4
edits
Changes
no edit summary
This page is about making a template cache for OpenVZ VE container from Gentoo Linux. The method is basically the same as described in [[Slackware template creation]] article.
We will make the template from a stage3 file. An OpenVZ OS template should be an archive (.tar.gz) of the root of a working system, but without the kernel and some files. You can download stage3 from the nearest mirror here: from http://www.gentoo.org/main/en/mirrors.xmlor directly from http://distfiles.gentoo.org/releases/x86/current-stage3/
---- == Or try to Download 64 bit stage3 == If you experience with 32bit containers you can also try to create Gentoo template with 64bits binary support. Try to download '''64bit''' stage3. For 64bit Gentoo template creation, search for nearest mirrors http://www.gentoo.org/main/en/mirrors.xml or directly from: http://distfiles.gentoo.org/releases/amd64/autobuilds/current-stage3/ with 32bit binary '''multilib''' support, or http://distfiles.gentoo.org/releases/amd64/autobuilds/current-stage3/hardened/ (stage3-amd64-hardened+nomultilib-20xxxxxx.tar.bz2) try the hardend profile without multilib support (only 64bit binary support for gentoo template containers!!) Don't forget that hostnode must support 64bit binary too, with or without 32bit multilib support!! Hostnodes that supports multilib can start 64bits containers with 32bits containers but with a '''''slight''''' performance degradation. Don't forget to look for:<pre>ACCEPT_KEYWORDS="amd64" in /etc/make.conf</pre> there you can accept 64bit binary packages support for your containers.<pre>cat /proc/cpuinfo</pre> for 64 bits Intel\AMD CPU instructions set support. '''WARNING''': There is no warrantied that template should work, you can bugtack the errors. But I haven't confronted with problem. ==Create directory directories for the new VE container and unarchive stage3 ===
<pre>
mkdir /vz/root/1001mkdir /vz/private/7771001tar -xjf xvjpf /root/stage3-i686-2006.020111213.tar.bz2 -C /vz/private/7771001
</pre>
<pre>
vzctl set 777 1001 --applyconfig vps.basic --save
</pre>
<pre>
</pre>
== Edit CT Config ==
First, you need to let vzctl know that this CT is using Gentoo:
echo 'OSTEMPLATE="gentoo"' >> /etc/vz/conf/1001.conf
Creation of container at end of this HowTo obeys quota limits and might exceed
those limits set in <code>vps.basic</code> by default (at least encountered with Gentoo
10.1 release). Thus it might be required to increase limits now. The following
values are providing 2 GB soft limit with 2.5 GB hard limit:
DISKSPACE="2.4G:2.5G"
If you use independed Gentoo portage tree for each container, is considered correct in the use of gentoo containers, don't forget to raise inodes number
DISKINODES="400000:420000"
You should also increase the ram to a minimum of 512 MB. Otherwise, you will get errors during compilation. Since vzctl 3.0.30 you can do:
vzctl set 1001 --ram 512M --swap 1G --save
Prior to vzctl 3.0.30 you have to do, which gives you 512 MB guaranteed and 1024 MB burstable:
vzctl set 1001 --vmguarpages 512M --save
vzctl set 1001 --oomguarpages 512M --save
vzctl set 1001 --privvmpages 512M:1024M --save
vzctl set 1001 --swappages 0:1024M --save
Independed Gentoo portage tree for each container would be good idea, because newer portage can delete older ebuilds already installed in container with other dependences.
Otherwise you can't reinstall already installed packages if you bind the newer version of portage in gentoo containers.
After that you copy that configuration file turning it into a sample configuration for later use:
# cp /etc/vz/conf/1001.conf /etc/vz/conf/ve-gentoo.conf-sample
<pre>
rm -f /vz/private/7771001/etc/mtabln -s /proc/mounts /vz/private/7771001/etc/mtab
</pre>
After replacing <code>/etc/mtab</code> with a symlink to <code>/proc/mounts</code>, you will always have up-to-date information of what is mounted in <code>/etc/mtab</code>.You will, however, have an error on boot (in <code>/var/log/init.log</code>) that can be safely ignored: <code>* /etc/mtab is not updateable [ !! ]</code>
<pre>
echo "proc /proc proc defaults 0 0" > /vz/private/7771001/etc/fstab
</pre>
We need only <code>/proc</code> to be mounted at boot time.
File <precode>c?:1235:respawn:/sbinvz/agetty 38400 tty? linuxprivate/1001/etc/init.d/halt.sh</precode>is deleted in Gentoo 11.2 and doesn't need to edit.
This prevents <code>getty</code> and login from starting on ttys that do not exist in VEscontainers.
Edit <code>/vz/private/7771001/etc/shadow</code>, and change root's password in the first line to an exclamation mark (!):
<pre>root:!:10071:0:::::</pre>
This will disable root login until the password is changed with <code>vzctl set VEID CTID --userpasswd root:password</code>.
The checkroot and consolefont init scripts should not be started inside VEscontainers:(NOT! for Gentoo 11.2)<pre>rm /vz/private/1001/etc/runlevels/boot/checkrootrm /vz/private/1001/etc/runlevels/boot/consolefont</pre>
Gentoo 11.2 release have an option in '''rc.conf'''
just uncoment rc_sys and type "openvz" and it disables init scripts
<pre>
</pre>
Edit <code>/vz/private/7771001/sbin/rc</code>, and put a hash mark (#) at the beginning of line 244 (your line number may be different):
<pre># try mount -n ${mntcmd:--t sysfs sysfs /sys -o noexec,nosuid,nodev}</pre>
This prevents the VE container from attempting to mount <code>/sys</code>. To ensure that this change isn't automatically overwritten on update, add the following to <code>/vz/private/1001/etc/make.conf</code>: <pre>CONFIG_PROTECT="/sbin/rc"</pre>
'''Baselayout 2 and OpenRC:''' <div class="previewnote"code>/vz/private/1001/etc/conf.d/rc<p><strong/code>NOTEis obsolete (http: udev-state does not exists anymore!! //www.gentoo.org/libdoc/udeven/state openrc-migration.xml#doc_chap2_sect2) and ..<code>/vz/private/lib1001/udevetc/devices are empty directories now.rc.. maybe someone knows how to handle it the right way?conf</strongcode>should be used instead. But, RC_DEVICES is missing in <code>/p>vz/private/1001/etc/rc.conf</divcode>?!?
<pre>
cd /vz/private/7771001/librm udev-state/devices.tar.bz2
mknod udev/devices/ttyp0 c 3 0
mknod udev/devices/ptyp0 c 2 0
</pre>
Edit <code>/vz/private/7771001/etc/conf.d/rc</code> or <code>/vz/private/1001/etc/conf.d/udev</code> if you using Gentoo 11.2 or future and change the <code>RC_DEVICES</code> line and <code>RC_DEVICE_TARBALL</code> lines to:
<pre>
RC_DEVICES="staticudev"RC_DEVICE_TARBALL="no"
</pre>
You have to leave the directory you are in for the next step to be OK, otherwise you will get this error message : <br> vzquota : (error) Quota on syscall for 7771001: Device or resource busy <br> vzquota on failed [3] <br>
<pre>
</pre>
===Test=Edit /etc/pam.d/chpasswd == Some changes are required for successful setting user's password with <code>vzctl</code> util.Edit <code>/vz/private/1001/etc/pam.d/chpasswd</code> and change the <code>password</code> lines to:
<pre>
password required pam_unix.so md5 shadow</pre> == Test == <pre>vzctl start 7771001vzctl enter 7771001
</pre>
</pre>
All services in boot and default runlevels must be started. If everything Enable SSH daemon if required: <pre>rc-update add sshd default</pre> {{Warning|'''Do not start sshd''' in template container as it would create server's pair of keys then shared among all right, containers instantiated later.}} Next leave container pressing Ctrl+D and stop the VEit:
<pre>
vzctl stop 7771001
</pre>
{{Warning|This step is optional and will result in shared files between VEscontainers! These steps can save space on disk but trade isolation and security... consider your options carefully!}}
To install software into a VE container with portage, you should mount <code>/usr/portage</code> into the VE container with the "bind" option. Do the following on the host after the VE container is started:
<pre>
mkdir /vz/root/7771001/usr/portagemount -o bind /usr/portage /vz/root/7771001/usr/portage
</pre>
<pre>
mount -n -o bind /usr/portage/distfiles /vz/root/7771001/usr/portage/distfiles
</pre>
Now, to install a package into a VEcontainer, you just need to enter the VE container using <code>vzctl enter</code> and run
<pre>
while you have all the needed files in the <code>/usr/portage/distfiles</code> of host system.
For security reasons, you should have these directories mounted only while installing software into a VEcontainer. {{Note|you have to <code>umount /vz/root/1001/usr/portage/distfiles</code> before trying to stop your container.}} == Dedicated installation of portage ==
<pre>
</pre>
===Test the new template cache file=Host system portage tree and distfiles in read-only mode ==
<pre>
</pre>
Make it executable: <pre>chmod u+x /etc/vz/conf/vps.mount</pre> Add the following strings to the <code>/vz/private/1001/etc/make.conf</code>: <pre>PORTAGE_RO_DISTDIRS="/usr/portage/distfiles"DISTDIR="/usr/portage_distfiles"</pre> You should update host-node portage tree on regular basis to keep it up to date because <code>emerge --sync</code> won't work inside guest container. == Create the template cache file == <pre>cd /vz/private/1001/tar --numeric-owner -czf /vz/template/cache/gentoo.tar.gz *</pre> == Test the new template cache file == Create a new container from the template file: <pre>vzctl create 800 --config gentoo --ipadd 192.168.0.10 --hostname testvps</pre> If the VE container was created successfully, try to start it:
<pre>
</pre>
If it started, and you can ssh in, enter it using <pre>vzctl enter 800</pre> congratulations, you've got a working Gentoo template! == Log in over SSH == Leave container by hitting Ctrl+D. To log in over SSH now, you need to set root's password in running container first: <pre>vzctl set 800 --userpasswd root:secret</pre> Of course, you should use different password (replacing <code>secret</code> above) obeying common rules for strong passwords. After that container is ready for login over SSH <pre>ssh root@192.168.0.10</pre>
[[Category: HOWTO]]
[[Category: Templates]]
[[Category: Gentoo]]