OpenVZ Virtuozzo Containers Wiki - User contributions [en]

Debian template creation

2007-05-18T19:56:00Z

Progfou: (protect code to escape wiki syntax)

These are rough instructions of how to manually create basic Debian Etch (4.0) template cache, which can be used to create OpenVZ [[VE]]s based on Debian Etch (4.0).

'''Notes:'''
* You shouldn't be running as root, but as a user that is permitted to use sudo instead. It's a dangerous idea, run as root at your peril.
* Anywhere you see <tt>/vz</tt>, you might really need to use <tt>/var/lib/vz</tt> instead, especially on a Debian Etch host.
* Anywhere you see <tt>http://debian.osuosl.org/debian/</tt>, you can substitute your favorite Debian mirror. ([http://www.debian.org/mirror/list List of official Debian Mirrors])

== Prerequisites ==
You need to have a working copy of <tt>debootstrap</tt> running on your hardware node.

For Debian:
sudo apt-get install debootstrap

For Gentoo:
sudo emerge debootstrap

For other distros you might need to install it from sources, or search for an appropriate package for your distribution. An RPM is available on the [http://forum.openvz.org/index.php?t=tree&th=142&mid=584 OpenVZ Forum].

== Bootstrapping Debian ==
This will download Debian Etch to a temporary location on your server. Specify your architecture instead of <tt>i386</tt> if you're using something other than i386/x86. For example, for AMD64/x86_64, use <tt>amd64</tt> or for ia64, use <tt>ia64</tt>. We use VE ID of 777 for this example; surely it can be any other unused ID.
sudo debootstrap --arch i386 etch /vz/private/777 http://debian.osuosl.org/debian/

== Preparing and starting the VE ==

=== Setting VE config ===
First, we need a config for the [[VE]]:
sudo vzctl set 777 --applyconfig vps.basic --save

=== Setting VE OSTEMPLATE ===
Also, we need <tt>OSTEMPLATE</tt> to be set in VE configuration file, for the [[vzctl]] to work properly.

sudo sh -c 'echo "OSTEMPLATE=debian-4.0" >> /etc/vz/conf/777.conf'

=== Setting VE IP address ===
For the [[VE]] to be able to download updates from the Internet, we need a valid IP address for it:
sudo vzctl set 777 --ipadd x.x.x.x --save

{{Note|if you use private IP for the VE, you have to set up NAT as described in [[Using NAT for VE with private IPs]].}}

=== Setting DNS server for VE ===
For the [[VE]] to be able to download updates from the Internet, we also need to specify a DNS for it:
sudo vzctl set 777 --nameserver x.x.x.x --save

=== Starting VE ===
Now start the VE:
sudo vzctl start 777

== Customizing the installation ==
A few things need to be done inside a newly created VE for it to become suitable for OpenVZ. All those things are done inside the VE, so first command is:
sudo vzctl enter 777
export PATH=/sbin:/usr/sbin:/bin:/usr/bin

{{Note|'''Warning!''' Do not run the commands below on the hardware node, they are only to be run within the VE!}}

=== Set Debian repositories ===
cat <<EOF > /etc/apt/sources.list
deb http://debian.osuosl.org/debian/ etch main contrib
deb http://security.debian.org etch/updates main contrib
EOF

=== Get new security updates ===
apt-get update
apt-get upgrade

=== Install some more packages ===
Installing packages could be an interactive process so the system might ask some questions. You can install more packages if you'd like. For example:
apt-get install ssh quota

=== Set sane permissions for <tt>/root</tt> directory ===
chmod 700 /root

=== Disable root login ===
This will disable root login by default.
usermod -L root

=== Disable getty ===
Disable running <tt>getty</tt>s on terminals as a VE does not have any:
sed -i -e '/getty/d' /etc/inittab

=== Disable <tt>sync()</tt> for syslog ===
Turn off doing <tt>sync()</tt> on every write for <tt>syslog</tt>'s log files, to improve I/O performance:
<pre>sed -i -e 's@$[[:space:]]$$/var/log/$@\1-\2@' /etc/syslog.conf</pre>

=== Fix <tt>/etc/mtab</tt> ===
Link <tt>/etc/mtab</tt> to <tt>/proc/mounts</tt>, so <tt>df</tt> and friends will work:
rm -f /etc/mtab
ln -s /proc/mounts /etc/mtab

=== Remove some unneeded packages ===
If you have any packages you'd like to remove, now's the time for it. Here's an example:
dpkg --purge modutils ppp pppoeconf pppoe pppconfig

=== Disable services ===
Do not start some services, stick to bare minimum:
update-rc.d -f klogd remove
update-rc.d -f quotarpc remove
update-rc.d -f exim4 remove
update-rc.d -f inetd remove

=== Fix SSH host keys ===
This is only useful if you installed SSH. Each individual [[VE]] should have its own pair of SSH host keys. The code below will wipe out the existing SSH keys and instruct the newly-created [[VE]] to create new SSH keys on first boot.


<pre>
rm -f /etc/ssh/ssh_host_*
cat << EOF > /etc/rc2.d/S15ssh_gen_host_keys
#!/bin/bash
ssh-keygen -f /etc/ssh/ssh_host_rsa_key -t rsa -N ''
ssh-keygen -f /etc/ssh/ssh_host_dsa_key -t dsa -N ''
rm -f \$0
EOF
chmod a+x /etc/rc2.d/S15ssh_gen_host_keys
</pre>

=== Clean packages ===
After installing packages, you'll have some junk packages laying around in your cache. Since you don't want your template to have those, this command will wipe them out.
apt-get clean

Now everything is done. Exit from the template and go back to the hardware node.
exit

== Preparing for and packing template cache ==

We don't need an IP for the VE anymore, and we definitely do not need it in template cache, so remove it:
sudo vzctl set 777 --ipdel all --save

Also, remove DNS server and search domain information from ''/etc/resolv.conf'' file '''in VE''':
sudo nano /vz/private/777/etc/resolv.conf

Stop the VE:
sudo vzctl stop 777

Go to the VE directory:
cd /vz/private/777

Now create a cached OS tarball. In the command below, you'll want to replace <tt>i386</tt> with your architecture (i386, amd64, ia64, etc).
sudo tar -zcf /vz/template/cache/debian-4.0-i386-minimal.tar.gz .

Look at the resulting tarball to see its size is sane:
# ls -lh /vz/template/cache
-rw-r--r-- 1 root root 51M Apr 10 03:16 debian-4.0-i386-minimal.tar.gz

== Checking if template cache works ==
We can now create a VE based on the just-created template cache. Be sure to change <tt>i386</tt> to your architecture just like you did when you named the tarball above.
sudo vzctl create 123456 --ostemplate debian-4.0-i386-minimal

Now make sure that it works:
sudo vzctl start 123456
sudo vzctl exec 123456 ps ax

You should see that a few processes are running.

== Final cleanup ==
Stop and remove the test VE you just created:
sudo vzctl stop 123456
sudo vzctl destroy 123456
sudo rm /etc/vz/conf/123456.conf.destroyed

Finally, let's remove the VE we used for OS template cache creation:
sudo vzctl destroy 777
sudo rm /etc/vz/conf/777.conf.destroyed

[[Category: HOWTO]]
[[Category: Templates]]

Installation on Debian/old

2007-05-02T06:59:00Z

Progfou: up'ed the title, since it's common to all installations + new way for Debian network options

= Sarge-Dapper (OldStable) =
The OpenVZ packages at http://debian.systs.org/ aimed to install OpenVZ in a easy way, some task are done on install process!

== edit apt source settings ==
Add to your "/etc/apt/sources.list"

<pre>
deb http://debian.systs.org/ sarge openvz
</pre>

and get the new package lists

<pre>
# apt-get update
</pre>

== precompiled kernel images at debian.systs.org (dso) ==
The kernel-images on debian.systs.org (dso) use the same kernel-config taken from OpenVZ.
(most kernel-modules are built-in!)

If there is more than one CPU available (or a CPU with hyperthreading), use the kernel-smp deb.
If there is more than 4 Gb of RAM available, use the kernel-enterprise deb.
Otherwise, use the plain kernel deb (kernel).

{| class="wikitable"
|+'''Kernel flavors list'''
! Kernel type !! Description !! Hardware !! Use case
|-
! -
| uniprocessor
| up to 4GB of RAM
|
|-
! -smp
| symmetric multiprocessor
| up to 4 GB of RAM
| 10-20 VPSs
|-
! -entnosplit
| SMP + PAE support
| up to 64 GB of RAM
| 10-30 VPSs
|-
! -enterprise
| SMP + PAE support + 4/4GB split
| up to 64 GB of RAM
| >20-30 VPSs
|}

kernel-image: i368 and amd64
<pre>
ovzkernel-2.6.9
ovzkernel-2.6.9-enterprise
ovzkernel-2.6.9-entnosplit
ovzkernel-2.6.9-smp

ovzkernel-2.6.18
ovzkernel-2.6.18-enterprise
ovzkernel-2.6.18-smp
</pre>

i386 only:
<pre>
ovzkernel-2.6.18-enterprise
</pre>

OpenVZ tool(s) for i386 and amd64
<pre>
vzctl
vzquota
vzprocps
vzdump
</pre>

template(s) for i368 and amd64 : Debian 3.1 Minimal
<pre>
vzctl-ostmpl-debian
</pre>

== installing the kernel-images, toolset and debian-os-template ==
Example: install the stable OpenVZ kernel, tools and Debian OS Template

# aptitude install ovzkernel-2.6.9 vzctl vzquota vzdump vzctl-ostmpl-debian

Maybe you need to update your "linux-loader" (can be configured at /etc/kernel-img.conf)

for the "GRUB":

# /sbin/grub-update

Reboot in your new Debian Stable OpenVZ System

# reboot

That's all :-)

Now it's time to setup your VE's with the minimal Debian-3.1 Template, create new one or download another precreated OS-Template.

= Etch (Stable) =
OpenVZ is now a part of Debian Etch repository.

== install the kernel-image ==

=== precompiled kernel images at download.openvz.org ===
Can be found at http://download.openvz.org/kernel/debian/etch/

<pre>
List of precompiled kernel-images

linux-image-2.6.18-openvz-486_02_i386.deb
linux-image-2.6.18-openvz-686_02_i386.deb
linux-image-2.6.18-openvz-amd64_01_amd64.deb
linux-image-2.6.18-openvz-ia64_01_ia64.deb
linux-image-2.6.18-openvz-k7_02_i386.deb
linux-image-2.6.18-openvz-sparc64-smp_01_sparc.deb
linux-image-2.6.18-openvz-sparc64_01_sparc.deb
</pre>

Example: Installing an OpenVZ precompiled Debian Kernel-Image for an i686:

<pre>
# wget http://download.openvz.org/kernel/debian/etch/linux-image-2.6.18-openvz-686_02_i386.deb
# dpkg -i linux-image-2.6.18-openvz-686_02_i386.deb
</pre>

=== precompiled kernel images at debian.systs.org ===

Add to your "/etc/apt/sources.list"

<pre>
deb http://debian.systs.org/ etch openvz
</pre>

Add the signing key of debian.systs.org (dso) apt-keyring, (need root permissions)
<pre>
# wget http://debian.systs.org/dso_archiv_signing_key.asc -q -O - | apt-key add -
</pre>

and get the new package lists

<pre>
# apt-get update
</pre>

linux-image (version 028stab023.1):
<pre>
ovzkernel-2.6.18 (i386 and amd64)
ovzkernel-2.6.18-smp (i386 and amd64)
ovzkernel-2.6.18-enterprise only (i386)
</pre>

# apt-get install <linux-image>

=== or build your own kernel-image (debian way) ===

To install the kernel-source and the OpenVZ kernel patch, run:
<pre>
# apt-get install kernel-package linux-source-2.6.18 kernel-patch-openvz libncurses5-dev
</pre>

Unpack the kernel-source:
<pre>
# cd /usr/src
# tar xjf linux-source-2.6.18.tar.bz2
# cd linux-source-2.6.18
</pre>

You need a kernel config.
You can use the config of the debian-kernel:
<pre>
# cp /boot/config-2.6.18-3-686 .config
</pre>

Or get a 2.6.18 kernel config from http://download.openvz.org/kernel/devel/current/configs/
<pre>
# wget http://download.openvz.org/kernel/devel/current/configs/kernel-2.6.18-028test010-i686.config.ovz -O .config
</pre>

Now you can apply openvz kernel patch and modify your kernel-config:
<pre>
# ../kernel-patches/all/apply/openvz
# make menuconfig
</pre>

You need following OpenVZ kernel config settings:
<pre>
(taken from a OpenVZ Kernel 2.6.18-028test010.1 on 686)

Filesystem
\_ [*] Second extended fs support (CONFIG_EXT2_FS)
\_ [*] Ext3 journalling file system support (CONFIG_EXT3_FS)
\_ [*] Quota Support (CONFIG_QUOTA)
\_ [*] Compatibility with older quotactl interface (CONFIG_QUOTA_COMPAT)
\_ [*]Quota format v2 support (CONFIG_QFMT_V2)
\_ [*] VPS filesystem (CONFIG_SIM_FS)
\_ [*] Virtuozzo Disk Quota support (CONFIG_VZ_QUOTA)
\-> [*] Per-user and per-group quota in Virtuozzo quota partitions (VZ_QUOTA_UGID)

Security
\->[ ] Enable different security models

OpenVZ ... (what else :-)
\_[*] Virtual Environment support (CONFIG_VE)
\_ <M> VE calls interface (CONFIG_VE_CALLS)
\_ <M> VE networking (CONFIG_VE_NETDEV)
\_ <M> Virtual ethernet device (CONFIG_VE_ETHDEV)
\_ <M> VE device (CONFIG_VZ_DEV)
\_ [*] VE netfiltering (CONFIG_VE_IPTABLES)
\_ <M> VE watchdog module (CONFIG_VZ_WDOG)
\_ <M> Checkpointing & restoring Virtual Environments (CONFIG_VZ_CHECKPOINT)

User resources ... (User Beancounters)
\_ [*] Enable user resource accounting (CONFIG_USER_RESOURCE)
\_ [*] Account physical memory usage ( CONFIG_USER_RSS_ACCOUNTING)
\_ [*] Account disk IO (CONFIG_UBC_IO_ACCT)
\_ [*] Account swap usage (CONFIG_USER_SWAP_ACCOUNTING)
\_ [*] Report resource usage in /proc (CONFIG_USER_RESOURCE_PROC)
\_ [*] User resources debug features (CONFIG_UBC_DEBUG)
\_ [*] Debug kmemsize with cache counters (CONFIG_UBC_DEBUG_KMEM)
</pre>

<pre>
INFO: Better to build the kernel-headers as well, so afterward other kernel-modules can
built without whole kernel tree (e.g. drbd -> drbd0.7-module-source)
See also :
# make-kpkg --targets
</pre>

Compile your Kernel (as user root, or you need the --rootcmd!)
<pre>
# make-kpkg --append_to_version=-1-openvz --added_patches=openvz --revision=1 --initrd binary-arch

or all above with one step

# make-kpkg --append_to_version=-1-openvz --added_patches=openvz --revision=1 --initrd --config menuconfig binary-arch
</pre>

Install the kernel and update initramfs:
<pre>
# dpkg -i ../linux-image-2.6.18-1-openvz_1_i386.deb
# update-initramfs -c -k 2.6.18-1-openvz
</pre>

<pre>
INFO: update-initramfs is done, when make-kpkg is use with --initrd option
INFO: update-grub can be configured by /etc/kernel-img.conf
</pre>

Update the bootloader (when not done above)

GRUB :

# /usr/sbin/update-grub

INFO: since the Debian ETCH-release the location of update-grub is moved from /sbin/update-grub to /usr/sbin/update-grub !

== install the toolset ==

You need the toolset for manage-ing OpenVZ Virtual Enviromennt (VE)

<pre>
# apt-get install vzctl vzquota
</pre>

= modify needed settings =

If you want network access for the virtual server then you need to enable IP forwarding.

An old (before Etch) Debian Way: set "ip_forward" to yes in /etc/network/option.

# editor /etc/network/options

The new (from Etch) standard way is to use sysctl for this (see below).

In some cases you may need to enable proxy_arp for the network devices that you want your virtual hosts to be accessible on.
You can add this to a specific interface in the network configuration (/etc/network/interfaces) by the following lines, replace %DEV% with your device name (ie. eth0).

Example:

<pre>
[...]
# device: %DEV%
iface %DEV% inet static
address 192.168.0.2
netmask 255.255.255.0
network 192.168.2.0
broadcast 192.168.2.255
gateway 192.168.2.1

up sysctl -w net.ipv4.conf.%DEV%.proxy_arp=0
pre-down sysctl -w net.ipv4.conf.%DEV%.proxy_arp=1
[...]
</pre>

or use the /etc/network/if-up/ and /etc/network/if-down.d/ directories.

<pre>
INFO: # man 5 interfaces (to read more about debian's network interface configuration for ifup and ifdown)
INFO: It is recommanded to add the magic-sysrq key, to your /etc/sysctl.conf
</pre>

a (plain) OpenVZ Linux Way:

Add settings to "/etc/sysctl.conf"

<pre>
# On Hardware Node we generally need
# packet forwarding enabled and proxy arp disabled
net.ipv4.ip_forward = 1
net.ipv4.conf.default.proxy_arp = 0

# Enables source route verification
net.ipv4.conf.all.rp_filter = 1

# Enables the magic-sysrq key
kernel.sysrq = 1

# TCP Explict Congestion Notification
# net.ipv4.tcp_ecn = 0

# we do not want all our interfaces to send redirects
net.ipv4.conf.default.send_redirects = 1
net.ipv4.conf.all.send_redirects = 0
</pre>

<pre>
INFO: Suggestion: Please make a symlink from /var/lib/vz to /vz as backward compability to Main OpenVZ
(Debian vz root directory is installed FHS-like to /var/lib/vz)

# ln -s /var/lib/vz /vz
</pre>

'''Before you restart your Server, keep in mind, that your system has all needed modules enabled; booting from your harddisk (e.g. hardware modules, raid system(s), lvm2 etc). May you need a INITRD (initramdisk) or compile needed kernel modules statically in.'''

# reboot

That's all!

Now it's time to create a OS Template or download another precreated OS-Template.

INFO: Suggestions: Setup your default OS Template in /etc/vz/vz.conf

[[Category: HOWTO]]
[[Category: Installation]]