Re: [vserver] ubuntu 10.04 as a guest

From: Herbert Poetzl <herbert_at_13thfloor.at>
Date: Fri 11 Mar 2011 - 13:52:25 GMT
Message-ID: <20110311135225.GS24107@MAIL.13thfloor.at>

On Fri, Mar 11, 2011 at 01:03:14PM +0000, Wojciech Giel wrote:
> Hi,

> On 08/03/11 15:35, Herbert Poetzl wrote:
>> On Tue, Mar 08, 2011 at 01:57:37PM +0000, Wojciech Giel wrote:
>>> Hi Herbert,

>>> On 08/03/11 12:33, Herbert Poetzl wrote:
>>>> for portmapper, make sure that you do not run an unrestricted
>>>> portmapper on the host, as it will bind to all IPs including
>>>> the guest IPs, which in turn will keep the guest's portmapper
>>>> from even starting ...

>>> I'm running on host and on guests portmapper with -i 127.0.0.1
>>> also tried with specific ip address.

>> recent distros usually use rpcbind, sure that it is portmapper
>> you are running on host and guest? (rpcbind needs -h)

> debian and ubuntu server uses portmap

speaking of, what kernel/patch/util-vserver version do
you use?

>>>> for the nfs(d) part, you want to go for an userspace nfsd not
>>>> the kernel nfsd, as a guest is not permitted to load and/or
>>>> access kernel modules

>>> I just want to use nfs client and autofs on guest as I'm using
>>> now on ubuntu server 8.04.

>> why inside the guest? wouldn't autofs from outside the guest
>> work just fine for you as well?

>>>>> bcapabilites and ccapablilites have proper flags. but can't
>>>>> mount with locking I get this error.

>>>> define proper :)

>>> I'm using these setting on ubuntu server 8.04 and everything is
>>> working fine while on 10.4 is not.

>>> cat bcapabilities
>>> SYS_ADMIN
>>> CAP_SYS_RAWIO
>>> CAP_MKNOD
>>> CAP_SYS_ADMIN
>>> CAP_IPC_LOCK
>>> CAP_IPC_OWNER

>>> cat ccapabilities
>>> SECURE_MOUNT
>>> SECURE_REMOUNT
>>> BINARY_MOUNT

>> you are aware that you give the guest(s) everything to mess
>> up your host pretty well and your actual protection is so
>> weak that any accident/incident on the guest will probably
>> kill the host as well?

> Yes but it is testing machine for developers they don't care. we
> still checking this technology.

>>>>> mount.nfs: rpc.statd is not running but is required for remote locking.
>>>>> mount.nfs: Either use '-o nolock' to keep locks local, or start statd.

>> assuming that you did start statd _inside_ the guest and
>> that it managed to bind to portmap/rpcbind, did you make
>> sure to restrict that as well on the host?

so, is statd running or not?
and what does strace -fF on the mount give you?

>>>> this sounds more like you are trying to mount an nfs volume
>>>> inside the guest, but without context it's hard to tell ...

>>> yes. I want use nfs on guest. each developer has a VServer guest,
>>> home directories are mounted from central storage. Developers
>>> are now asking for more modern software. I'm trying to prepare
>>> environment (newer lts version of ubuntu server).

>> as I said above, I'd use propagating namespaces and autofs
>> on the host to map the 'various' nfs mounts into the guests
>> but of course YMMV

> Can you explain it a bit more.

basically you have all the vfs features available the Linux
kernel provides, which includes access to the various name
spaces and (r)bind mounts within a certain namespace hierarchy

one option would be to simply run autofs on the host, but
within the guest's mount/filesystem namespace, so that the
mounts only show up within the guest ....

> Do you mean binding host automount dir to guest?

this would be another option, which is probably the better
one if you want to provide the same mounts to several guests
(as it will save resources)

let's assume there is a mount point /net/home on the host
and autofs on the host is configured to mount user dirs
there (like /net/home/foo) ... then you could simply add
the following line to the guest config's fstab to share
those mounts and the automount feature:

/net/home /home auto rbind 0 0

HTH,
Herbert

> thanks
> Wojciech
Received on Fri Mar 11 13:52:39 2011

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Fri 11 Mar 2011 - 13:52:39 GMT by hypermail 2.1.8