0
Virtualization which isnt LXC (Linux Containers)       Dobrica Pavlinušić        http://blog.rot13.org   DORS/CLUC, Zagreb...
Content●   Virtualizations    ●   Vserver, Xen, OpenVZ, sVirt, LXC    ●   KVM, VirtualBox, VMWare●   cgroup●   Linux Conta...
Virtualization overview●   Xen    ●   Separate host i guest kernel (dom0, domU)    ●   Not upstream, massive duplication o...
cgroup●   Process namespace in kernel    ●   Devices (even X11 in LXC!)    ●   CPU (sched, cpu account, cpuset) - NUMA    ...
Linux containers - LXCdpavlin@klin:~$ lxc-checkconfig                             dpavlin@klin:/usr/bin$ ls lxc-*Kernel co...
LXC: Network●   veth    ●   Bridge on host, (virtual) device inside container●   vlan    ●   Select packets by IP address●...
LXC: limit resources●   Cores    ●   lxc.cgroup.cpuset.cpus=1,2,3●   CPU share    ●   lxc.cgroup.cpu.shares=1024 # default...
Start LXC container●   Start single process in container    ●   lxc-execute -n container -- /bin/bash●   Whole operating s...
Templates: lxc-create# /usr/lib/lxc/templates/export MIRROR=http://192.168.1.20:3142/ftp.debian.orgexport SUITE=lennycat <...
Container overview●   /var/lib/lxc/container/config●   Familiar commands    ●   lxc-ls    ●   lxc-info    ●   lxc-ps    ● ...
Under construction●   Still not in: Linux 2.6.38.2●   lxc-attach    ●   Attach process (bash) inside running container    ...
LXC summary●   Isolate    ●   one application – lxc-execute    ●   whole OS – lxc-start●   use templates (lxc-create)●   F...
Upcoming SlideShare
Loading in...5
×

Virtualization which isn't: LXC (Linux Containers)

2,912

Published on

Published in: Technology
0 Comments
9 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total Views
2,912
On Slideshare
0
From Embeds
0
Number of Embeds
0
Actions
Shares
0
Downloads
85
Comments
0
Likes
9
Embeds 0
No embeds

No notes for slide

Transcript of "Virtualization which isn't: LXC (Linux Containers)"

  1. 1. Virtualization which isnt LXC (Linux Containers) Dobrica Pavlinušić http://blog.rot13.org DORS/CLUC, Zagreb, 2011-05-16
  2. 2. Content● Virtualizations ● Vserver, Xen, OpenVZ, sVirt, LXC ● KVM, VirtualBox, VMWare● cgroup● Linux Containers
  3. 3. Virtualization overview● Xen ● Separate host i guest kernel (dom0, domU) ● Not upstream, massive duplication of kernel code● Linux Vserver, OpenVZ (Virtuozzo), sVirt (SELinux based) ● Single kernel, out-of-tree patches● Linux Containers - LXC ● chroot on steroids, based on cgroup Linux support ● Part of standard kernel, based on things you already know!● Full-system virtualization: KVM, VirtualBox, VMWare ● But you can run LXC inside them! (e.g. EC2)
  4. 4. cgroup● Process namespace in kernel ● Devices (even X11 in LXC!) ● CPU (sched, cpu account, cpuset) - NUMA ● Memory (not in Debians kernel) ● Block I/O scheduling, limits● Linus 2.6.38 magic patch ● Setsid create new scheduler entry● Used by Google Chrome, systemd...
  5. 5. Linux containers - LXCdpavlin@klin:~$ lxc-checkconfig dpavlin@klin:/usr/bin$ ls lxc-*Kernel config /proc/config.gz not found, looking in other lxc-checkconfigplaces... lxc-executeFound kernel config file /boot/config-2.6.38-2-686 lxc-start--- Namespaces --- lxc-stopNamespaces: enabled lxc-infoUtsname namespace: enabledIpc namespace: enabled lxc-consolePid namespace: enabled lxc-createUser namespace: enabled lxc-destroyNetwork namespace: enabled lxc-lsMultiple /dev/pts instances: enabled lxc-ps lxc-netstat--- Control groups --- lxc-restartCgroup: enabled lxc-cgroupCgroup namespace: enabled lxc-freezeCgroup device: enabled lxc-killCgroup sched: enabled lxc-monitorCgroup cpu account: enabled lxc-setcapCgroup memory controller: missing lxc-setuidCgroup cpuset: enabled lxc-unfreeze lxc-unshare--- Misc ---Veth pair device: enabled lxc-versionMacvlan: enabled Lxc-waitVlan: enabled lxc-attachFile capabilities: missing lxc-checkpoint
  6. 6. LXC: Network● veth ● Bridge on host, (virtual) device inside container● vlan ● Select packets by IP address● macvlan ● Select packets by MAC address● phys ● Move host interface inside container (routing fun!)● Empty ● Only loopback
  7. 7. LXC: limit resources● Cores ● lxc.cgroup.cpuset.cpus=1,2,3● CPU share ● lxc.cgroup.cpu.shares=1024 # default● Memory usage (!Debian) ● lxc.cgroup.memory.limit_in_bytes = 256M ● lxc.cgroup.memory.memsw.limit_in_bytes = 1G● Disk (blkio) ● Disk space – standard LVM, quota... ● echo 100 > /cgroup/disk1/blkio.weight # XXX < 1000 ! ● echo "3:0 1048576" > /cgroup/disk1/blkio.throttle.read_bps_device
  8. 8. Start LXC container● Start single process in container ● lxc-execute -n container -- /bin/bash● Whole operating system ● Mounting filesystems, etc from config file ● Application is /bin/init ● lxc-start -n container ● lxc-console -n container ● lxc-stop -n container
  9. 9. Templates: lxc-create# /usr/lib/lxc/templates/export MIRROR=http://192.168.1.20:3142/ftp.debian.orgexport SUITE=lennycat <<_EOF_ > /tmp/lenny.conflxc.network.type=vethlxc.network.link=br0lxc.network.flags=upEOFt61p:~# lxc-create -n lenny -t debian -f /tmp/lenny.conf
  10. 10. Container overview● /var/lib/lxc/container/config● Familiar commands ● lxc-ls ● lxc-info ● lxc-ps ● lxc-netstat● htop --enable-group > r192● /proc inside contauner isnt fully isolated! ● Depends on namespace support in kernel
  11. 11. Under construction● Still not in: Linux 2.6.38.2● lxc-attach ● Attach process (bash) inside running container ● Needed to set default route outside container● lxc-checkpoint ● Similar to lxc-(un)freeze with checkpoint to disk ● https://ckpt.wiki.kernel.org/
  12. 12. LXC summary● Isolate ● one application – lxc-execute ● whole OS – lxc-start● use templates (lxc-create)● Familiar Linux networking (bridges)● Limiting features varies (kernel config/version)● Ready to use today!
  1. A particular slide catching your eye?

    Clipping is a handy way to collect important slides you want to go back to later.

×