Thanks Corey - what a great explanation - I so appreciate the time you put into it. Very much appreciate the "fast tracking" help! On 02/19/14 00:51, Corey Wright wrote: > On Tue, 18 Feb 2014 14:00:04 -0500 > Ted Barnes<madogdevelopment@gmail.com> wrote: > > >> Hi All: >> >> I'm starting to explore "hashify", and have a number of questions >> (sorry, this is long but am hoping to gain a good understanding if >> possible). If there is a link that answers these, please let me know >> (the links I've found are short and I'm unsure if they are "current")? >> I'm running Wheezy host and guests, with Mate on the guests. Thanks! >> > i'm running a wheezy host with a mix of past and present debian guests and > have used hashify for years (going back several debian releases on the host). > > >> 1) Hashify advantages >> >> Are the advantages of using hashified guests a) saving disk space and b) >> performance (e.g., restarting a guest will be faster)? >> > hashifying guests saves disk (due to hard links) and memory (again, due to > hard links). > > if you have multiple similar guests (eg wheezy), then there will be redundant > files between them. wouldn't it be great if you could have each guest point > to a single copy of the file (ie used disk space = size of file), instead of > each guest having it's own copy (ie used disk space = size of file * number > of guests). that's what hashifying does for you. > > another benefit is that only one copy of files (ie text/code sections of > executables and shared libraries) need to be loaded into memory, despite the > same files being used in multiple guests. i have a guest for each web > application with each of those guests running a supporting web server. if a > single web server instance (running within a single guest) takes 50 MiB of > memory, then that web server running in 10 guests will consume 500 MiB without > hashifying, but only 50 MiB with hashifying. (okay, i admit that's an > over-simplification as you have to account for each instance's data, stack, > and heap, not just text/code sections, which won't be shared between > instances and does consume memory based on number of guests.) > > hashifying is what keeps me on linux-vserver and off lxc. > > may i recommend you search the web for the following terms to deepen your > understanding of hashifying by knowing the underlying principles. > * "posix hard link" > * "memory page text data copy on write" > > >> 2) Set up steps - are these the "current" right ones to use? Does the >> error I get matter? >> >> Per >> "http://linux-vserver.org/Frequently_Asked_Questions#What_is_vhashify.3F", >> I used the following steps. >> >> On Host: >> >> mkdir /etc/vservers/.defaults/apps/vunify/hash /vservers/.hash >> ln -s /vservers/.hash /etc/vservers/.defaults/apps/vunify/hash/root >> >> On Guest: >> >> mkdir /etc/vservers/<vservername>/apps/vunify >> vserver name-of-guest hashify >> > yes, those are the steps for both the host and the guest to enable hashifying > based on my personal notes. > > >> Note: when I run the hashify command, I get "Duplicate hash-dir entry >> '00' found" which I do not believe prevents the hashify process from >> completing, but should I worry about this message? >> > see q&a #5 of the vhashify mini faq [1] to help you identify and correct the > problem. > > [1] http://linux-vserver.org/util-vserver:Vhashify#Mini_FAQ > > >> 3) Cloning a hashified guest >> - If I clone a hashified guest, should the cloning process go faster >> than "regular" cloning, or should it be roughly the same? >> >> - Are the cloning commands the same (e.g., vserver vserver5 build -m >> clone --hostname vserver5.mydomain.com --interface eth0:192.168.1.14/24 >> -- --source /vservers/vserver4)? >> >> - Once the cloning of a hashified guest is complete, is that clone >> hashified? My take is "no" and I need to run the hashify command >> against the new clone >> > i know nothing about cloning. i don't make many vserver guests, so when i do > make one, i make it from scratch (ie "vserver<name> build -m debootstrap"), > hashify, and restart. > > >> - Is there command to show if a guest is hashified or not? >> > ls -l /vservers/*/bin/bash > > if link count (ie second column between permissions and owner) is greater > than 1, then they're hashified (unless /bin/bash is directly or indirectly > excluded by configuration; see below). > > >> - Is there an "undo" short of going in and deleting links? I'm not sure >> why I'd want this, but was curious. >> > hashified files can be unlinked by copying the file, deleting the original, > and renaming the copy back to the original (or writing the copy to the > original and deleting the copy). that's a brute force method and there might > be something smarter. > > >> 4) If hashified guest were compromised... >> >> If a hashfied guest were compromised with malware, and the attacker got >> to root on the guest, would a reboot put the guest's system files back >> in order? Or could the guest's hashified files still be compromised >> (assuming the attacker had not seized control of the host)? >> > no. hashifying has nothing to do with file persistence within a guest. > > even though each guest's files are hard linked to other guests' files, the > malware's damage would be contained to the compromised guest because of the > copy-on-write semantics of hashified files. when a vserver's hashified file > is written to, the kernel makes a copy of the file for that vserver and the > write applies to that vserver's copy and not the hard link all other vservers > are pointing to. note: this is a unique feature of linux-vserver and does > not apply to hard links in general. > > >> 5) I intend to put /home in one Logical Volume, and put "/everything >> else" in another logical volume. I assume at the end of the day I only >> want to hashify the "/everthing else". Is that right? Given that the >> "vserver guestname hashify" command appears to hashify the entire >> vserver guest, is there a command alternative I could use? >> > "vserver<name> hashify" is configured by: > * /usr/lib/util-vserver/defaults/vunify-exclude (or where ever your > installation of util-vserver places that file) > * /etc/vservers/<vserver>/apps/vunify/exclude > > i usually start with "cp > -av /usr/lib/util-vserver/defaults/vunify-exclude /etc/vservers/<vserver>/apps/vunify/exclude" > and then modify /etc/vservers/<vserver>/apps/vunify/exclude to suit my need. > > see q&a #4 of the vhashify mini faq [2] to help you understand the syntax of > the exclude file. > > [2] http://linux-vserver.org/util-vserver:Vhashify#Mini_FAQ > > >> 6) Updates >> >> My understanding is after updating each guest, I would need to >> re-hashify them all - is that correct? >> > yes. > > i hashify my guests once a day automatically to alleviate me having to > remember. > > >> Again, apologize this is long - any help appreciated! >> > hth. > > corey > -- > undefined@pobox.com >