Subject: Re: [vserver] Hashify Questions
From: Corey Wright <undefined@pobox.com>
Date: Tue, 18 Feb 2014 23:51:55 -0600

On Tue, 18 Feb 2014 14:00:04 -0500
Ted Barnes <madogdevelopment@gmail.com> wrote:

> Hi All:
> 
> I'm starting to explore "hashify", and have a number of questions 
> (sorry, this is long but am hoping to gain a good understanding if 
> possible).  If there is a link that answers these, please let me know 
> (the links I've found are short and I'm unsure if they are "current")?   
> I'm running Wheezy host and guests, with Mate on the guests.  Thanks!

i'm running a wheezy host with a mix of past and present debian guests and
have used hashify for years (going back several debian releases on the host).

> 1)  Hashify advantages
> 
> Are the advantages of using hashified guests a) saving disk space and b) 
> performance (e.g., restarting a guest will be faster)?

hashifying guests saves disk (due to hard links) and memory (again, due to
hard links).

if you have multiple similar guests (eg wheezy), then there will be redundant
files between them.  wouldn't it be great if you could have each guest point
to a single copy of the file (ie used disk space = size of file), instead of
each guest having it's own copy (ie used disk space = size of file * number
of guests).  that's what hashifying does for you.

another benefit is that only one copy of files (ie text/code sections of
executables and shared libraries) need to be loaded into memory, despite the
same files being used in multiple guests.  i have a guest for each web
application with each of those guests running a supporting web server.  if a
single web server instance (running within a single guest) takes 50 MiB of
memory, then that web server running in 10 guests will consume 500 MiB without
hashifying, but only 50 MiB with hashifying.  (okay, i admit that's an
over-simplification as you have to account for each instance's data, stack,
and heap, not just text/code sections, which won't be shared between
instances and does consume memory based on number of guests.)

hashifying is what keeps me on linux-vserver and off lxc.

may i recommend you search the web for the following terms to deepen your
understanding of hashifying by knowing the underlying principles.
 * "posix hard link"
 * "memory page text data copy on write"

> 2)  Set up steps - are these the "current" right ones to use?  Does the 
> error I get matter?
> 
> Per 
> "http://linux-vserver.org/Frequently_Asked_Questions#What_is_vhashify.3F", 
> I used the following steps.
> 
> On Host:
> 
> mkdir /etc/vservers/.defaults/apps/vunify/hash /vservers/.hash
> ln -s /vservers/.hash /etc/vservers/.defaults/apps/vunify/hash/root
> 
> On Guest:
> 
> mkdir /etc/vservers/<vservername>/apps/vunify
> vserver name-of-guest hashify

yes, those are the steps for both the host and the guest to enable hashifying
based on my personal notes.

> Note:  when I run the hashify command, I get "Duplicate hash-dir entry 
> '00' found" which I do not believe prevents the hashify process from 
> completing, but should I worry about this message?

see q&a #5 of the vhashify mini faq [1] to help you identify and correct the
problem.

[1] http://linux-vserver.org/util-vserver:Vhashify#Mini_FAQ

> 3)  Cloning a hashified guest
> - If I clone a hashified guest, should the cloning process go faster 
> than "regular" cloning, or should it be roughly the same?
> 
> - Are the cloning commands the same (e.g., vserver vserver5 build -m 
> clone --hostname vserver5.mydomain.com --interface eth0:192.168.1.14/24 
> -- --source /vservers/vserver4)?
> 
> - Once the cloning of a hashified guest is complete, is that clone 
> hashified?  My take is "no" and I need to run the hashify command 
> against the new clone

i know nothing about cloning.  i don't make many vserver guests, so when i do
make one, i make it from scratch (ie "vserver <name> build -m debootstrap"),
hashify, and restart.

> - Is there command to show if a guest is hashified or not?

ls -l /vservers/*/bin/bash

if link count (ie second column between permissions and owner) is greater
than 1, then they're hashified (unless /bin/bash is directly or indirectly
excluded by configuration; see below).

> - Is there an "undo" short of going in and deleting links?  I'm not sure 
> why I'd want this, but was curious.

hashified files can be unlinked by copying the file, deleting the original,
and renaming the copy back to the original (or writing the copy to the
original and deleting the copy).  that's a brute force method and there might
be something smarter.

> 4)  If hashified guest were compromised...
> 
> If a hashfied guest were compromised with malware, and the attacker got 
> to root on the guest, would a reboot put the guest's system files back 
> in order?  Or could the guest's hashified files still be compromised 
> (assuming the attacker had not seized control of the host)?

no.  hashifying has nothing to do with file persistence within a guest.

even though each guest's files are hard linked to other guests' files, the
malware's damage would be contained to the compromised guest because of the
copy-on-write semantics of hashified files.  when a vserver's hashified file
is written to, the kernel makes a copy of the file for that vserver and the
write applies to that vserver's copy and not the hard link all other vservers
are pointing to.  note: this is a unique feature of linux-vserver and does
not apply to hard links in general.

> 5)  I intend to put /home in one Logical Volume, and put "/everything 
> else" in another logical volume.  I assume at the end of the day I only 
> want to hashify the "/everthing else".  Is that right?  Given that the 
> "vserver guestname hashify" command appears to hashify the entire 
> vserver guest, is there a command alternative I could use?

"vserver <name> hashify" is configured by:
 * /usr/lib/util-vserver/defaults/vunify-exclude (or where ever your
installation of util-vserver places that file)
 * /etc/vservers/<vserver>/apps/vunify/exclude

i usually start with "cp
-av /usr/lib/util-vserver/defaults/vunify-exclude /etc/vservers/<vserver>/apps/vunify/exclude"
and then modify /etc/vservers/<vserver>/apps/vunify/exclude to suit my need.

see q&a #4 of the vhashify mini faq [2] to help you understand the syntax of
the exclude file.

[2] http://linux-vserver.org/util-vserver:Vhashify#Mini_FAQ

> 6)  Updates
> 
> My understanding is after updating each guest, I would need to 
> re-hashify them all - is that correct?

yes.

i hashify my guests once a day automatically to alleviate me having to
remember.

> Again, apologize this is long - any help appreciated!

hth.

corey
--
undefined@pobox.com