On Sun, Aug 01, 2010 at 06:09:17PM +0800, Jeff Jansen wrote:
> Is it possible/safe to run vservers from different locations on the
> host's hard drive?
> My understanding from the docs
> (http://linux-vserver.org/Secure_chroot_Barrier for one) is that the
> "setattr --barrier" command has to be run on the directory where
> the vservers "vdir" is located. So if my vservers are located in
> "/vservers/", then I run "setattr --barrier /vservers" and that
> "protects" all the vservers located there.
that is, why I _always_ tell folks that the barrier should
go on /path/to/guest/.. but the problem there is that folks
either respond with, ah, so I have to set it on '/path/to'
or get completely confused and simply remove the '..' setting
it on the guest dir (/path/to/guest) which basically disables
the guest :)
> I've always run ALL the vservers from the same location and so
> this has never been an issue. But many of the comments on the high
> availability thread have made me wonder about the ease and safety of
> running different vservers from different locations.
> So I have two questions.
> 1. What if each vserver "vdir" is its own LVM partition which will
> be mounted to a directory in /vservers when needed. So before I
> run my "mail" vserver, I have to run "mount /dev/VSERVERS/MAIL
> /vservers/mail".
you mount the lvm, and do
setattr --barrier /vservers/mail/..
note that you can mount inside the guest configs fstab and
do not 'need' to mount the lvm _brefore_ starting the guest
> Is the /vservers/mail directory still protected?
the directory right above /vservers/mail is protected, which
is the point of the barrier
> Do I need to do anything else like set the barrier
> inside the vserver before I start it?
nope, wouldn't work anyway, barrier ops are not allowed
inside a guest ...
> 2. What if I want to run vservers off of two LVM partitions, let's say
> "/vservers1" and "/vservers2", so they could be mounted on different
> cluster nodes. So my mail vserver might be at "/vservers1/mail"
> while my web vserver is "/vservers2/www".
same as above, after mounting, you do
setattr --barrier /vservers/mail/..
setattr --barrier /vservers/www/..
> Do I need to run "setattr --barrier /vservers1" AFTER the LVM is
> mounted, or is it enough to run it at boot time (before the LVM is
> mounted?
you want to run it with the full filesystem the guest will
see in place, although this usually gives the same results
than without the mounts
> Assuming that "works", then can I simply set "/etc/vservers/mail/vdir"
> to point to "/vservers1/mail" and everything works or is there
> anywhere else I need to set this vserver's vdir.
yep, that works, there is even an option when you build
new guests to place them in any directory you like ...
HTC,
Herbert
> TIA
> Jeff Jansen
Received on Sun Aug 1 14:31:03 2010