On Sun, Aug 01, 2010 at 06:09:17PM +0800, Jeff Jansen wrote: > Is it possible/safe to run vservers from different locations on the > host's hard drive? > My understanding from the docs > (http://linux-vserver.org/Secure_chroot_Barrier for one) is that the > "setattr --barrier" command has to be run on the directory where > the vservers "vdir" is located. So if my vservers are located in > "/vservers/", then I run "setattr --barrier /vservers" and that > "protects" all the vservers located there. that is, why I _always_ tell folks that the barrier should go on /path/to/guest/.. but the problem there is that folks either respond with, ah, so I have to set it on '/path/to' or get completely confused and simply remove the '..' setting it on the guest dir (/path/to/guest) which basically disables the guest :) > I've always run ALL the vservers from the same location and so > this has never been an issue. But many of the comments on the high > availability thread have made me wonder about the ease and safety of > running different vservers from different locations. > So I have two questions. > 1. What if each vserver "vdir" is its own LVM partition which will > be mounted to a directory in /vservers when needed. So before I > run my "mail" vserver, I have to run "mount /dev/VSERVERS/MAIL > /vservers/mail". you mount the lvm, and do setattr --barrier /vservers/mail/.. note that you can mount inside the guest configs fstab and do not 'need' to mount the lvm _brefore_ starting the guest > Is the /vservers/mail directory still protected? the directory right above /vservers/mail is protected, which is the point of the barrier > Do I need to do anything else like set the barrier > inside the vserver before I start it? nope, wouldn't work anyway, barrier ops are not allowed inside a guest ... > 2. What if I want to run vservers off of two LVM partitions, let's say > "/vservers1" and "/vservers2", so they could be mounted on different > cluster nodes. So my mail vserver might be at "/vservers1/mail" > while my web vserver is "/vservers2/www". same as above, after mounting, you do setattr --barrier /vservers/mail/.. setattr --barrier /vservers/www/.. > Do I need to run "setattr --barrier /vservers1" AFTER the LVM is > mounted, or is it enough to run it at boot time (before the LVM is > mounted? you want to run it with the full filesystem the guest will see in place, although this usually gives the same results than without the mounts > Assuming that "works", then can I simply set "/etc/vservers/mail/vdir" > to point to "/vservers1/mail" and everything works or is there > anywhere else I need to set this vserver's vdir. yep, that works, there is even an option when you build new guests to place them in any directory you like ... HTC, Herbert > TIA > Jeff Jansen