Subject: Re: [vserver] Vservers on Slackware
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Sun, 24 Aug 2008 20:00:19 +0200

On Sun, Aug 24, 2008 at 07:49:39PM +0200, Laurens Vets wrote:
> >>I wrote a document a while back on how to install vservers on Slackware 
> >>and was wondering whether the procedure I used is correct or whether I 
> >>forgot something or ...  Anyways, it's a rather large mail so hopefully 
> >>you won't get bored :)
> >
> >not reading the mail in deep detail, just skimming 
> >over and dropping a few comments :)
> >
> >>You will need a kernel which has been patched to work with 
> >>Linux-VServer and the util-vserver software. I?ve created a couple of 
> >>simple scripts to aid in setting up minimal Slackware guests: 
> >>http://www.cilinder.be/slackware/svs-0.1.tar.gz.
> >>
> >>Next, you will need the util-vserver tools which are the Linux-VServer 
> >>userland tools. You can download my Slackware 12 package here: 
> >>util-vserver-0.30.214-i486-1tfx.tgz. Install via the normal Slackware 
> >>method ("installpkg util-vserver-0.30.214-i486-1tfx.tgz").
> >>
> >>We start by creating a template. I?ve based my list of installed 
> >>packages on the Linux from Slack and Minimal System pages on 
> >>Slackwiki.org. You can find the list of packages that will be installed 
> >
> >sounds good, can they be installed via network?
> 
> Well, the collection of scripts I made (svs, see further down), take 
> care of the downloading and isntalling the needed Slackware packages.
> 
> >>in the template VServer in the svs scripts above (look for the 
> >>"vserver.list" file). Download the above scripts and extract them to a 
> >>local directory:
> >>
> >>$ wget http://www.cilinder.be/slackware/svs-0.1.tar.gz
> >>$ tar zxpvf svs-0.1.tar.gz
> >>
> >>The files get.sh, inst.sh and vserver.list should now be available in 
> >>your current working directory. Get.sh will fetch the necessary 
> >>packages from a Slackware mirror. Inst.sh will install the downloaded 
> >>packages to /vservers/template. The file vserver.list contains the 
> >>necessary packages for a minimal Slackware VServer. It?s probably a 
> >>good idea to change the Slackware mirror in the get.sh to something 
> >>that?s closer to your location.
> >
> >you might want to integrate that as a new build
> >method (-m slackware) into util-vserver, and 
> >I'm sure, if that can be done in a clean way,
> >Daniel will happily add that to the next release
> 
> How can I accomplish this? Are there any example builds or is there
> any documentation I can check?

best, have a chat with Daniel Hokka Zakrisson
on the IRC channel (nick is daniel_hozac :)

> >>We?ll begin by fetching the necessary Slackware 12.0 packages with 
> >>get.sh:
> >>$ ./get.sh
> >>
> >>When this is done, there will be a new directory "slackware" in your 
> >>current working directory with a bunch of packages. For the next part, 
> >>you?ll have to become root. When you are, run inst.sh:
> >># ./inst.sh
> >>
> >>This will install the above downloaded packages in /vservers/template 
> >>which will become our template directory for future Slackware VServers. 
> >>Next, descent in the directory /vservers/template/dev and remove the 
> >>devices listed there:
> >># cd /vservers/template/dev/
> >># rm -Rf *
> >>
> >>We will also have to create a System V initialization script in 
> >>/vservers/template/etc/init.d/:
> >
> >does it use something different than sysv?
> >if so, is it kind-of runlevel based?
> >if not, does the 'plain' style work for it?
> 
> Yes, Slackware uses a BSD-style init.
> 
> >># vi /vservers/template/etc/init.d/rc
> >>
> >>Add the following in the above file:
> >>if [ $1 -eq 3 ]; then
> >>  echo "entering runlevel 3: multi";
> >>  /etc/rc.d/rc.M
> >>fi
> >>if [ $1 -eq 6 ]; then
> >>  echo "entering runlevel 6: reboot";
> >>  /etc/rc.d/rc.6
> >>fi
> >>if [ $1 -eq 0 ]; then
> >>  echo "entering runlevel 0: shutdown";
> >>  /etc/rc.d/rc.0
> >>fi
> >>if [ $1 -eq 4 ]; then
> >>  echo "entering runlevel 4";
> >>fi
> >>if [ $1 -eq 5 ]; then
> >>  echo "entering runlevel 5";
> >>fi
> >>if [ $1 -eq 1 ]; then
> >>  echo "entering runlevel 1:single";
> >>  /etc/rc.d/rc.K
> >>fi
> >>if [ $1 -eq 2 ]; then
> >>  echo "entering runlevel 2:multi";
> >>  /etc/rc.d/rc.M
> >>fi
> >>
> >>Don?t forget to give that file execution permissions otherwise it won?t 
> >>run when we start our VServer:
> >># chmod u+x /vservers/template/etc/init.d/rc
> >>
> >>After this is done, we will need to apply a patch (found here: 
> >>slack12.diff) which will disable the Slackware hardware related startup 
> >>scripts:
> >># cd /vservers/template
> >># wget http://www.cilinder.be/slackware/slack12.diff
> >># patch -p1 < slack12.diff
> >>
> >>We will also have to disable "/etc/rc.d/rc.inet1" from being run on 
> >>startup:
> >># chmod -x /vservers/template/etc/rc.d/rc.inet1
> >>
> >>The next command will create a new skeleton vserver under 
> >>/vservers/vserver1 with the necessary devices:
> >>
> >># NAME=vserver1
> >># INTERFACE=eth0:10.0.0.1/24
> >># CONTEXT=1000
> >># vserver ${NAME} build -m skeleton --context ${CONTEXT} --interface
> >>${INTERFACE} --flags 
> >>lock,virt_mem,virt_uptime,virt_cpu,virt_load,sched_hard,hide_netif
> >>--initstyle sysv
> >
> >you don't want to give all those flags, as
> >some of them are default anyway, and others
> >are left-overs from ancient times :)
> 
> For the flags, only lock seems to be needed?
> Also, what exactly does private do?  
> Does it prevent the root from the host system to enter the vserver?

http://linux-vserver.org/Capabilities_and_Flags

note that the flags tagged with 'L' are legacy
flags and you don't want them with Linux-VServer
2.0 or later (legacy means 1.x :)

> >>In the above example, change the NAME, INTERFACE and CONTEXT fiels to 
> >>whatever it needs to be on your machine. After that, you will have a 
> >>new directory /vserver/vserver1. Now we will copy our template 
> >>directory that newly created directory:
> >>
> >># cd /vservers/
> >># cp -a template/. vserver1/.
> >>
> >>At this point, our VServer should already be able to boot. We can test 
> >>this with:
> >># /usr/sbin/vserver vserver1 start
> >>
> >>You?ll probably see a lot of error messages, this is due to the 
> >>Slackware startup scripts that are executed in the VServer related to 
> >>configuring and starting hardware devices. I?m still working on a diff 
> >>to patch the template directory to remove those. When the VServer has 
> >>been booted, you can access it with:
> >># /usr/sbin/vserver vserver1 enter
> >>
> >>At this point you can start "netconfig" and start configuring your 
> >>newly created Slackware 12.0 VServer. It?s probably a good idea to have 
> >>a 'localhost' in your vserver. This can be achieved by creating a new 
> >>folder in /etc/vservers/${NAME}/interfaces/. Name the folder 1, if the 
> >>previous one that exists there is 0. Then create files named ?ip?, 
> >>?dev? and ?prefix? and write 127.0.0.1 to ip, lo to dev and 32 to 
> >>prefix:
> >
> >don't do that, it will break a lot of things
> >(and make your guest insecure)
> 
> How does it make the guest insecure?

well, the guest and the host will magically share
the loopback address now, and thus the guest will
be able to bind ports the host services are using,
and to receive data or even block service which
belong to the host

> >if you are with vs2.0-vs2.2, you want to change
> >/etc/hosts to contain something like
> >
> > <guest-ip> localhost localhost.localdomain
> >
> >if you are with vs2.3, enable the lback feature
> >and you'll get a private 127.0.0.1 for your guest
> 
> And how do I add the ip addresses or is adding them with 
> the "vserver build ..." command enough?

you can specify all the addresses at build time
or runtime or in the config

> >># mkdir /etc/vservers/${NAME}/interfaces/1/
> >># echo 127.0.0.1 > /etc/vservers/${NAME}/interfaces/1/ip
> >># echo 32 > /etc/vservers/${NAME}/interfaces/1/prefix
> >># echo lo > /etc/vservers/${NAME}/interfaces/1/dev
> >
> >again, don't do that if you do not exactly know
> >the implications
> >
> >>Vservers created this way work, but start with some bootup related 
> >>errors, probably related to Slackware startup scripts which are not yet 
> >>full corrected...
> >
> >you should probably remove _any_ network setup
> >from the guest's scripts, as they are not needed
> >anyway
> >
> >same gies for hardware related setups, like
> >hwclock, special drivers, etc
> 
> Ok, thank you!

best,
Herbert

> >>Did I miss something?  Does this all sound sane?
> >>
> >>Thanks for checking and making it this far :)