Debian template creation
These are rough instructions of how to manually create minimal Debian Sarge (3.1) template cache, which can be used to create OpenVZ VEs based on Debian Sarge (3.1).
Contents
Prerequisites
I have used OpenVZ on a Gentoo Linux for this work, but any distribution is fine, as long as you can have a working debootstrap utility on it.
For Gentoo, run
emerge debootstrap
For other distros you might need to install it from sources, or google for an appropriate package for your distro. An RPM is available from [1].
Bootstrapping Debian
All the commands below are executed from the root shell. We use VE ID of 777 for this example; surely it can be any other unused ID.
For Debian Sarge on an x86 (a.k.a. i386) architecture:
debootstrap --arch i386 sarge /vz/private/777 http://ftp.freenet.de/debian
For Debian Sarge on an x86_64 (a.k.a. AMD64) architecture (Sarge/amd64 is not official so we have to use another repository):
debootstrap --arch amd64 sarge /vz/private/777 http://amd64.debian.net/debian
For Debian Sarge on an ia64 architecture:
debootstrap --arch ia64 sarge /vz/private/777 http://ftp.freenet.de/debian
Preparing and starting the VE
Setting VE config
First, we need a config for the VE:
vzctl set 777 --applyconfig vps.basic --save
Setting VE OSTEMPLATE
Also, we need OSTEMPLATE to be set in VE configuration file, for the vzctl to work properly.
echo "OSTEMPLATE=debian-3.1" >> /etc/vz/conf/777.conf
Setting VE IP address
For the VE to be able to download updates from the Internet, we need a valid IP address for it:
vzctl set 777 --ipadd x.x.x.x --save
|
Note: if you use private IP for the VE, you have to set up NAT as described in Using NAT for VE with private IPs. |
Setting Debian repositories
For x86_64:
cat << EOF > /vz/private/777/etc/apt/sources.list deb http://amd64.debian.net/debian stable main contrib non-free deb http://security.debian.org stable/updates main contrib non-free EOF
For i386 and ia64:
cat << EOF > /vz/private/777/etc/apt/sources.list deb http://ftp.freenet.de/debian stable main contrib non-free deb http://security.debian.org stable/updates main contrib non-free EOF
Starting VE
Now start the VE:
vzctl start 777
Customizing the installation
A few things needs to be done inside a newly created VE for it to become suitable for OpenVZ. All those things are done inside the VE, so first command is vzctl enter.
|
|
Note: Do not run these commands inside host system, they are only for VE! |
vzctl enter 777 export PATH=/sbin:/usr/sbin:/bin:/usr/bin
Convert the system to use shadow passwords
pwconv
Get new security updates
apt-get update apt-get upgrade
Install some more packages
This could be an interactive process so the system would ask some questions. Here you can add more packages you like to be present, like less, vim etc.
apt-get install ssh quota
Disable root login
usermod -L root
|
|
Note: The root login will be enabled back then you use vzctl set VEID --userpasswd root:xxxx. |
Disable getty
Disable running gettys on terminals as a VE does not have any:
sed -i -e '/getty/d' /etc/inittab
Put sane permissions for /root directory
chmod 700 /root
Disable sync() for syslog
Turn off doing sync() on every write for syslog's log files, to improve I/O performance:
sed -i -e 's@\([[:space:]]\)\(/var/log/\)@\1-\2@' /etc/syslog.conf
Fix /etc/mtab
Link /etc/mtab to /proc/mounts, so df and stuff will work:
rm -f /etc/mtab ln -s /proc/mounts /etc/mtab
Remove some unneeded packages
dpkg --purge modutils dpkg --purge ppp pppoeconf pppoe pppconfig
Disable services
Do not start some services, stick to bare minimum:
update-rc.d -f klogd remove update-rc.d -f quotarpc remove update-rc.d -f exim4 remove update-rc.d -f inetd remove
Fix SSH host keys
SSH host keys should be created later, upon the first VE start:
rm -f /etc/ssh/ssh_host_* cat << EOF > /etc/rc2.d/S15ssh_gen_host_keys #!/bin/bash ssh-keygen -f /etc/ssh/ssh_host_rsa_key -t rsa -N '' ssh-keygen -f /etc/ssh/ssh_host_dsa_key -t dsa -N '' rm -f \$0 EOF chmod a+x /etc/rc2.d/S15ssh_gen_host_keys
Clean packages
apt-get clean
Now everything is done. Exit from the VE by pressing Ctrl-D (or typing exit).
Preparing for and packing template cache
We don't need an IP for the VE anymore, and we definitely do not need it in template cache, so remove it:
vzctl set 777 --ipdel all --save
Stop the VE:
vzctl stop 777
Go to the VE directory:
cd /vz/private/777
Now create a cached OS tarball.
For i386:
tar czf /vz/template/cache/debian-3.1-i386-minimal.tar.gz .
For AMD64:
tar czf /vz/template/cache/debian-3.1-x86_64-minimal.tar.gz .
Look at the resulting tarball to see its size is sane:
# ls -lh /vz/template/cache/de* -rw-r--r-- 1 root root 42M Nov 17 23:50 /vz/template/cache/debian-3.1-x86_64-minimal.tar.gz
Checking if template cache works
We can now create a VE based on the just-created template cache.
For x86_64:
vzctl create 1002 --ostemplate debian-3.1-x86_64-minimal
For i386:
vzctl create 1002 --ostemplate debian-3.1-i386-minimal
Now check that it works:
vzctl start 1002 vzctl exec 1002 ps ax
You should see that a few processes are running.
Final cleanups
Let's stop and remove the VE we used to test a new cache:
vzctl stop 1002 vzctl destroy 1002
Finally, let's remove the VE we used for OS template cache creation:
vzctl destroy 777