Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| tools:lxc [2022/09/01 22:19] – [Networking] darron | tools:lxc [2024/10/24 00:19] (current) – [Setup] darron | ||
|---|---|---|---|
| Line 2: | Line 2: | ||
| Linux containers (LXC) is the Linux implementation of FreeBSD Jails. | Linux containers (LXC) is the Linux implementation of FreeBSD Jails. | ||
| - | |||
| - | This page mostly covers usage in debian, however, due to limitations | ||
| - | there it's best to adapt this to ubuntu instead. Only minor differences | ||
| - | exist and they are not mentioned. | ||
| Within a Linux container we can run a self-contained installation of Linux | Within a Linux container we can run a self-contained installation of Linux | ||
| Line 16: | Line 12: | ||
| < | < | ||
| - | apt-get install lxc lxc-templates bridge-utils cgroupfs-mount conntrack iptables | + | apt-get install lxc lxc-templates bridge-utils cgroupfs-mount conntrack iptables |
| / | / | ||
| </ | </ | ||
| Line 35: | Line 31: | ||
| ==systemd== | ==systemd== | ||
| < | < | ||
| + | systemctl stop lxc-monitord.service | ||
| + | systemctl disable lxc-monitord.service | ||
| + | systemctl mask lxc-monitord.service | ||
| systemctl disable lxc-net.service | systemctl disable lxc-net.service | ||
| systemctl disable lxc.service | systemctl disable lxc.service | ||
| Line 42: | Line 41: | ||
| < | < | ||
| - | sed -i ' | + | sed -i ' |
| - | sed -i ' | + | sed -i ' |
| </ | </ | ||
| Line 82: | Line 81: | ||
| < | < | ||
| - | #!/bin/sh | + | #! /bin/sh |
| - | PATH=/sbin | + | PATH=/sbin:/ |
| iptables -t filter -F | iptables -t filter -F | ||
| Line 89: | Line 88: | ||
| iptables -t raw -F | iptables -t raw -F | ||
| iptables -t nat -F | iptables -t nat -F | ||
| - | /usr/sbin/conntrack -F | + | conntrack -F |
| # raw: | # raw: | ||
| Line 139: | Line 138: | ||
| < | < | ||
| + | mkdir -p / | ||
| wget " | wget " | ||
| - | wget " | ||
| gpg --no-default-keyring --keyring / | gpg --no-default-keyring --keyring / | ||
| + | wget " | ||
| gpg --no-default-keyring --keyring / | gpg --no-default-keyring --keyring / | ||
| </ | </ | ||
| Line 156: | Line 156: | ||
| lxc-create -n terminator -t debian -- -r bullseye -a armhf | lxc-create -n terminator -t debian -- -r bullseye -a armhf | ||
| </ | </ | ||
| - | === Configure === | ||
| - | ==/ | + | Install bookworm (32-bit) |
| - | + | ||
| - | __Obsolete Debian template__ | + | |
| < | < | ||
| - | # Template used to create this container: / | + | lxc-create -n cracker -t debian |
| - | # Parameters passed to the template: | + | |
| - | # For additional config options, please look at lxc.container.conf(5) | + | |
| - | lxc.rootfs = / | + | |
| - | + | ||
| - | # Common configuration | + | |
| - | lxc.include = / | + | |
| - | + | ||
| - | # Container specific configuration | + | |
| - | lxc.mount = / | + | |
| - | lxc.utsname = HOSTNAME | + | |
| - | lxc.arch = amd64 | + | |
| - | + | ||
| - | # Network | + | |
| - | lxc.network.type = veth | + | |
| - | lxc.network.flags = up | + | |
| - | + | ||
| - | # that's the interface defined above in host's interfaces file | + | |
| - | lxc.network.link = lxcbr0 | + | |
| - | + | ||
| - | # name of network device inside the container, | + | |
| - | # defaults to eth0, you could choose a name freely | + | |
| - | lxc.network.name = lxcnet0 | + | |
| - | + | ||
| - | lxc.network.hwaddr = 00: | + | |
| - | lxc.network.veth.pair = veth1 | + | |
| - | + | ||
| - | # the ip may be set to 0.0.0.0/24 or skip this line | + | |
| - | # if you like to use a dhcp client inside the container | + | |
| - | lxc.network.ipv4 = 10.10.10.10/ | + | |
| - | + | ||
| - | # define a gateway to have access to the internet | + | |
| - | lxc.network.ipv4.gateway = 10.10.10.1 | + | |
| - | + | ||
| - | # Autostart | + | |
| - | lxc.start.auto = 1 | + | |
| - | lxc.start.delay = 5 | + | |
| - | lxc.start.order = 100 | + | |
| </ | </ | ||
| + | === Configure === | ||
| - | __Modern Debian template__ | + | ==/ |
| < | < | ||
| Line 285: | Line 246: | ||
| some user ids to map to the container then configure it. | some user ids to map to the container then configure it. | ||
| - | This has been tested to work Ubuntu vivid. It failed to operate on Debian | + | This has been tested to work Ubuntu vivid and nothing else since. |
| - | at this time due to set up of /dev within the container | + | |
| When assigning a range of ids to the root user. Choose what is available, here i | When assigning a range of ids to the root user. Choose what is available, here i | ||
| chose 200000 because this was free. | chose 200000 because this was free. | ||
| + | |||
| < | < | ||
| usermod --add-subuids 200000-265535 root | usermod --add-subuids 200000-265535 root | ||
| Line 310: | Line 271: | ||
| Now we can start and stop the container, attach to it, etc. | Now we can start and stop the container, attach to it, etc. | ||
| + | ===Runit=== | ||
| + | Start container and login as root | ||
| + | < | ||
| + | lxc-start -F -n container | ||
| + | </ | ||
| + | |||
| + | Install runit. It will ask you to enter a phrase and after installation reboot. | ||
| + | |||
| + | < | ||
| + | apt install runit-init | ||
| + | reboot | ||
| + | </ | ||
| + | |||
| + | or | ||
| + | |||
| + | < | ||
| + | apt-get install runit runit-run runit-systemd | ||
| + | </ | ||
| + | |||
| + | Login to tidy up. | ||
| + | |||
| + | < | ||
| + | lxc-attach -n container | ||
| + | cd / | ||
| + | rm getty-tty* | ||
| + | </ | ||
| + | |||
| + | ===Apt=== | ||
| + | |||
| + | < | ||
| + | sed -i ' | ||
| + | </ | ||
