Difference between revisions of "Deploying Debian VEs without Templates"
m |
Narcisgarcia (talk | contribs) (ctcreate to ctctl) |
||
| (9 intermediate revisions by 5 users not shown) | |||
| Line 1: | Line 1: | ||
Installing Debian Virtual Environments without relying on a precreated template has many advantages and a few drawbacks. This article tries to outline those factors and provide a possible solution to reduce the amount of work needed for template-less Debian deployments. | Installing Debian Virtual Environments without relying on a precreated template has many advantages and a few drawbacks. This article tries to outline those factors and provide a possible solution to reduce the amount of work needed for template-less Debian deployments. | ||
| + | {{Note|'''[https://downloads.actiu.net/ctctl/ ctctl]''' is an alternative wizard to create a container and convert it to a template.}} | ||
== Templates == | == Templates == | ||
[[Template|Templates]] are at the heart of the OpenVZ VE creation process. A "template cache" is basically a tarball consisting of a minimum operating system installation of a given Linux flavor. | [[Template|Templates]] are at the heart of the OpenVZ VE creation process. A "template cache" is basically a tarball consisting of a minimum operating system installation of a given Linux flavor. | ||
| − | |||
== Reasons for pre-built templates == | == Reasons for pre-built templates == | ||
| Line 25: | Line 25: | ||
=== Management of tarballs can be tedious === | === Management of tarballs can be tedious === | ||
| − | Managing templates in a non-trivial environment can become it's own demanding task, if taken seriously. The templates have to be updated constantly to reflect new security updates or point releases. And with every updated template, said templates have to be distributed to all Hardware Nodes where they are used. | + | Managing templates in a non-trivial environment can become it's own demanding task, if taken seriously. The templates have to be updated constantly to reflect new security updates or operating system point releases. And with every updated template, said templates have to be distributed to all Hardware Nodes where they are used. |
| − | Experience has shown, that quality is one of the first things being cut in operations/production environments when being time constrained, so preventing one source of constant work improves quality and security instantly. | + | Experience has shown, that quality is one of the first things being cut in operations/production environments when being time constrained, so preventing one source of constant work improves quality and security instantly and irrevocably. |
| − | === | + | === Templates are of questionable security === |
Pre-built templates, especially those which can be downloaded from the internet, are of doubtful trustworthiness. It's trivial to open backdoors, install keyloggers or run DDoS clients if you have full control of the binaries which are going to be run in a VE. | Pre-built templates, especially those which can be downloaded from the internet, are of doubtful trustworthiness. It's trivial to open backdoors, install keyloggers or run DDoS clients if you have full control of the binaries which are going to be run in a VE. | ||
| Line 35: | Line 35: | ||
=== It's not needed after all === | === It's not needed after all === | ||
| − | With Debian, there is no reason to actually use pre-built templates if you're not time-constrained in the deployment process and have other means of managing your configuration | + | With Debian, there is no reason to actually use pre-built templates if you're not time-constrained in the deployment process and have other means of managing your configuration. |
| + | Since <tt>debootstrap</tt> is the tool at the core of every Debian installation it doesn't matter if it's run by the [http://wiki.debian.org/DebianInstaller Debian Installer], during template creation, by hand or even in a completely different Linux distribution. | ||
| + | |||
| + | Management of configuration files by means of templates is a non-sustainable way of doing Configuration Management. In environments with few (if any) changes this can work out nicely, but in more agile/complex environments a proper Configuration Management solution should be used. | ||
== Basic Steps == | == Basic Steps == | ||
| Line 42: | Line 45: | ||
The basic steps needed to deploy Debian VEs are outlined in [[Debian template creation]]. | The basic steps needed to deploy Debian VEs are outlined in [[Debian template creation]]. | ||
| − | == | + | == Creation helpers == |
To automate the process of deploying VEs with <tt>debootstrap</tt> a bit of shell-scripting glue is needed. | To automate the process of deploying VEs with <tt>debootstrap</tt> a bit of shell-scripting glue is needed. | ||
| − | + | === ctcreate by Narcis Garcia === | |
| − | + | 2017 version included in the [https://git.actiu.net/libre/amoreos/ Amoreos repository]. Deploys APT/Debian containers for OpenVZ 6 in APT/Debian host, by building its corresponding template first. | |
| − | |||
| + | === deploy.sh by Michael Renner === | ||
| + | 2011 version can be found at [https://github.com/terrorobe/vzstuff github.com/terrorobe/vzstuff]. To get a local copy you will need to install [http://git-scm.com/ git] and then run the following command: | ||
| + | git clone git://github.com/terrorobe/vzstuff.git | ||
Following the instructions in the README file should get you started nicely. | Following the instructions in the README file should get you started nicely. | ||
Latest revision as of 09:24, 28 January 2020
Installing Debian Virtual Environments without relying on a precreated template has many advantages and a few drawbacks. This article tries to outline those factors and provide a possible solution to reduce the amount of work needed for template-less Debian deployments.
|
Note: ctctl is an alternative wizard to create a container and convert it to a template. |
Contents
Templates[edit]
Templates are at the heart of the OpenVZ VE creation process. A "template cache" is basically a tarball consisting of a minimum operating system installation of a given Linux flavor.
Reasons for pre-built templates[edit]
Very fast VE deployment[edit]
Deploying a new VE with a tarball reduces the work needed to extracting said tar archive, so the deployment speed can't be any faster. It's possible that certain vzfs optimizations rely on templates being deployed from a specific cached template.
Template can contain complex modifications[edit]
Since templates can contain any files with any given content, you can deploy heavily modified VEs without any problems.
Access to a package repository[edit]
Running a bootstrapper instead of using templates requires access to a package repository, which might not be feasible in certain environments.
Reasons against pre-built templates[edit]
Management of tarballs can be tedious[edit]
Managing templates in a non-trivial environment can become it's own demanding task, if taken seriously. The templates have to be updated constantly to reflect new security updates or operating system point releases. And with every updated template, said templates have to be distributed to all Hardware Nodes where they are used.
Experience has shown, that quality is one of the first things being cut in operations/production environments when being time constrained, so preventing one source of constant work improves quality and security instantly and irrevocably.
Templates are of questionable security[edit]
Pre-built templates, especially those which can be downloaded from the internet, are of doubtful trustworthiness. It's trivial to open backdoors, install keyloggers or run DDoS clients if you have full control of the binaries which are going to be run in a VE.
It's not needed after all[edit]
With Debian, there is no reason to actually use pre-built templates if you're not time-constrained in the deployment process and have other means of managing your configuration.
Since debootstrap is the tool at the core of every Debian installation it doesn't matter if it's run by the Debian Installer, during template creation, by hand or even in a completely different Linux distribution.
Management of configuration files by means of templates is a non-sustainable way of doing Configuration Management. In environments with few (if any) changes this can work out nicely, but in more agile/complex environments a proper Configuration Management solution should be used.
Basic Steps[edit]
The basic steps needed to deploy Debian VEs are outlined in Debian template creation.
Creation helpers[edit]
To automate the process of deploying VEs with debootstrap a bit of shell-scripting glue is needed.
ctcreate by Narcis Garcia[edit]
2017 version included in the Amoreos repository. Deploys APT/Debian containers for OpenVZ 6 in APT/Debian host, by building its corresponding template first.
deploy.sh by Michael Renner[edit]
2011 version can be found at github.com/terrorobe/vzstuff. To get a local copy you will need to install git and then run the following command:
git clone git://github.com/terrorobe/vzstuff.git
Following the instructions in the README file should get you started nicely.
