92
edits
Changes
ctcreate to ctctl
These are rough instructions of how to manually create basic Debian Etch (4.0) template cache, which can be used to create OpenVZ [[VE]]s based on Debian Etch (4.0) {{Note|'''[https://downloads.actiu.net/ctctl/ ctctl]''' is an automated helper to create and customize Debian templates.}} {{Warning|The recommended way is '''not to follow''' the below instructions, but to use the official Debian templates, modifying those to your needs. Some template + container creation helpers are recommended at page [[Deploying Debian VEs without Templates]].}}
'''Notes:'''
* You shouldn't be running as root, but as a user that is permitted to use sudo instead. It's a dangerous idea, run as root at your peril.
* Anywhere you see <tt>/vz</tt>, you might really need to use <tt>/var/lib/vz</tt> instead, especially on a Debian Etch host.
* Anywhere you see <tt>http://http.us.debian.osuosl.org/debian/</tt>, you can substitute your favorite Debian mirror. ([http://www.debian.org/mirror/list List of official Debian Mirrors])* See also: <tt>/usr/share/doc/vzctl/README.Debian</tt> in the ''vzctl'' Debian package
== Prerequisites ==
You need to have a working copy of <tt>debootstrap</tt> running on your hardware node.
For Gentoo:
sudo emerge debootstrap
For Fedora (at least Fedora 8 have it, not sure about earlier versions):
sudo yum install debootstrap
For other distros you might need to install it from sources, or search for an appropriate package for your distribution. An RPM is available on the [http://forum.openvz.org/index.php?t=tree&th=142&mid=584 OpenVZ Forum].
== Bootstrapping Debian ==
== Preparing and starting the VE ==
First, we need a config for the [[VE]]:
sudo vzctl set 777 --applyconfig vps.basic --save
On debian squeeze only the following worked for me (''confirmed''), because the standard template names in /etc/vz/conf have changed.
sudo vzctl set 777 --applyconfig basic --save
=== Setting VE OSTEMPLATE ===
Also, we need <tt>OSTEMPLATE</tt> to be set in VE configuration file, for the [[vzctl]] to work properly.
sudo sh -c 'echo "OSTEMPLATE=\"debian-46.0\" ' >> /etc/vz/conf/777.conf'
=== Setting VE IP address ===
sudo vzctl set 777 --ipadd x.x.x.x --save
{{Note|if you use private IP for the VE, you might have to set up NAT as described in [[Using NAT for VE with private IPs]].}}
=== Setting DNS server for VE ===
For the [[VE]] to be able to download updates from the Internet, we also need to specify a DNS for it:
sudo vzctl set 777 --nameserver x.x.x.x --save
=== Creating /dev/ptmx ===
The ptmx character device should normally exist, but if it doesn't, create one.
sudo mknod --mode 666 /var/lib/vz/private/777/dev/ptmx c 5 2
=== Starting VE ===
== Customizing the installation ==
A few things need to be done inside a newly created VE for it to become suitable for OpenVZ. All those things are done inside Enter the VEto begin the configuration (note: if running a wheezy container on a squeeze hardware node, you'll need to manually install a newer version of vzctl (the one from wheezy will be fine - http://packages.debian.org/wheezy/vzctl) due to this bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=683454 - without making this change, so first the enter command will hang). Exporting the path is:optional.
sudo vzctl enter 777
export PATH=/sbin:/usr/sbin:/bin:/usr/bin
{{NoteWarning|'''Warning!''' Do not run the commands below on the hardware node, they are only to be run within the VE!}}
=== Set Debian repositories ===
The list shown is for wheezy, and downloading from US located servers - adjust your release name and mirror location as necessary
cat <<EOF > /etc/apt/sources.list
deb http://http.us.debian.osuosl.org/debian/ etch wheezy main contrib deb http://security.debian.org etchwheezy/updates main contrib deb http://http.us.debian.org/debian wheezy-updates main ## backports - ONLY IF YOU KNOW WHAT YOU DO # deb http://http.us.debian.org/debian-backports/ wheezy-backports main
EOF
=== Install some more packages ===
Installing packages could be an interactive process so the system might ask some questions. You can install more packages if you'd like. For example:
apt-get install ssh quotaless
=== Set sane permissions for <tt>/root</tt> directory ===
=== Disable <tt>sync()</tt> for syslog ===
Turn off doing <tt>sync()</tt> on every write for <tt>syslog</tt>'s log files, to improve I/O performance:
<pre>sed -i -e 's@\([[:space:]]\)\(/var/log/\)@\1-\2@' /etc/*syslog.conf</pre>
=== Fix <tt>/etc/mtab</tt> ===
=== Remove some unneeded packages ===
If you have any packages you'd like to remove, now's the time for it. Here's an example— note that not all of those packages are installed by default in Debian Squeeze (although they were in earlier versions): dpkg --purge modutils ppp pppoeconf pppoe pppconfigmodule-init-tools
=== Disable services ===
Do not start some services, stick to bare minimum:. This step is release dependent. ==== for Jessie ==== <source lang="bash"># turn off and stop some servicesfor i in bind9 quotarpc fetchmail ondemand rsync uuidd wide-dhcpv6-client; do systemctl stop $i systemctl disable $idone # for upstart services comment out the start on in confsfor i in nmbd smbd samba-ad-dc rpcbind; do systemctl disable $idone</source> ==== for Squeeze ==== update-rc.d-insserv -f klogd remove update-rc.d-insserv -f quotarpc remove update-rc.d-insserv -f exim4 remove update-rc.d-insserv -f inetd remove ==== for older releases (Lenny, Sarge etc.) ====
update-rc.d -f klogd remove
update-rc.d -f quotarpc remove
This is only useful if you installed SSH. Each individual [[VE]] should have its own pair of SSH host keys. The code below will wipe out the existing SSH keys and instruct the newly-created [[VE]] to create new SSH keys on first boot.
==== for Jessie ==== <source lang="bash"># Save /etc/rc.local copymv /etc/rc.local /etc/rc.local.orig # ssh host keys hackecho "#!/bin/shrm -f etc/ssh/ssh_host_*/usr/bin/ssh-keygen -t rsa -N '' -f /etc/ssh/ssh_host_rsa_key/usr/bin/ssh-keygen -t dsa -N '' -f /etc/ssh/ssh_host_dsa_key/usr/bin/ssh-keygen -t rsa1 -N '' -f /etc/ssh/ssh_host_key/usr/bin/ssh-keygen -t ecdsa -N '' -f /etc/ssh/ssh_host_ecdsa_key/usr/bin/ssh-keygen -t ed25519 -N '' -f /etc/ssh/ssh_host_ed25519_keysystemctl restart sshmv -f /etc/rc.local.orig /etc/rc.local" > /etc/rc.local chmod a+x /etc/rc.local</source> ==== for Squeeze ==== rm -f /etc/ssh/ssh_host_*<!-- please do not remove <presource>...</presource> pair of tags below,
otherwise quotes after -N (-N '') are not visible -->
<presource lang="bash">cat << EOF > /etc/init.d/ssh_gen_host_keys#!/bin/sh### BEGIN INIT INFO# Provides: Generates new ssh host keys on first boot# Required-Start: $remote_fs $syslog# Required-Stop: $remote_fs $syslog# Default-Start: 2 3 4 5# Default-Stop:# Short-Description: Generates new ssh host keys on first boot# Description: Generates new ssh host keys on first boot### END INIT INFOssh-keygen -f /etc/ssh/ssh_host_rsa_key -t rsa -N ""ssh-keygen -f /etc/ssh/ssh_host_dsa_key -t dsa -N ""insserv -r /etc/init.d/ssh_gen_host_keysrm -f \$0EOF</source> chmod a+x /etc/init.d/ssh_gen_host_keys insserv /etc/init.d/ssh_gen_host_keys ==== for older releases (Lenny, Sarge etc.) ==== <!-- please do not remove <source>...</source> pair of tags below, otherwise quotes after -N (-N '') are not visible --><source lang="bash">
rm -f /etc/ssh/ssh_host_*
cat << EOF > /etc/rc2.d/S15ssh_gen_host_keys
EOF
chmod a+x /etc/rc2.d/S15ssh_gen_host_keys
</presource> === Change timezone === You might want to change timezone if you do not live in $UTC. The following example is for Germany <source lang="bash">ln -sf /usr/share/zoneinfo/Europe/Berlin /etc/localtime</source>or even better<source lang="bash">dpkg-reconfigure tzdata</source> === Create vzfifo script (for Jessie only) === This step is required '''for Jessie only''' (and is handled automatically by vzctl for earlier Debian releases). It ensures that <code>vzctl start --wait</code> works as expected. <source lang="bash"># Create vzfifo servicecat >> /lib/systemd/system/vzfifo.service << EOF# This file is part of systemd.## systemd is free software; you can redistribute it and/or modify it# under the terms of the GNU General Public License as published by# the Free Software Foundation; either version 2 of the License, or# (at your option) any later version. [Unit]Description=Tell that Container is startedConditionPathExists=/proc/vzConditionPathExists=!/proc/bcAfter=multi-user.target quotaon.service quotacheck.service [Service]Type=forkingExecStart=/bin/touch /.vzfifoTimeoutSec=0RemainAfterExit=noSysVStartPriority=99 [Install]WantedBy=multi-user.targetEOF # Enable servicefor service in vzfifo; do systemctl enable $service > /dev/null 2>&1done</source>
=== Clean packages ===
Also, remove DNS server and search domain information from ''/etc/resolv.conf'' file '''in VE''':
sudo nano editor /vz/private/777/etc/resolv.conf Also, remove ''/etc/hostname'' file '''in VE''': sudo rm -f /vz/private/777/etc/hostname
Stop the VE:
Now create a cached OS tarball. In the command below, you'll want to replace <tt>i386</tt> with your architecture (i386, amd64, ia64, etc).
sudo tar --numeric-owner -zcf /vz/template/cache/debian-45.0-i386-minimal.tar.gz .
Look at the resulting tarball to see its size is sane:
# ls -lh /vz/template/cache
-rw-r--r-- 1 root root 51M Apr 10 03:16 debian-45.0-i386-minimal.tar.gz
== Checking if template cache works ==
We can now create a VE based on the just-created template cache. Be sure to change <tt>i386</tt> to your architecture just like you did when you named the tarball above.
sudo vzctl create 123456 --ostemplate debian-45.0-i386-minimal
Now make sure that it works:
sudo vzctl destroy 777
sudo rm /etc/vz/conf/777.conf.destroyed
You might want to edit /etc/vz/vz.conf and change DEF_OSTEMPLATE to the name of the template you use most often so that you don't have to specify the template when creating a VE.
DEF_OSTEMPLATE="debian-6.0-i386-minimal"
If you use iptables, you might want to include additional modules in the list for IPTABLES in /etc/vz/vz.conf. See ''man vzctl'' for a list of available modules.
[[Category: HOWTO]]
[[Category: Templates]]
[[Category: Debian]]