These are rough instructions of how to manually create basic Debian Etch (4.0) template cache, which can be used to create OpenVZ VEs based on Debian Etch (4.0). (see also /usr/share/doc/vzctl/README.Debian in the vzctl Debian package)
Notes:
- You shouldn't be running as root, but as a user that is permitted to use sudo instead. It's a dangerous idea, run as root at your peril.
- Anywhere you see /vz, you might really need to use /var/lib/vz instead, especially on a Debian Etch host.
- Anywhere you see http://http.us.debian.org/debian/, you can substitute your favorite Debian mirror. (List of official Debian Mirrors)
Contents
Prerequisites
You need to have a working copy of debootstrap running on your hardware node.
For Debian:
sudo apt-get install debootstrap
For Gentoo:
sudo emerge debootstrap
For Fedora (at least Fedora 8 have it, not sure about earlier versions):
sudo yum install debootstrap
For other distros you might need to install it from sources, or search for an appropriate package for your distribution. An RPM is available on the OpenVZ Forum.
Bootstrapping Debian
You can install different releases of Debian into a VE's private directory using the debootstrap command.
The command parameters are:
debootstrap --arch ARCH NAME DIRECTORY URL
Specify your architecture instead of i386 if you're using something other than i386/x86. For example, for AMD64/x86_64, use amd64 or for ia64, use ia64.
We use VE ID of 777 for this example; surely it can be any other unused ID.
Lenny (current Debian stable)
debootstrap --arch i386 lenny /vz/private/777 http://http.us.debian.org/debian/
Etch (old release)
debootstrap --arch i386 etch /vz/private/777 http://http.us.debian.org/debian/
Sarge (very old release)
debootstrap sarge /vz/private/777 http://archive.debian.org/debian
Preparing the HN network
Append the following lines to /etc/sysctl.conf, adjust to taste and then execute "sysctl -p" for them to take effect.
### OpenVZ settings # On Hardware Node we generally need packet # forwarding enabled and proxy arp disabled net.ipv4.conf.default.forwarding=1 net.ipv4.conf.default.proxy_arp = 0 net.ipv4.ip_forward=1 # Enables source route verification net.ipv4.conf.all.rp_filter = 1 # Enables the magic-sysrq key kernel.sysrq = 1 # TCP Explict Congestion Notification net.ipv4.tcp_ecn = 0 # we do not want all our interfaces to send redirects net.ipv4.conf.default.send_redirects = 1 net.ipv4.conf.all.send_redirects = 0
Preparing and starting the VE
Setting VE config
First, we need a config for the VE:
sudo vzctl set 777 --applyconfig vps.basic --save
Setting VE OSTEMPLATE
Also, we need OSTEMPLATE to be set in VE configuration file, for the vzctl to work properly.
sudo sh -c 'echo "OSTEMPLATE=debian-4.0" >> /etc/vz/conf/777.conf'
Setting VE IP address
For the VE to be able to download updates from the Internet, we need a valid IP address for it:
sudo vzctl set 777 --ipadd x.x.x.x --save
|
Note: if you use private IP for the VE, you have to set up NAT as described in Using NAT for VE with private IPs. |
Setting DNS server for VE
For the VE to be able to download updates from the Internet, we also need to specify a DNS for it:
sudo vzctl set 777 --nameserver x.x.x.x --save
Starting VE
Now start the VE:
sudo vzctl start 777
Customizing the installation
A few things need to be done inside a newly created VE for it to become suitable for OpenVZ. All those things are done inside the VE, so first command is:
sudo vzctl enter 777 export PATH=/sbin:/usr/sbin:/bin:/usr/bin
|
Warning: Do not run the commands below on the hardware node, they are only to be run within the VE! |
Set Debian repositories
cat <<EOF > /etc/apt/sources.list deb http://http.us.debian.org/debian etch main contrib deb http://security.debian.org etch/updates main contrib EOF
Get new security updates
apt-get update apt-get upgrade
Install some more packages
Installing packages could be an interactive process so the system might ask some questions. You can install more packages if you'd like. For example:
apt-get install ssh quota less
Set sane permissions for /root directory
chmod 700 /root
Disable root login
This will disable root login by default.
usermod -L root
Disable getty
Disable running gettys on terminals as a VE does not have any:
sed -i -e '/getty/d' /etc/inittab
Disable sync() for syslog
Turn off doing sync() on every write for syslog's log files, to improve I/O performance:
sed -i -e 's@\([[:space:]]\)\(/var/log/\)@\1-\2@' /etc/*syslog.conf
Fix /etc/mtab
Link /etc/mtab to /proc/mounts, so df and friends will work:
rm -f /etc/mtab ln -s /proc/mounts /etc/mtab
Remove some unneeded packages
If you have any packages you'd like to remove, now's the time for it. Here's an example:
dpkg --purge modutils ppp pppoeconf pppoe pppconfig
Disable services
Do not start some services, stick to bare minimum:
update-rc.d -f klogd remove update-rc.d -f quotarpc remove update-rc.d -f exim4 remove update-rc.d -f inetd remove
Fix SSH host keys
This is only useful if you installed SSH. Each individual VE should have its own pair of SSH host keys. The code below will wipe out the existing SSH keys and instruct the newly-created VE to create new SSH keys on first boot.
rm -f /etc/ssh/ssh_host_*
cat << EOF > /etc/rc2.d/S15ssh_gen_host_keys
#!/bin/bash
ssh-keygen -f /etc/ssh/ssh_host_rsa_key -t rsa -N ''
ssh-keygen -f /etc/ssh/ssh_host_dsa_key -t dsa -N ''
rm -f \$0
EOF
chmod a+x /etc/rc2.d/S15ssh_gen_host_keysChange timezone
You might want to change timezone if you do not live in $UTC. The following example is for Germany
ln -sf /usr/share/zoneinfo/Europe/Berlin /etc/localtimeor even better
dpkg-reconfigure tzdataClean packages
After installing packages, you'll have some junk packages laying around in your cache. Since you don't want your template to have those, this command will wipe them out.
apt-get clean
Now everything is done. Exit from the template and go back to the hardware node.
exit
Preparing for and packing template cache
We don't need an IP for the VE anymore, and we definitely do not need it in template cache, so remove it:
sudo vzctl set 777 --ipdel all --save
Also, remove DNS server and search domain information from /etc/resolv.conf file in VE:
sudo nano /vz/private/777/etc/resolv.conf
Also, remove /etc/hostname file in VE:
sudo rm -f /vz/private/777/etc/hostname
Stop the VE:
sudo vzctl stop 777
Go to the VE directory:
cd /vz/private/777
Now create a cached OS tarball. In the command below, you'll want to replace i386 with your architecture (i386, amd64, ia64, etc).
sudo tar --numeric-owner -zcf /vz/template/cache/debian-4.0-i386-minimal.tar.gz .
Look at the resulting tarball to see its size is sane:
# ls -lh /vz/template/cache -rw-r--r-- 1 root root 51M Apr 10 03:16 debian-4.0-i386-minimal.tar.gz
Checking if template cache works
We can now create a VE based on the just-created template cache. Be sure to change i386 to your architecture just like you did when you named the tarball above.
sudo vzctl create 123456 --ostemplate debian-4.0-i386-minimal
Now make sure that it works:
sudo vzctl start 123456 sudo vzctl exec 123456 ps ax
You should see that a few processes are running.
Final cleanup
Stop and remove the test VE you just created:
sudo vzctl stop 123456 sudo vzctl destroy 123456 sudo rm /etc/vz/conf/123456.conf.destroyed
Finally, let's remove the VE we used for OS template cache creation:
sudo vzctl destroy 777 sudo rm /etc/vz/conf/777.conf.destroyed