Subject: Re: [vserver] ubuntu 10.04 as a guest
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Tue, 8 Mar 2011 16:35:52 +0100

On Tue, Mar 08, 2011 at 01:57:37PM +0000, Wojciech Giel wrote:
> Hi Herbert,

> On 08/03/11 12:33, Herbert Poetzl wrote:
> >for portmapper, make sure that you do not run an unrestricted
> >portmapper on the host, as it will bind to all IPs including
> >the guest IPs, which in turn will keep the guest's portmapper
> >from even starting ...

> I'm running on host and on guests portmapper with -i 127.0.0.1 also
> tried with specific ip address .

recent distros usually use rpcbind, sure that it is portmapper
you are running on host and guest? (rpcbind needs -h)

> >for the nfs(d) part, you want to go for an userspace nfsd not
> >the kernel nfsd, as a guest is not permitted to load and/or
> >access kernel modules

> I just want to use nfs client and autofs on guest as I'm using now on 
> ubuntu server 8.04.

why inside the guest? wouldn't autofs from outside the guest
work just fine for you as well?

>>> bcapabilites and ccapablilites have proper flags. but can't mount
>>> with locking I get this error.
  
>> define proper :)

> I'm using these setting on ubuntu server 8.04 and everything is working 
> fine while on 10.4 is not.

> cat bcapabilities
> SYS_ADMIN
> CAP_SYS_RAWIO
> CAP_MKNOD
> CAP_SYS_ADMIN
> CAP_IPC_LOCK
> CAP_IPC_OWNER

> cat ccapabilities
> SECURE_MOUNT
> SECURE_REMOUNT
> BINARY_MOUNT

you are aware that you give the guest(s) everything to mess
up your host pretty well and your actual protection is so
weak that any accident/incident on the guest will probably 
kill the host as well?

>>> mount.nfs: rpc.statd is not running but is required for remote locking.
>>> mount.nfs: Either use '-o nolock' to keep locks local, or start statd.

assuming that you did start statd _inside_ the guest and
that it managed to bind to portmap/rpcbind, did you make
sure to restrict that as well on the host?

>> this sounds more like you are trying to mount an nfs volume
>> inside the guest, but without context it's hard to tell ...

> yes. I want use nfs on guest. each developer has a VServer guest, home 
> directories are mounted from central storage. Developers are now asking 
> for more modern software. I'm trying to prepare environment (newer lts 
> version of ubuntu server).

as I said above, I'd use propagating namespaces and autofs
on the host to map the 'various' nfs mounts into the guests
but of course YMMV

best,
Herbert

> thanks for response
> Wojciech
> 
> 
> -- 
> wojciech.giel@cimr.cam.ac.uk
> JDRF/WT Diabetes and Inflammation Laboratory (DIL)
> Cambridge Institute for Medical Research (CIMR)
> University of Cambridge
> Wellcome Trust/MRC Building
> Addenbrooke's Hospital Hills Road Cambridge CB2 0XY
> Tel: 01223 763228