Re: [vserver] ubuntu 10.04 as a guest

From: Wojciech Giel <wojciech.giel_at_cimr.cam.ac.uk>
Date: Fri 11 Mar 2011 - 13:03:14 GMT
Message-ID: <4D7A1D92.20709@cimr.cam.ac.uk>

Hi,

On 08/03/11 15:35, Herbert Poetzl wrote:
> On Tue, Mar 08, 2011 at 01:57:37PM +0000, Wojciech Giel wrote:
>> Hi Herbert,
>
>> On 08/03/11 12:33, Herbert Poetzl wrote:
>>> for portmapper, make sure that you do not run an unrestricted
>>> portmapper on the host, as it will bind to all IPs including
>>> the guest IPs, which in turn will keep the guest's portmapper
>> >from even starting ...
>
>> I'm running on host and on guests portmapper with -i 127.0.0.1 also
>> tried with specific ip address .
>
> recent distros usually use rpcbind, sure that it is portmapper
> you are running on host and guest? (rpcbind needs -h)
>

debian and ubuntu server uses portmap

>>> for the nfs(d) part, you want to go for an userspace nfsd not
>>> the kernel nfsd, as a guest is not permitted to load and/or
>>> access kernel modules
>
>> I just want to use nfs client and autofs on guest as I'm using now on
>> ubuntu server 8.04.
>
> why inside the guest? wouldn't autofs from outside the guest
> work just fine for you as well?
>
>>>> bcapabilites and ccapablilites have proper flags. but can't mount
>>>> with locking I get this error.
>
>>> define proper :)
>
>> I'm using these setting on ubuntu server 8.04 and everything is working
>> fine while on 10.4 is not.
>
>> cat bcapabilities
>> SYS_ADMIN
>> CAP_SYS_RAWIO
>> CAP_MKNOD
>> CAP_SYS_ADMIN
>> CAP_IPC_LOCK
>> CAP_IPC_OWNER
>
>> cat ccapabilities
>> SECURE_MOUNT
>> SECURE_REMOUNT
>> BINARY_MOUNT
>
> you are aware that you give the guest(s) everything to mess
> up your host pretty well and your actual protection is so
> weak that any accident/incident on the guest will probably
> kill the host as well?

Yes but it is testing machine for developers they don't care. we still
checking this technology.

>>>> mount.nfs: rpc.statd is not running but is required for remote locking.
>>>> mount.nfs: Either use '-o nolock' to keep locks local, or start statd.
>
> assuming that you did start statd _inside_ the guest and
> that it managed to bind to portmap/rpcbind, did you make
> sure to restrict that as well on the host?
>
>>> this sounds more like you are trying to mount an nfs volume
>>> inside the guest, but without context it's hard to tell ...
>
>> yes. I want use nfs on guest. each developer has a VServer guest, home
>> directories are mounted from central storage. Developers are now asking
>> for more modern software. I'm trying to prepare environment (newer lts
>> version of ubuntu server).
>
> as I said above, I'd use propagating namespaces and autofs
> on the host to map the 'various' nfs mounts into the guests
> but of course YMMV

Can you explain it a bit more. Do you mean binding host automount dir to
guest?
thanks
Wojciech
Received on Fri Mar 11 13:07:05 2011

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Fri 11 Mar 2011 - 13:07:06 GMT by hypermail 2.1.8