On Tue, 18 Feb 2014 14:00:04 -0500 Ted Barnes <madogdevelopment@gmail.com> wrote: > Hi All: > > I'm starting to explore "hashify", and have a number of questions > (sorry, this is long but am hoping to gain a good understanding if > possible). If there is a link that answers these, please let me know > (the links I've found are short and I'm unsure if they are "current")? > I'm running Wheezy host and guests, with Mate on the guests. Thanks! i'm running a wheezy host with a mix of past and present debian guests and have used hashify for years (going back several debian releases on the host). > 1) Hashify advantages > > Are the advantages of using hashified guests a) saving disk space and b) > performance (e.g., restarting a guest will be faster)? hashifying guests saves disk (due to hard links) and memory (again, due to hard links). if you have multiple similar guests (eg wheezy), then there will be redundant files between them. wouldn't it be great if you could have each guest point to a single copy of the file (ie used disk space = size of file), instead of each guest having it's own copy (ie used disk space = size of file * number of guests). that's what hashifying does for you. another benefit is that only one copy of files (ie text/code sections of executables and shared libraries) need to be loaded into memory, despite the same files being used in multiple guests. i have a guest for each web application with each of those guests running a supporting web server. if a single web server instance (running within a single guest) takes 50 MiB of memory, then that web server running in 10 guests will consume 500 MiB without hashifying, but only 50 MiB with hashifying. (okay, i admit that's an over-simplification as you have to account for each instance's data, stack, and heap, not just text/code sections, which won't be shared between instances and does consume memory based on number of guests.) hashifying is what keeps me on linux-vserver and off lxc. may i recommend you search the web for the following terms to deepen your understanding of hashifying by knowing the underlying principles. * "posix hard link" * "memory page text data copy on write" > 2) Set up steps - are these the "current" right ones to use? Does the > error I get matter? > > Per > "http://linux-vserver.org/Frequently_Asked_Questions#What_is_vhashify.3F", > I used the following steps. > > On Host: > > mkdir /etc/vservers/.defaults/apps/vunify/hash /vservers/.hash > ln -s /vservers/.hash /etc/vservers/.defaults/apps/vunify/hash/root > > On Guest: > > mkdir /etc/vservers/<vservername>/apps/vunify > vserver name-of-guest hashify yes, those are the steps for both the host and the guest to enable hashifying based on my personal notes. > Note: when I run the hashify command, I get "Duplicate hash-dir entry > '00' found" which I do not believe prevents the hashify process from > completing, but should I worry about this message? see q&a #5 of the vhashify mini faq [1] to help you identify and correct the problem. [1] http://linux-vserver.org/util-vserver:Vhashify#Mini_FAQ > 3) Cloning a hashified guest > - If I clone a hashified guest, should the cloning process go faster > than "regular" cloning, or should it be roughly the same? > > - Are the cloning commands the same (e.g., vserver vserver5 build -m > clone --hostname vserver5.mydomain.com --interface eth0:192.168.1.14/24 > -- --source /vservers/vserver4)? > > - Once the cloning of a hashified guest is complete, is that clone > hashified? My take is "no" and I need to run the hashify command > against the new clone i know nothing about cloning. i don't make many vserver guests, so when i do make one, i make it from scratch (ie "vserver <name> build -m debootstrap"), hashify, and restart. > - Is there command to show if a guest is hashified or not? ls -l /vservers/*/bin/bash if link count (ie second column between permissions and owner) is greater than 1, then they're hashified (unless /bin/bash is directly or indirectly excluded by configuration; see below). > - Is there an "undo" short of going in and deleting links? I'm not sure > why I'd want this, but was curious. hashified files can be unlinked by copying the file, deleting the original, and renaming the copy back to the original (or writing the copy to the original and deleting the copy). that's a brute force method and there might be something smarter. > 4) If hashified guest were compromised... > > If a hashfied guest were compromised with malware, and the attacker got > to root on the guest, would a reboot put the guest's system files back > in order? Or could the guest's hashified files still be compromised > (assuming the attacker had not seized control of the host)? no. hashifying has nothing to do with file persistence within a guest. even though each guest's files are hard linked to other guests' files, the malware's damage would be contained to the compromised guest because of the copy-on-write semantics of hashified files. when a vserver's hashified file is written to, the kernel makes a copy of the file for that vserver and the write applies to that vserver's copy and not the hard link all other vservers are pointing to. note: this is a unique feature of linux-vserver and does not apply to hard links in general. > 5) I intend to put /home in one Logical Volume, and put "/everything > else" in another logical volume. I assume at the end of the day I only > want to hashify the "/everthing else". Is that right? Given that the > "vserver guestname hashify" command appears to hashify the entire > vserver guest, is there a command alternative I could use? "vserver <name> hashify" is configured by: * /usr/lib/util-vserver/defaults/vunify-exclude (or where ever your installation of util-vserver places that file) * /etc/vservers/<vserver>/apps/vunify/exclude i usually start with "cp -av /usr/lib/util-vserver/defaults/vunify-exclude /etc/vservers/<vserver>/apps/vunify/exclude" and then modify /etc/vservers/<vserver>/apps/vunify/exclude to suit my need. see q&a #4 of the vhashify mini faq [2] to help you understand the syntax of the exclude file. [2] http://linux-vserver.org/util-vserver:Vhashify#Mini_FAQ > 6) Updates > > My understanding is after updating each guest, I would need to > re-hashify them all - is that correct? yes. i hashify my guests once a day automatically to alleviate me having to remember. > Again, apologize this is long - any help appreciated! hth. corey -- undefined@pobox.com