dev-python/flask).

root # emerge -av flask
These are the packages that would be merged, in order:

Calculating dependencies... done!
[ebuild  N     ] dev-python/blinker-1.3-r1000  USE="-doc {-test}" PYTHON_ABIS="2.7 3.3 -2.6 -2.7-jython -2.7-pypy-2.0 -3.1 -3.2 -3.4 (-3.5)" 90 kB
[ebuild  N     ] dev-python/werkzeug-0.9.6-r1000  USE="-redis" PYTHON_ABIS="2.7 3.3 -2.6 -2.7-jython -2.7-pypy-2.0 -3.4 (-3.5)" 1,102 kB
[ebuild  N     ] dev-python/itsdangerous-0.24-r1000  USE="-doc" PYTHON_ABIS="2.7 3.3 -2.6 -2.7-jython -2.7-pypy-2.0 -3.1 -3.2 -3.4 (-3.5)" 46 kB
[ebuild  N     ] dev-python/markupsafe-0.23-r1000  PYTHON_ABIS="2.7 3.3 -2.6 -2.7-jython -2.7-pypy-2.0 -3.1 -3.2 -3.4 (-3.5)" 14 kB
[ebuild  N     ] dev-python/jinja-2.7.3-r1000  USE="-doc -examples -i18n -vim-syntax" PYTHON_ABIS="2.7 3.3 -2.6 -2.7-jython -2.7-pypy-2.0 -3.1 -3.2 -3.4 (-3.5)" 370 kB
[ebuild  N     ] dev-python/flask-0.10.1-r1000  USE="-doc -examples" PYTHON_ABIS="2.7 3.3 -2.6 -2.7-jython -2.7-pypy-2.0 -3.4 (-3.5)" 532 kB

Total: 6 packages (6 new), Size of downloads: 2,152 kB

Would you like to merge these packages? [Yes/No] 

root # git clone https://github.com/trick77/LXC-Web-Panel
root # cd LXC-Web-Panel
root # python lwp.py

Summary

LXC is a very powerful virtualization technology, in Linux it is one of many to choose from and that is nice. LXC works off the host's existing vanilla kernel, thanks to functionality called cgroups that was merged into the Linux kernel v2.6.24. This allows operating system-level virtualization, and the ability to run multiple isolated Linux systems in "containers" -- a lightweight version of virtual machines (VM).