Subject: Re: [vserver] running vservers from different locations
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Sun, 1 Aug 2010 15:30:49 +0200

On Sun, Aug 01, 2010 at 06:09:17PM +0800, Jeff Jansen wrote:
> Is it possible/safe to run vservers from different locations on the
> host's hard drive?

> My understanding from the docs
> (http://linux-vserver.org/Secure_chroot_Barrier for one) is that the
> "setattr --barrier" command has to be run on the directory where
> the vservers "vdir" is located. So if my vservers are located in
> "/vservers/", then I run "setattr --barrier /vservers" and that
> "protects" all the vservers located there.

that is, why I _always_ tell folks that the barrier should
go on /path/to/guest/.. but the problem there is that folks
either respond with, ah, so I have to set it on '/path/to'
or get completely confused and simply remove the '..' setting
it on the guest dir (/path/to/guest) which basically disables
the guest :)

> I've always run ALL the vservers from the same location and so
> this has never been an issue. But many of the comments on the high
> availability thread have made me wonder about the ease and safety of
> running different vservers from different locations.

> So I have two questions.

> 1. What if each vserver "vdir" is its own LVM partition which will
> be mounted to a directory in /vservers when needed. So before I
> run my "mail" vserver, I have to run "mount /dev/VSERVERS/MAIL
> /vservers/mail". 

you mount the lvm, and do 
 setattr --barrier /vservers/mail/..

note that you can mount inside the guest configs fstab and
do not 'need' to mount the lvm _brefore_ starting the guest

> Is the /vservers/mail directory still protected?  

the directory right above /vservers/mail is protected, which
is the point of the barrier

> Do I need to do anything else like set the barrier
> inside the vserver before I start it?

nope, wouldn't work anyway, barrier ops are not allowed
inside a guest ...

> 2. What if I want to run vservers off of two LVM partitions, let's say
> "/vservers1" and "/vservers2", so they could be mounted on different
> cluster nodes. So my mail vserver might be at "/vservers1/mail"
> while my web vserver is "/vservers2/www". 

same as above, after mounting, you do
 setattr --barrier /vservers/mail/..
 setattr --barrier /vservers/www/..

> Do I need to run "setattr --barrier /vservers1" AFTER the LVM is
> mounted, or is it enough to run it at boot time (before the LVM is
> mounted?

you want to run it with the full filesystem the guest will
see in place, although this usually gives the same results
than without the mounts

> Assuming that "works", then can I simply set "/etc/vservers/mail/vdir"
> to point to "/vservers1/mail" and everything works or is there
> anywhere else I need to set this vserver's vdir.

yep, that works, there is even an option when you build
new guests to place them in any directory you like ...

HTC,
Herbert

> TIA
> Jeff Jansen