This page is about making a template cache for OpenVZ VE container from Gentoo Linux. The method is basically the same as described in [[Slackware template creation]] article.

===Download stage3===

We shall will make the template from a stage3 file. An OpenVZ OS template should be an archive (.tar.gz) of the root of the a working system, but without the kernel and some files. You can download stage3 from the nearest mirror here: from http://www.gentoo.org/main/en/mirrors.xmlor directly from http://distfiles.gentoo.org/releases/x86/current-stage3/

---- == Or try to Download 64 bit stage3 == If you experience with 32bit containers you can also try to create Gentoo template with 64bits binary support. Try to download '''64bit''' stage3. For 64bit Gentoo template creation, search for nearest mirrors http://www.gentoo.org/main/en/mirrors.xml or directly from: http://distfiles.gentoo.org/releases/amd64/autobuilds/current-stage3/ with 32bit binary '''multilib''' support, or  http://distfiles.gentoo.org/releases/amd64/autobuilds/current-stage3/hardened/ (stage3-amd64-hardened+nomultilib-20xxxxxx.tar.bz2) try the hardend profile without multilib support (only 64bit binary support for gentoo template containers!!)  Don't forget that hostnode must support 64bit binary too, with or without 32bit multilib support!! Hostnodes that supports multilib can start 64bits containers with 32bits containers but with a '''''slight''''' performance degradation. Don't forget to look for:<pre>ACCEPT_KEYWORDS="amd64" in /etc/make.conf</pre> there you can accept 64bit binary packages support for your containers.<pre>cat /proc/cpuinfo</pre> for 64 bits Intel\AMD CPU instructions set support.  '''WARNING''': There is no warrantied that template should work, you can bugtack the errors. But I haven't confronted with problem. ==Create directory directories for the new VE container and unarchive stage3 == <pre>mkdir /vz/root/1001mkdir /vz/private/1001tar -xvjpf /root/stage3-i686-20111213.tar.bz2 -C /vz/private/1001</pre> == Create CT config ==Now you need to create the configuration file for the container, 1001.conf:

mkdir /vz/private/777tar vzctl set 1001 -xjf /root/stage3-i686applyconfig basic -2006.0.tar.bz2 -C /vz/private/777save

===Create VE config===Gentoo users wil see warning, but nothing to worry just ignore itNow you need to create the configuration file for the VE, 777<pre>WARNING: /etc/vz/conf/1001.confnot found: No such file or directory</pre>

# vzctl set 777 1001 --applyconfig vps.basic --saveError in ploop_open_dd (di.c:288): Can't resolve /vz/private/1001/root.hdd/DiskDescriptor.xml: No such file or directoryFailed to read /vz/private/1001/root.hdd/DiskDescriptor.xmlError: failed to apply some parameters, not saving configuration file!

Add == Make /etc/mtab a symlink to /proc/mounts ==The container's root filesystem is mounted by the host system, not the guest — and therefore root fs will not appear in <code>/etc/vzmtab</code>. It will lead to a non-working <code>df</code> command. To fix, link /etc/mtab to /confproc/777mounts.conf:

rm -f /vz/private/777/etc/mtabln -s echo "proc /proc/mounts proc defaults 0 0" > /vz/private/7771001/etc/mtabfstab

=We need only <code>/proc</code> to be mounted at boot time. ==Edit /etc/fstab=inittab and /etc/init.d/halt.sh == Edit <code>/vz/private/1001/etc/inittab</code> and put a hash mark (#) at the beginning of the lines containing:

echo "proc # TERMINALSc1:12345:respawn:/proc proc defaults 0 0" > sbin/vzagetty 38400 tty1 linuxc2:2345:respawn:/privatesbin/777agetty 38400 tty2 linuxc3:2345:respawn:/etcsbin/fstabagetty 38400 tty3 linuxc4:2345:respawn:/sbin/agetty 38400 tty4 linuxc5:2345:respawn:/sbin/agetty 38400 tty5 linuxc6:2345:respawn:/sbin/agetty 38400 tty6 linux

We need only Just like that:<codepre># TERMINALS#c1:12345:respawn:/procsbin/agetty 38400 tty1 linux#c2:2345:respawn:/sbin/agetty 38400 tty2 linux#c3:2345:respawn:/sbin/agetty 38400 tty3 linux#c4:2345:respawn:/sbin/agetty 38400 tty4 linux#c5:2345:respawn:/sbin/agetty 38400 tty5 linux#c6:2345:respawn:/sbin/agetty 38400 tty6 linux</codepre> to be mounted at the boot time.

===Edit inittab===<code>/vz/private/1001/etc/init.d/halt.sh</code> and put a hash mark (#) at the beginning of the lines containing:

Edit <codepre>sulogin -t 10 /vzdev/private/777/etc/inittabconsole</codepre>, putting a hashmark (#) before the lines containing:

File <precode>c?:1235:respawn:/sbinvz/agetty 38400 tty? linuxprivate/1001/etc/init.d/halt.sh</precode>is deleted in Gentoo 11.2 and doesn't need to edit.

This prevents from starting <code>getty</code> and loginfrom starting on ttys that do not exist in containers.

===Edit /etc/shadow===

Edit <code>/vz/private/7771001/etc/shadow</code>, and change root's password in the first line to an exclamation mark (!):

This will disable the root login until the password is changed with <code>vzctl set VEID CTID --userpasswd root:password</code>.

===Edit /etc/Disable unneeded init.d/checkroot=scripts ==

We have to clean this script The checkroot and make them dummy, because we don't need mount or check rootconsolefont init scripts should not be started inside containers:(NOT! for Gentoo 11. 2)<pre>rm /vz/private/1001/etc/runlevels/boot/checkrootrm /vz/private/1001/etc/runlevels/boot/consolefont</pre>

cat > nano /vz/private/7771001/etc/initrc.d/checkroot#!/sbin/runscriptdepend(){}start(){}end(){conf}rc_sys="openvz"

===Edit /sbin/rc== Edit <code>/vz/private/1001/sbin/rc</code> and put a hash mark (#) at the beginning of line 244 (your line number may be different): <pre># try mount -n ${mntcmd:--t sysfs sysfs /sys -o noexec,nosuid,nodev}</pre> This prevents the container from attempting to mount <code>/sys</code>. To ensure that this change isn't automatically overwritten on update, add the following to <code>/vz/private/1001/etc/make.conf</code>: <pre>CONFIG_PROTECT="/sbin/rc"</pre>

Comment line number 141 in '''Gentoo 11.2''' <code>/vz/private/7771001/sbin/rc:</code> is '''binary''', i just skipped this post

This prevents from attepting Using udev you will have problems since some devices nodes are not created.For example sshd will fail to mount start since /dev/random and /dev/urandom are missing.So it's recommended to disable udev.Edit <code>/sysvz/private/1001/etc/conf.d/rc</code>or <code>/vz/private/1001/etc/conf.d/udev</code> if you using Gentoo 11.2 or future and change the <code>RC_DEVICES</code> line to:<pre>RC_DEVICES="static"</pre>

Delete /lib/If you want to enable udev-state/devices.tarread on.bz2 and create  Create some device nodes needed to enter VPSa container:

rm cd /libvz/private/udev-state1001/devices.tar.bz2libmknod /lib/udev/devices/ttyp0 c 3 0mknod /lib/udev/devices/ptyp0 c 2 0mknod /lib/udev/devices/ptmx c 5 2

You have to leave the directory you are in for the next step to be OK, otherwise you will get this error message: vzquota : (error) Quota on syscall for 1001: Device or resource busy vzquota on failed [3] <pre>cd /</pre> == Edit /etc/pam.d/chpasswd == Some changes are required for successful setting user's password with <code>vzctl</code> util.Edit <code>/vz/private/1001/etc/pam.d/chpasswd</code> and change the <code>password</code> lines to: <pre>password required pam_unix.so md5 shadow</pre> == Test == <pre>vzctl start 1001vzctl enter 1001</pre> You can check running services.:

All services in boot and default runlevels must be started. If everything all right, stop it Enable SSH daemon if required:

===Make distfiles and portage tree {{Warning|'''Do not start sshd''' in template container as it would create server's pair of the host system available in a VE===keys then shared among all containers instantiated later.}}

To install software into a VE with portage you should mount /usr/portage into VE with "bind" option. Do this after VE startsNext leave container pressing Ctrl+D and stop it:

== Making distfiles and portage tree of the host system available in a container == {{Warning|This step is optional and will result in shared files between containers! These steps can save space on disk but trade isolation and security... consider your options carefully!}} To install software into a container with portage, you should mount <code>/usr/portage</code> into the container with the "bind" option. Do the following on the host after the container is started: <pre>mkdir /vz/root/1001/usr/portagemount -o bind /usr/portage /vz/root/1001/usr/portage</pre> If your <code>/usr/portage/distfiles placed </code> directory resides on the other a different partition than your <code>/usr/portage</code> directory, dothe following:

mount -n -o bind /usr/portage/distfiles /vz/root/7771001/usr/portage/distfiles

Now, to install a package into a VE container, you just need to enter there by the container using <code>vzctl enter</code> and run

For security reasons hold this , you should have these directories mounted only while you are installing software into a VEcontainer. {{Note|you have to <code>umount /vz/root/1001/usr/portage/distfiles</code> before trying to stop your container.}} == Dedicated installation of portage == If you decide not to share portage with host as described before, you'll still need a portage installed into your container.

cd # wget http:/vz/privatedistfiles.gentoo.org/releases/snapshots/777current/portage-latest.tar.bz2# tar czf xjf portage-latest.tar.bz2 -C /vz/templateprivate/cache1001/gentoo.tar.gz *usr

==Host system portage tree and distfiles in read-only mode =Test = You can safely share portage tree from the new cache file===host system among all Gentoo VPSs by mounting it in read-only mode and defining dedicated <code>distfiles</code> directory. All files in regular <code>distfiles</code> directory will be also available to guest containers. Create <code>/etc/vz/conf/vps.mount</code> to mount RO portage to all Gentoo guests or <code>/etc/vz/conf/<vps id>.mount</code> to mount portage tree only to particular container:

vzctl create 800 #!/bin/bashsource /etc/vz/vz.confsource ${VE_CONFFILE}if [ -d /vz/root/$VEID/usr/portage ]; then mount -ostemplate gentoo n --ipadd 192.168.0.10 -bind -hostname testvpso ro /vz/portage /vz/root/$VEID/usr/portagefi

Make it executable: <pre>chmod u+x /etc/vz/conf/vps.mount</pre>  Add the following strings to the <code>/vz/private/1001/etc/make.conf</code>: <pre>PORTAGE_RO_DISTDIRS="/usr/portage/distfiles"DISTDIR="/usr/portage_distfiles"</pre> You should update host-node portage tree on regular basis to keep it up to date because <code>emerge --sync</code> won't work inside guest container. == Create the template cache file == <pre>cd /vz/private/1001/tar --numeric-owner -czf /vz/template/cache/gentoo.tar.gz *</pre> == Test the new template cache file == Create a new container from the template file: <pre>vzctl create 800 --config gentoo --ipadd 192.168.0.10 --hostname testvps</pre> If the container was created successfully, try to start it:

If it started, and you can ssh in, enter it using  <pre>vzctl enter 800</pre> congratulations, you've got a working Gentoo template! == Log in over SSH == Leave container by hitting Ctrl+D. To log in over SSH now, you need to set root's password in running container first: <pre>vzctl set 800 --userpasswd root:secret</pre> Of course, you should use different password (replacing <code>secret</code> above) obeying common rules for strong passwords. After that container is ready for login over SSH <pre>ssh root@192.168.0.10</pre>