Changes

utility to control perform various operations on an OpenVZ container.</p>

<p styletable width="margin-left:11100%; margin-top: 1em">vzctlborder="0" rules="none" frame="void"[<i>flags</i>] <b>create</b> <i>CTID</i cellspacing="0" cellpadding="0">[<b>--ostemplate</b> <i>name</i>] [<b>--config</btr valign="top" align="left"><i>name</i>] [<b>--private</b> <itd width="11%">path</i>] [<b>--root</btd><i>path</i>] [<b>--ipadd</b> <i>addr</i>] [<b>--hostname</b><i>name</i>]</ptd width="7%">

<p style="margin-left:11%; margin-top: 1em">vzctl[<ib>flagsvzctl</i>] <b>set</bp> <i>CTID parameters</itd>[<btd width="2%">--save</btd>]</ptd width="80%">

<p style="margin-left:11%; margin-top: 1em">vzctl[<i>flags</i>] <b>destroycreate</b> | <bi>mountCTID --parameter value</bi> | <b>umount[...]</bp>| <b>start</btd> | <b>stop</btr> | <b>restart</btr valign="top" align="left"> |<btd width="11%">status</btd> | <b>quotaon</b> | <b>quotaoff</b> |<b>quotainit</b> <i>CTID</i></ptd width="7%">

<p style="margin-left:11%; margin-top: 1em">vzctl[<ib>flagsvzctl</i>] <b>exec</b> | <bp>exec2</b> <itd>CTIDcommand</i> [<itd width="2%">arg</itd> ...]</ptd width="80%">

<p style="margin-left:11%; margin-top: 1em">vzctl[<i>flags</i>] <b>enterstart</b> <i>CTID</i> [<b>--execwait</b>][<ib>command--force</ib> ] [<ib>arg--skip-fsck</ib> ...][<b>--skip-remount</b>]</p> </td></tr><tr valign="top" align="left"><td width="11%"></td><td width="7%">

<p style="margin-left:11%; margin-top: 1em">vzctl[<ib>flagsvzctl</ib>] <b/p>runscript</btd> <itd width="2%">CTID script</itd></ptd width="80%">

<p style="margin-left:11%; margin-top: 1em">vzctl[<i>flags</i>] <b>stop</b> <i>CTID</i> [<b>--helpfast</b> | ][<b>--versionskip-umount</b>]</p> </td></tr><tr valign="top" align="left"><td width="11%"></td><td width="7%">

<p><b>vzctl</b></p></td><td width="2%"></td><td width= DESCRIPTION =="80%">

<p style="margin>[<i>flags</i>] <b>restart</b> <i>CTID</i>[<b>--wait</b>] [<b>--force</b>] [<b>-left:11%; margin-top: 1em"fast</b>Utility][<b>vzctl--skip-fsck</b> runs on the host system (otherwise known as] [<b>--skip-remount</b>]</p></td></tr>Hardware Node, or HN) and performs direct manipulations with<tr valign="top" align="left">containers (CTs).<td width="11%"></ptd><td width="7%">

<p style="margin-left:11%; margin-top: 1em">Containers canbe referred to by either numeric <ib>vzctl</b></p>CTID</itd> or by name (see<btd width="2%">--name</btd> option). Note that CT ID &lt;= 100 arereserved for OpenVZ internal purposes.</ptd width="80%">

<p>[<i>flags</i>] <b>suspend</b> | <b>resume</b><i>CTID</i> [<b>--dumpfile&nbsp;</b><i>name</i>]</p></td></tr><tr valign="top" align= OPTIONS "left"><td width="11%"></td><td width="7%">

<p><b>vzctl</b></p></td><td width="2%"></td><td width== Flags ==="80%">

<p style>[<i>flags</i>] <b>snapshot</b> <i>CTID</i>[<b>--id&nbsp;</b><i>uuid</i>][<b>--name&nbsp;</b><i>name</i>][<b>--description&nbsp;</b><i>desc</i>][<b>--skip-suspend</b>] [<b>--skip-config</b>]</p></td></tr><tr valign="margin-top: 1em" align="left">These flags come before acommand, and can be used with any command. They affect<td width="11%"></td>logging to console (terminal) only, and do not affectlogging to a log file.</ptd width="7%">

<p style="margin-left:11%;"><b>--quietvzctl</b></p></td><td width="2%"></td><td width="80%">

<p style>[<i>flags</i>] <b>snapshot-switch</b> <i>CTID</i>[<b>--skip-resume</b> | <b>--must-resume</b>][<b>--skip-config</b>] <b>--id</b> <i>uuid</i></p></td></tr><tr valign="top" align="margin-left:17"><td width="11%;">Disables output. Note that</td>scripts run by vzctl are still able to produce someoutput.</ptd width="7%">

<p style="margin-left:11%;"><b>--verbosevzctl</b></p></td><td width="2%"></td><td width="80%">

<p style="margin-left:17%;">Increments logging level upfrom the default. Can be used multiple times. Default valueis set to the value of [<bi>VERBOSEflags</bi> parameter in theglobal configuration file [[Man/vz.conf.5|] <b>vz.confsnapshot-delete</b>(5)]], or to <bi>0CTID</bi>if not set by <b>VERBOSE--id</b> parameter.<i>uuid</i></p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="7%">

<p><b>vzctl</b></p></td><td width="2%"></td><td width== Setting container parameters ==="80%">

<p style="margin-left:11%;">[<i>flags</i>] <b>setsnapshot-mount</b> <i>CTIDparameters</i> [<b>--saveid</b>] [<i>uuid</i> <b>--forcetarget</b>]<i>dir</i></p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="7%">

<p style="margin-left:17%;">This command sets variouscontainer parameters. If a <b>--savevzctl</b> flag is given,parameters are saved in container configuration file[[Man/ctid.conf.5|<b>ctid.conf</b>(5)]]. Use <bp>--force</btd> to save theparameters even if the current kernel doesn&rsquo;t supportOpenVZ. If the container is currently running, <btd width="2%">vzctl</btd>applies these parameters to the container.</ptd width="80%">

<p style="margin>[<i>flags</i>] <b>snapshot-left:17%; margin-top: 1em"umount</b> <i>CTID</i>The followingparameters can be used with <b>set--id</b> command.<i>uuid</i></p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="7%">

<p style="margin-left:11%;"><b>Miscellaneous vzctl<br/b></p>--onboot yes</btd>|<btd width="2%">no</btd></ptd width="80%">

<p style="margin>[<i>flags</i>] <b>snapshot-left:17%;"list</b> <i>CTID</i>Sets whether the container willbe started during system boot[<b>-H</b>] [<b>-o</b> <i>field</i>[,<i>field</i>... The container will not be]auto[<b>--started unless this parameter is set to id</b> <i>yesuuid</i>.]</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="7%">

<p style="margin-left:11%;"><b>--bootordervzctl</b></p></td><itd width="2%">number</itd></ptd width="80%">

<p style="margin-left:17%;">Sets the boot order priorityfor this CT. The higher the [<i>flags</i>number] <b>set</b> <i>CTID --parameter value</i> is, the earlier inthe boot process this container starts[... By default this] [<b>--save</b>] [<b>--force</b>]parameter is unset, which is considered to be the lowestpriority, so containers with unset [<b>--setmode&nbsp;restart</b>|<b>bootorderignore</b> will]</p> </td></tr><tr valign="top" align="left">start last.<td width="11%"></ptd><td width="7%">

<p style="margin-left:11%;"><b>--rootvzctl</b> <i/p>path</itd><td width="2%"></ptd><td width="80%">

<p style="margin-left:17%;">Sets the path to root directoryfor this container. This is essentially a mount point forcontainer&rsquo;s root directory. Argument can containliteral string [<i>flags</i>] <b>$VEIDset</b>, which will be substituted withthe numeric CT ID. Changing this parameter is not<i>CTID</i>recommended, better edit [[Man/vz.conf.5|<b>vz.conf--reset_ub</b>(5)]] global</p> </td></tr><tr valign="top" align="left">configuration file.<td width="11%"></ptd><td width="7%">

<p style="margin-left:11%;"><b>--userpasswdvzctl</b><i/p>user</itd>:<itd width="2%">password</itd></ptd width="80%">

<p style="margin-left:17%;">Sets password for the given[<i>flags</i>] <b>destroy</b> | <b>delete</b> |user in a container, creating the user if it does not<b>mount</b> | <b>umount</b> | <b>status</b> |exists. Note that this option is not saved in configurationfile at all (so <b>--savequotaon</b> | <b>quotaoff</b> | <b>quotainit</b> flag is useless), it isapplied to the container (by modifying its <i>CTID</etci></passwd andp> </etctd></shadow files).tr><tr valign="top" align="left"><td width="11%"></ptd><td width="7%">

<p style><b>vzctl</b></p></td><td width="margin-left:172%; margin-top: 1em">In case</td>container root filesystem is not mounted, it isautomatically mounted, then all the appropriate file changesare applied, then it is unmounted.</ptd width="80%">

<p style>[<i>flags</i>] <b>console</b> <i>CTID</i>[<i>ttynum</i>]</p> </td></tr><tr valign="top" align="margin-left:17"><td width="11%; margin-top: 1em">Note that</td>container should be created before using this option.</ptd width="7%">

<p style="margin-left:11%;"><b>--disabledvzctl</b><i/p>yes</itd>|<itd width="2%">no</itd></ptd width="80%">

<p style="margin-left:17%;">Disable container start. To[<i>flags</i>] <b>convert</b> <i>CTID</i>force the start of a disabled container, use [<b>vzctl start--forcelayout&nbsp;ploop</b>[<b>:</b>.{<b>expanded</b>|<b>plain</b>|<b>raw</b>}]]</p> </td></tr><tr valign="top" align="left"><td width="11%"></td><td width="7%">

<p style="margin-left:11%;"><b>--namevzctl</b> <i/p>name</itd><td width="2%"></ptd><td width="80%">

<p style="margin-left:17%;">Add a name for a container. The[<i>nameflags</i> can later be used in subsequent calls to] <b>vzctlcompact</b> in place of <i>CTID</i>.</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="7%">

<p style="margin-left:11%;"><b>--descriptionvzctl</b></p></td><itd width="2%">string</itd></ptd width="80%">

<p style>[<i>flags</i>] <b>exec</b> | <b>exec2</b> <i>CTIDcommand</i> [<i>arg</i> ...]</p></td></tr><tr valign="top" align="margin-left:17"><td width="11%;">Add a textual description for a</td>container.</ptd width="7%">

<p style="margin-left:11%;"><b>--setmoderestartvzctl</b>|<b/p>ignore</btd><td width="2%"></ptd><td width="80%">

<p style>[<i>flags</i>] <b>enter</b> <i>CTID</i>[<b>--exec&nbsp;</b><i>command&nbsp;</i>[<i>arg&nbsp;</i>...]]</p> </td></tr><tr valign="top" align="margin-left:17"><td width="11%;">Whether to restart a container</td>after applying parameters that require the container to berestarted in order to take effect.</ptd width="7%">

<p style="margin-left:11%;"><b>Networking vzctl</b><br/p>--ipadd</btd> <itd width="2%">addr</itd></ptd width="80%">

<p style>[<i>flags</i>] <b>runscript</b> <i>CTID script</i></p></td></tr><tr valign="top" align="margin-left:17%;">Adds IP address to a givencontainer. Note that this option is incremental, so<itd width="11%">addr</itd> are added to already existing ones.</ptd width="7%">

<p style="margin-left:11%;"><b>--ipdelvzctl</b> <i/p>addr</itd> |<btd width="2%">all</btd></ptd width="80%">

<p style="margin-left:17%;">Removes IP address <ib>addr--help</ib>from a container. If you want to remove all the addresses,use | <b>--ipdel allversion</b>.</p></td></tr></table>

<p style="margin-left:11%;"><b>--hostname</b><i>name</i></p>= DESCRIPTION ==

<p style="margin-left:1711%;margin-top: 1em">Sets container hostname.Utility<b>vzctl</b> writes it to runs on the appropriate file inside ahost system (otherwise known asHardware Node, or HN) and performs direct manipulations withcontainer containers (distribution-dependentCTs).</p>

<p style="margin-left:11%;margin-top: 1em">Containers canbe referred to by either numeric <i>CTID</i> or by name (see<b>--nameservername</b>option). Note that CT ID &lt;= 100 arereserved for OpenVZ internal purposes. A numeric ID shouldnot be more than <ib>addr2147483644</ib>.</p>

<p style="margin-left:17%;">Sets DNS server IP address fora container. If you want to set several nameservers, youshould do it at once, so use <b>--nameserver</b> optionmultiple times in one call to <b>vzctl</b>, as all the nameserver values set in previous calls to <b>vzctl</b> areoverwritten.</p>= OPTIONS ==

<p style="margin-left:11%;"><b>--searchdomain</b><i>name</i></p>== Flags ===

<p style="margin-lefttop:17%;1em">Sets DNS search domains for These flags come before acontainercommand, and can be used with any command. If you want They affectlogging to set several search domainsconsole (terminal) only, youshould and do it at once, so use <b>--searchdomain</b> optionnot affectmultiple times in one call logging to <b>vzctl</b>, as all thesearch domain values set in previous calls to <b>vzctl</b>are overwrittena log file.</p>

<p style="margin-left:11%;"><b>--netif_addquiet</b><i>ifname[</i>,<i>mac</i>,<i>host_ifname</i>,<i>host_mac</i>,<i>bridge]</i></p>

<p style="margin-left:17%;">Adds a virtual Ethernet device(veth) to a given container. Here <i>ifname</i> is theEthernet device name in the container, <i>mac</i> is its MACaddress, <i>host_ifname</i> is the Ethernet device name onthe host, and <i>host_mac</i> is its MAC address. MACaddresses should be in the format like XX:XX:XX:XX:XX:XXDisables output.Note that<i>bridge</i> is an optional parameter which can be used incustom network start scripts run by vzctl are still able to automatically add theinterface to a bridge. All parameters except <i>ifname</i>are optional and are automatically generated if notproduce somespecifiedoutput.</p>

<p style="margin-left:11%;"><b>--netif_del</b><i>dev_name</i> | <b>allverbose</b></p>

<p style="margin-left:17%;">Removes virtual Ethernet deviceIncrements logging level upfrom a containerthe default. Can be used multiple times. If you want Default valueis set to remove all devicesthe value of <b>VERBOSE</b> parameter in theglobal configuration file [[Man/vz.conf.5|<b>vz.conf</b>(5)]], useor to <b>0</b>if not set by <b>allVERBOSE</b>parameter.</p> === Setting container parameters ===

<p styletable width="margin-left:11100%;" border="0" rules="none" frame="void" cellspacing="0" cellpadding="0"><btr valign="top" align="left">Veth interfaceconfiguration<td width="11%"></btd></ptd width="4%">

<p style="margin-left:11%; margin-top: 1em">The followingoptions can be used to reconfigure the already-createdvirtual Ethernet interface. To select the interface toconfigure, use <b>--ifnameset</b> <i/p>name</i> option. <b><brtd>--mac</btd width="2%"> <i>XX:XX:XX:XX:XX:XX</itd></ptd width="83%">

<p style="margin-lefttop: 1em"><i>CTID</i>[<b>--onboot&nbsp;yes</b>|<b>no</b>][<b>--bootorder&nbsp;</b><i>number</i>][<b>--root&nbsp;</b><i>path</i>][<b>--private&nbsp;</b><i>path</i>][<b>--mount_opts&nbsp;</b><i>options</i>][<b>--userpasswd&nbsp;</b><i>user</i>:<i>pass</i>][<b>--disabled&nbsp;yes</b>|<b>no</b>][<b>--name&nbsp;</b><i>name</i>][<b>--description&nbsp;</b><i>string</i>][<b>--ostemplate&nbsp;</b><i>string</i>][<b>--stop-timeout&nbsp;</b><i>seconds</i>][<b>--ipadd&nbsp;</b><i>addr</i>][<b>--ipdel&nbsp;</b><i>addr</i>|<b>all</b>][<b>--hostname&nbsp;</b><i>name</i>][<b>--nameserver&nbsp;</b><i>addr</i>][<b>--searchdomain&nbsp;</b><i>name</i>][<b>--netif_add&nbsp;</b><i>dev</i>[,<i>params</i>...]][<b>--netif_del&nbsp;</b><i>dev</i>|<b>all</b>][<b>--ifname</b> <i>dev</i>[<b>--mac&nbsp;</b><i>hwaddr</i>][<b>--host_ifname&nbsp;</b><i>dev</i>][<b>--host_mac&nbsp;</b><i>hwaddr</i>][<b>--bridge&nbsp;</b><i>name</i>][<b>--mac_filter&nbsp;on</b>|<b>off</b>]][<b>--numproc&nbsp;</b><i>items</i>][<b>--numtcpsock&nbsp;</b><i>items</i>][<b>--numothersock&nbsp;</b><i>items</i>][<b>--vmguarpages&nbsp;</b><i>pages</i>][<b>--kmemsize&nbsp;</b><i>bytes</i>][<b>--tcpsndbuf&nbsp;</b><i>bytes</i>][<b>--tcprcvbuf&nbsp;</b><i>bytes</i>][<b>--othersockbuf&nbsp;</b><i>bytes</i>][<b>--dgramrcvbuf&nbsp;</b><i>bytes</i>][<b>--oomguarpages&nbsp;</b><i>pages</i>][<b>--lockedpages&nbsp;</b><i>pages</i>][<b>--privvmpages&nbsp;</b><i>pages</i>][<b>--shmpages&nbsp;</b><i>pages</i>][<b>--numfile&nbsp;</b><i>items</i>][<b>--numflock&nbsp;</b><i>items</i>][<b>--numpty&nbsp;</b><i>items</i>][<b>--numsiginfo&nbsp;</b><i>items</i>][<b>--dcachesize&nbsp;</b><i>bytes</i>][<b>--numiptent&nbsp;</b><i>num</i>][<b>--physpages&nbsp;</b><i>pages</i>][<b>--swappages&nbsp;</b><i>pages</i>][<b>--ram&nbsp;</b><i>bytes</i>][<b>--swap&nbsp;</b><i>bytes</i>][<b>--vm_overcommit&nbsp;</b><i>float</i>][<b>--cpuunits&nbsp;</b><i>num</i>][<b>--cpulimit&nbsp;</b><i>num</i>][<b>--cpus&nbsp;</b><i>num</i>][<b>--cpumask&nbsp;</b><i>cpus</i>|<b>auto</b>|<b>all</b>][<b>--nodemask&nbsp;</b><i>nodes</i>|<b>all</b>][<b>--meminfo&nbsp;none</b>|<i>mode</i>:<i>value</i>][<b>--iptables&nbsp;</b><i>name</i>[<b>,</b>...]][<b>--netfilter&nbsp;disabled</b>|<b>stateless</b>|<b>stateful</b>|<b>full</b>][<b>--netdev_add&nbsp;</b><i>ifname</i>][<b>--netdev_del&nbsp;</b><i>ifname</i>][<b>--diskquota&nbsp;yes</b>|<b>no</b>][<b>--diskspace&nbsp;</b><i>num</i>][<b>--diskinodes&nbsp;</b><i>num</i>][<b>--quotatime&nbsp;</b><i>seconds</i>][<b>--quotaugidlimit&nbsp;</b><i>num</i>][<b>--capability&nbsp;</b><i>capname</i>:22%<b>on</b>|<b>off</b>[<b>,</b>...]][<b>--devnodes&nbsp;</b><i>param</i>][<b>--devices&nbsp;</b><i>param</i>][<b>--pci_add&nbsp;</b><i>dev</i>][<b>--pci_del&nbsp;"</b><i>dev</i>MAC address of interface inside]a container[<b>--features&nbsp;</b><i>name</i>:<b>on</b>|<b>off</b>[<b>,</b>...]][<b>--applyconfig&nbsp;</b><i>name</i>][<b>--applyconfig_map&nbsp;</b><i>group</i>][<b>--ioprio&nbsp;</b><i>num</i>][<b>--iolimit&nbsp;</b><i>mbps</i>][<b>--iopslimit&nbsp;</b><i>iops</i>] [<b>--save</b>][<b>--force</b>] [<b>--reset_ub</b>][<b>--setmode&nbsp;restart</b>|<b>ignore</b>]</p> </td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"></td><td width="2%"></td><td width="83%">

<p style="margin-left:11%;">This command sets various container parameters. If thecontainer is currently running, <b>--host_ifnamevzctl</b>applies theseparameters to the container. The following options can beused with <ib>nameset</ib>command.</p></td></tr></table>

<p style="margin-left:22%;">interface name for virtualinterface in the host system.</p>=== Flags ====

<p style="margin-left:11%;"><b>--host_macsave</b><i>XX:XX:XX:XX:XX:XX</i></p>

<p style="margin-left:2217%;">MAC address of interface If this flag is given,parameters are saved in thecontainer configuration filehost system[[Man/ctid.conf.5|<b>ctid.conf</b>(5)]].</p>

<p style="margin-left:11%;"><b>--bridgeforce</b> <i>name</i></p>

<p style="margin-left:2217%;">Bridge nameIf this flag is given togetherwith <b>--save</b>, parameters are saved even if the currentkernel doesn&rsquo;t support OpenVZ. Custom networkNote this flag does notstart scripts can use this value to automatically add themake sense without <b>--save</b>, so <b>--save</b> isinterface to a bridgerequired.</p>

<p style="margin-left:11%;"><b>--mac_filterreset_ub</b><i>on|off</i></p>

<p style="margin-left:2217%;">EnablesIf this flag is given,<b>vzctl</disables MAC addressfiltering for the Container veth device and the possibilityof configuring the MAC address of this device b> applies all User Beancounter parameters from insidethe Containerconfiguration file to a running container. If the filtering This is turned on: <br>&bull; the veth device accepts only those packets that havehelpful in case configuration file is modified manually.a MAC address in their headers corresponding to that of Please note thisdevice (excluding all broadcast and multicast packets); <br>&bull; flag is exclusive, i.e. it is impossible to modify the veth MAC address fromcan not beinside the Containercombined with any other options or flags.</p>

<p style="margin-left:2211%; margin"><b>--top: 1em"setmode restart</b>By default,|this functionality is enabled for all veth devices existinginside the Container.<b>ignore</b></p>

<p style="margin-left:1117%;">A few parameters can only beapplied by restarting the container. By default,<b>Resource limitsvzctl</b>prints a warning if such parameters aresupplied and a container is running. Use <b>--setmoderestart</b> together with <b>--save</b> flag to restart acontainer in such a case, or <b>--setmode ignore</b> tosuppress the warning.</p>

<p style="margin-left:22%; margin-top: 1em">The followingoptions sets barrier and limit for various userbeancounters. Each option requires one or two arguments. Incase of one argument, <b>vzctl</b> sets barrier and limit tothe same value. In case of two colon-separated arguments,the first is a barrier, and the second is a limit. Eachargument is either a number, a number with a suffix, or aspecial value <b>unlimited</b>.</p>=== Miscellaneous ====

<p style="margin-left:2211%; margin-top: 1em">Arguments arein items, pages or bytes. Note that page size isarchitecture<b>--specific, it is 4096 bytes on IA32onboot yes</b> |platform.<b>no</b></p>

<p style="margin-left:2217%; margin-top: 1em">You can alsoSets whether the container willspecify different suffixes for be started during system boot. The container will be startedon boot by <b>setvz</b> parameters (exceptinitscript if either this parameter isfor the parameters which names start with set to <b>numyes</b>). For, or the container was running just beforeexamplelast reboot, <b>vzctl and this parameter is not setto </b> <i>CTIDno</i> <b>--privvmpages.5M:6M</b> should set <b>privvmpages</b>&rsquo; barrier to 5Default value is unset, meaning the container will bemegabytes and its limit to 6 megabytesstarted if it was running before the last reboot.</p>

<p style="margin-left:2211%; margin-top: 1em">Availablesuffixes are: <b><br>g</b>, <b>G</b> -- gigabytes. <b><br>m</b>, <b>M</b> -- megabytes. <b><br>k</b>, <b>Kbootorder</b> -- kilobytes. <b><br>p</b>, <bi>Pnumber</bi> -- pages (page is 4096 bytes on x86architecture, other architectures may differ).</p>

<p style="margin-left:2217%; margin-top: 1em">You can alsoSets the boot order priorityspecify for this CT. The higher the literal word <bi>unlimitednumber</bi> is, the earlier in place of anumberthe boot process this container starts. In that case By default thisparameter is unset, which is considered to be the corresponding value will be set tolowestpriority, so containers with unset <b>LONG_MAXbootorder</b>, i. e. the maximum possible valuewillstart last.</p>

<p style="margin-left:11%;"><b>--numprocroot</b><i>itemspath</i>[:<i>items</i>]</p>

<p style="margin-left:2217%;">Maximum number of processes andSets the path to root directorykernel-level threads(<b>VE_ROOT</b>) for this container. This is essentially amount point for container&rsquo;s root directory. Setting Argumentcan contain literal string <b>$VEID</b>, which will besubstituted with the barrier and the limit todifferent values does not make practical sensenumeric CT ID.</p>

<p style="margin-left:11%;"><b>--numtcpsockprivate</b><i>itemspath</i>[:<i>items</i>]</p>

<p style="margin-left:2217%;">Maximum number of TCP socketsSets the path to privatedirectory (<b>VE_PRIVATE</b>) for this container.This is aThis parameter limits directory in which all the number of TCP connections and,container&rsquo;s files arethusstored. Argument can contain literal string <b>$VEID</b>, the number of clients the server application canhandle in parallel. Setting which will be substituted with the barrier and the limit todifferent values does not make practical sensenumeric CT ID.</p>

<p style="margin-left:11%;"><b>--numothersockmount_opts</b><i>itemsoption</i>[:<b>,</b><i>itemsoption</i>...]</p>

<p style="margin-left:2217%;">Maximum number of non-TCPSets additional mount optionssockets (local sockets, UDP and other types of sockets)for container file system.Only applicable for <b>ploop</b>Setting the barrier and the limit to different values doesnot make practical senselayout, ignored otherwise.</p>

<p style="margin-left:11%;"><b>--vmguarpagesuserpasswd</b><i>pagesuser</i>[:<i>pagespassword</i>]</p> <p style="margin-left:17%;">Sets password for the givenuser in a container, creating the user if it does notexists. Note that this option is not saved in configurationfile at all (so <b>--save</b> flag is useless), it isapplied directly to the container, by runningdistribution-specific programs inside the container. It isnot recommended to combine this option with any otheroptions.</p>

<p style="margin-left:2217%;margin-top: 1em">Memory allocation guarantee.In caseThis parameter controls how much memory container was not running, it is available to aautomatically started thencontainer. The barrier is all the amount of memory thatcontainer&rsquo;s applications appropriate changes are guaranteed to be able toallocate. The meaning of the limit applied, then it is currently unspecified;it should be set to <b>unlimited</b>stopped.</p>

<p style="margin-left:1117%;margin-top: 1em"><b>--kmemsize</b>Note that<i>bytes</i>[:<i>bytes</i>]container should be created before using this option.</p>

<p style="margin-left:2211%;">Maximum amount of kernel memoryused. This parameter is related to <b>--numprocdisabled yes</b>. Eachprocess consumes certain amount of kernel memory - 16 KB atleast, 30-50 KB typically. Very large processes may consumea bit more. It is important to have a certain safety gapbetween the barrier and the limit of this parameter: equalbarrier and limit may lead to the situation where the kernelwill need to kill container&rsquo;s applications to keep the|<b>kmemsizeno</b> usage under the limit.</p>

<p style="margin-left:1117%;">Disable container start. Toforce the start of a disabled container, use <b>vzctl start--tcpsndbufforce</b><i>bytes</i>[:<i>bytes</i>].</p>

<p style="margin-left:2211%;">Maximum size of TCP sendbuffers. Barrier should be not less than 64 KB, anddifference between barrier and limit should be equal to ormore than value of <b>numtcpsock--name</b> multiplied by 2.5KB.<i>name</i></p>

<p style="margin-left:1117%;">Add a name for a container. The<i>name</i> can later be used in subsequent calls to<b>--tcprcvbufvzctl</b>in place of <i>bytesCTID</i>[:. Note this option cannot be used without <ib>bytes--save</ib>].</p>

<p style="margin-left:2211%;">Maximum size of TCP receivebuffers. Barrier should be not less than 64 KB, anddifference between barrier and limit should be equal to ormore than value of <b>numtcpsock--description</b> multiplied by 2.5KB.<i>string</i></p>

<p style="margin-left:1117%;"><b>--othersockbuf</b>Add a textual description for a<i>bytes</i>[:<i>bytes</i>]container.</p>

<p style="margin-left:2211%;">Maximum size of other (non<b>-TCP)socket send buffers. If container&rsquo;s processes needs tosend very large datagrams, the barrier should be setaccordingly. Increased limit is necessary for highperformance of communications through local (UNIX-domain)ostemplate</b>sockets.<i>string</i></p>

<p style="margin-left:1117%;">Sets a new value of<b>--dgramrcvbufOSTEMPLATE</b>parameter in container configuration file[[Man/ctid.conf.5|<ib>bytesctid.conf</ib>[:(5)]]. Requires <ib>bytes--save</ib>]flag. Usefulafter a change/upgrade of a distribution running insidecontainer, as vzctl uses the value of OSTEMPLATE to rundistribution-specific scripts.</p>

<p style="margin-left:2211%;">Maximum size of other (non<b>-TCP)-stop-timeout</b>socket receive buffers. If container&rsquo;s processes needsto receive very large datagrams, the barrier should be setaccordingly. The difference between the barrier and thelimit is not needed.<i>seconds</i></p>

<p style="margin-left:1117%;">Sets a time to wait forcontainer to stop on <b>--oomguarpagesvzctl stop</b>before forciblykilling it, in seconds. Note this option can not be usedwithout <ib>pages--save</i>[:<i>pages</ib>]flag.</p>

<p style="margin-left:2217%;margin-top: 1em">Guarantees against OOM kill.Under this beancounter the kernel accounts the total amountof memory and swap space used by the container&rsquo;sprocesses. The barrier of this parameter is theSpecial valueout-of-memory guarantee. If the <b>oomguarpages0</b> usage isbelow the barrier, processes of this container areguaranteed not means to be killed use compiled-in out-of-memory situations. Themeaning of limit is currently unspecified; it should be setto <b>unlimited</b>default.</p>

<p style="margin-left:11%;"><b>--lockedpages</b><i>pages</i>[:<i>pages</i>]</p>=== Networking ====

<p style="margin-left:2211%;">Maximum number of pagesacquired by <b>mlock--ipadd</b>(2).<i>addr</i></p>

<p style="margin-left:1117%;">Adds an IP address <bi>--privvmpagesaddr</bi>to a given container. Address can optionally have a netmaskspecified in the CIDR notation (e.g. <ib>pages10.1.2.3/25</ib>[:).Note that this option is incremental, so <i>pagesaddr</i>]areadded to already existing ones.</p>

<p style="margin-left:2211%;">Allows controlling the amountof memory allocated by the applications. For shared (mappedas <b>MAP_SHARED--ipdel</b>) pages, each container really using amemory page is charged for the fraction of the page(depending on the number of others using it). For&quot;potentially private&quot; pages (mapped as<i>addr</i> |<b>MAP_PRIVATEall</b>), container is charged either for afraction of the size or for the full size if the allocatedaddress space. In the latter case, the physical pagesassociated with the allocated address space may be inmemory, in swap or not physically allocated yet.</p>

<p style="margin-left:2217%; margin-top: 1em">The barrier andthe limit of this parameter control the upper boundary ofthe total size of allocated memory. Note that this upperRemoves IP address <i>addr</i>boundary does not guarantee that from a container will be able toallocate that much memory. The primary mechanism If you want to controlremove all the addresses,memory allocation is the use <b>--vmguarpagesipdel all</b> guarantee.</p>

<p style="margin-left:11%;"><b>--shmpageshostname</b><i>pagesname</i>[:<i>pages</i>]</p>

<p style="margin-left:2217%;">Maximum IPC SHM segment sizeSets container hostname.Setting <b>vzctl</b> writes it to the barrier and the limit to different values doesappropriate file inside anot make practical sensecontainer (distribution-dependent).</p>

<p style="margin-left:11%;"><b>--numfilenameserver</b><i>itemsaddr</i>[:<i>items</i>]</p>

<p style="margin-left:2217%;">Maximum number of open filesSets DNS server IP address fora container.If you want to set several nameservers, youIn most cases the barrier and the limit should be set to thedo it at once, so use <b>--nameserver</b> optionsame value. Setting the barrier multiple times in one call to <b>0vzctl</b> effectively, as all the namedisables pre-charging optimization for this beancounter server values set inthe kernel, which leads previous calls to the held value being precise but<b>vzctl</b> arecould slightly degrade file open performanceoverwritten.</p>

<p style="margin-left:1117%;margin-top: 1em">A special valueof <b>--numflockinherit</b>can be used to auto-propagate nameservervalue(s) from the host system&rsquo;s<ib>items</i>[:<i>itemsetc/resolv.conf</ib>]file.</p>

<p style="margin-left:2211%;">Maximum number of file locks.<b>--searchdomain</b>Safety gap should be between barrier and limit.<i>name</i></p>

<p style="margin-left:1117%;">Sets DNS search domains for acontainer. If you want to set several search domains, youshould do it at once, so use <b>--numptysearchdomain</b>optionmultiple times in one call to <ib>itemsvzctl</ib>[:, as all thesearch domain values set in previous calls to <ib>itemsvzctl</ib>]are overwritten.</p>

<p style="margin-left:2217%;margin-top: 1em">Number A special valueof pseudo<b>inherit</b> can be used to auto-terminalspropagate searchdomain value(PTYs). Note that in OpenVZ each container can have not morefrom the host system&rsquo;sthan 255 PTYs<b>/etc/resolv. Setting the barrier and the limit todifferent values does not make practical senseconf</b> file.</p>

<p style="margin-left:11%;"><b>--numsiginfonetif_add</b><i>itemsifname[</i>,<i>mac</i>[:,<i>host_ifname</i>,<i>itemshost_mac</i>,<i>bridge]</i></p>

<p style="margin-left:2217%;">Number of siginfo structures.Adds a virtual Ethernet deviceSetting the barrier and the limit (veth) to different values doesnot make practical sensea given container.Here <i>ifname</pi>is theEthernet device name in the container, <i>mac</i> is its MACaddress, <i>host_ifname<p style="margin-left:11%;"/i>is the Ethernet device name onthe host, and <bi>--dcachesizehost_mac</bi>is its MAC address. MACaddresses should be in the format like XX:XX:XX:XX:XX:XX.<i>bytesbridge</i>[:is an optional parameter which can be used incustom network start scripts to automatically add theinterface to a bridge. All parameters except <i>bytesifname</i>]are optional and are automatically generated if notspecified.</p>

<p style="margin-left:2211%;">Maximum size offilesystem<b>--related caches, such as directory entry and inodenetif_del</b>caches. Exists as a separate parameter to impose a limitcausing file operations to sense memory shortage and returnan errno to applications, protecting from memory shortagesduring critical operations that should not fail. Safety gapshould be between barrier and limit.<i>dev_name</i> | <b>all</b></p>

<p style="margin-left:1117%;">Removes virtual Ethernet devicefrom a container. If you want to remove all devices, use<b>--numiptentall</b><i>num</i>[:<i>num</i>]</p> <p style="margin-left:22%;">Number of iptables (netfilter)entries. Setting the barrier and the limit to differentvalues does not make practical sense.</p>

<p style="margin-left:11%;"><b>--physpages</b><i>pages</i>[:<i>pages</i>]</p>=== veth interface configuration ====

<p style="margin-left:2211%;margin-top: 1em">This is currently anThe followingaccountingoptions can be used to reconfigure the already-only parametercreatedvirtual Ethernet interface. It shows To select the usage of RAM by thisinterface tocontainer. Barrier should be set to 0configure, and limit should beset to use <b>unlimited--ifname</b><i>name</i> option.<b><br>--mac</b> <i>XX:XX:XX:XX:XX:XX</i></p>

<p style="margin-left:1122%;"><b>--swappages</b>MAC address of interface inside<i>pages</i>[:<i>pages</i>]a container.</p>

<p style="margin-left:2211%;">The limit, if set, is used toshow a total amount of swap space available inside thecontainer. The barrier of this parameter is currentlyignored. The default value is <b>unlimited--host_ifname</b>, meaningtotal swap will be reported as 0.<i>name</i></p>

<p style="margin-left:22%; margin-top: 1em">Note that interface name for virtualinterface inorder for the value to be shown as total swap space,<b>--meminfo</b> parameter should be set to value other than<b>none</b>host system.</p>

<p style="margin-left:11%;"><b>CPU fair scheduler--host_mac</b>parameters<i>XX:XX:XX:XX:XX:XX</bi></p>

<p style="margin-left:22%; margin-top: 1em">TheseMAC address of interface in theparameters control CPU usage by containerhost system.</p>

<p style="margin-left:1122%;margin-top: 1em"><b>--cpuunits</b>If you want anindependent communication with the Container through thebridge, you should specify a multicast MAC address here<i>num</i>(FE:FF:FF:FF:FF:FF).</p>

<p style="margin-left:2211%;">CPU weight for a container.Argument is positive non<b>--zero number, passed to and used inthe kernel fair scheduler. The larger the number is, themore CPU time this container gets. Maximum value is 500000,minimal is 8. Number is relative to weights of all the otherrunning containers. If bridge</b>cpuunits<i>name</bi> are not specified,default value of 1000 is used.</p>

<p style="margin-left:22%; ">Bridge name. Custom networkstart scripts can use this value to automatically add theinterface to a bridge.</p> <p style="margin-topleft: 1em11%;">You can set CPUweight for CT0 (host system itself) as well (use <b>vzctlset 0 --cpuunitsmac_filter on</b> <i>num</i>). Usually, OpenVZ initscript|(<b>/etc/init.d/vzoff</b>) takes care of setting this.</p>

<p style="margin-left:1122%;"><b>--cpulimit<Enables/b>disables MAC addressfiltering for the Container veth device and the possibilityof configuring the MAC address of this device from insidethe Container. If the filtering is turned on: <ibr>num&bull; the veth device accepts only those packets that havea MAC address in their headers corresponding to that of thisdevice (excluding all broadcast and multicast packets); </ibr>[<b>%</b>]&bull; it is impossible to modify the veth MAC address frominside the Container.</p>

<p style="margin-left:22%;margin-top: 1em">Limit of CPU usage for thecontainerBy default, in per cent. Note if the computer has 2 CPUs, ithas total of 200% CPU time. Default CPU limit this functionality is <b>0</b>enabled for all veth devices existing(no CPU limit)inside the Container.</p>

<p style="margin-left:11%;"><b>--cpus</b> <i>num</i></p>=== VSwap limits ====

<p style="margin-left:2211%;margin-top: 1em">The followingoptions sets number of CPUs availablememory and swap limits for VSwap-enabledin the containerkernels (kernel version 042stab042 or greater).</p>

<p style="margin-left:11%;margin-top: 1em"><b>--cpumask</b> <i>cpus</i> |Argument is inbytes, unless otherwise specified by an optional suffix.<b>all</b>Available suffixes are:</p>

<p style="margin-left:2211%;margin-top: 1em">sets list of allowed CPUs for&bull;the container. Input format is a comma<b>T</b>, <b>t</b> -separated list ofterabytes; <br>decimal numbers and ranges. Consecutively set bits are shown&bull; <b>G</b>, <b>g</b> - gigabytes; <br>as two hyphen&bull; <b>M</b>, <b>m</b> -separated decimal numbers, the smallest andmegabytes; <br>largest bit numbers set in the range. For example&bull; <b>K</b>, if you<b>k</b> - kilobytes; <br>want the container to execute on CPUs 0&bull; <b>P</b>, 1<b>p</b> - memory pages (arch-specific, 2, 7, you shouldpass usually 4KB); <br>&bull; <b>0-2,7B</b>. Default value is , <b>allb</b> - bytes (this is thecontainer can execute on any CPUdefault).<b><br>--ram</b> <i>bytes</i></p>

<p style="margin-left:1122%;">Sets physical memory (RAM)available to a container. Actually, the option is a shortcutfor setting <b>Memory outputparameters--physpages</b>limit (the barrier is set to0).</p>

<p style="margin-left:2211%; margin-top: 1em">This parametercontrol output of <b>--swap</procb> <i>bytes</meminfo inside a container.i></p>

<p style="margin-left:1122%;">Set swap space available to acontainer. Actually, the option is a shortcut for setting<b>--meminfo noneswappages</b>limit (the barrier is set to 0).</p>

<p style="margin-left:11%;"><b>--vm_overcommit</b><i>float</i></p> <p style="margin-left:22%;">No Set VM overcommitment value to<i>float</proci>. If set, it is used to calculate<b>privmmpages</meminfo virtualizationb> parameter in case it is not setexplicitly (see below). Default value is <b>0</b>, meaningunlimited privvmpages.</p> <p style="margin-left:11%; margin-top: 1em"><b>vzctl</b>checks if running kernel is VSwap capable, and refuses touse these parameters otherwise. This behavior can beoverriden by using <b>--force</b> flag beforeparameters.</p> <p style="margin-left:11%; margin-top: 1em">In VSwap mode,all beancounters other than RAM and swap become optional.Note though that if some optional beancounters are not set,they are calculated and set by vzctl implicitly, using the same as on host system)following formulae:</p> <p style="margin-left:11%; margin-top: 1em"><b>&bull;lockedpages.barrier = oomguarpages.barrier = ram</b></p>

<p style="margin-left:11%;margin-top: 1em"><b>--meminfo&bull;lockedpages.limit = oomguarpages.limit = unlimited</b><i>mode</i>:<i>value</i></p>

<p style="margin-left:2211%;margin-top: 1em">Configure total memory output<b>&bull;in a containervmguarpages. Reported free memory is evaluatedaccordingly to the mode being setbarrier = vmguarpages. Reported limit = ram + swap isevaluated according to the settings of <b>--swappages</b>parameter.</p>

<p style="margin-left:2211%; margin-top: 1em">You can use thefollowing modes for <i>mode</i>: <brb>&bull; <b>pages</b>:<i>value</i> - sets total memory inpages; <br>&bull; <b>privvmpages</b>:<i>value</i> - sets total memory.barrier = privvmpages.limit = (ram + swap) *as <b>privvmpagesvm_overcommit</b> * <i>value</i>.</p>

<p style="margin-left:2211%; margin-top: 1em">Default (if<b>vm_overcommit</b> is<b>0</b> or not set,<b>privvmpages:1</b>.is set to &quot;unlimited&quot;)</p>

<p style="margin-left:11%;margin-top: 1em"><b>Iptables control parametersHere is an<br>example of setting container 777 to have 512 megabytes of--iptables</b> <i>name</i>RAM and 1 gigabyte of swap:</p>

<p pre style="margin-left:2211%;">Allow to use the functionalityof <i>name</i> iptables module inside the container. Tospecify multiple <i>name</i>s, repeat vzctl set 777 --ram 512M --swap 1G -iptables for each,or use space-separated list as an argument (enclosed insingle or double quotes to protect spaces).save</ppre>

<p style="margin-left:22%; margin-top: 1em">The defaultlist of enabled iptables modules is specified by the<b>IPTABLES</b> variable in [[Man/vz.conf.5|<b>vz.conf</b>(5)]].</p>=== User Beancounter limits ====

<p style="margin-left:2211%; margin-top: 1em">You can use theThe followingfollowing values options sets barrier and limit for <i>name</i>: <b>iptable_filter</b>,<b>iptable_mangle</b>, <b>ipt_limit</b>,<b>ipt_multiport</b>, <b>ipt_tos</b>, <b>ipt_TOS</b>,<b>ipt_REJECT</b>, <b>ipt_TCPMSS</b>, <b>ipt_tcpmss</b>,various user<b>ipt_ttl</b>, <b>ipt_LOG</b>, <b>ipt_length</b>,<b>ip_conntrack</b>, <b>ip_conntrack_ftp</b>,<b>ip_conntrack_irc</b>, <b>ipt_conntrack</b>,<b>ipt_state</b>, <b>ipt_helper</b>, <b>iptable_nat</b>,<b>ip_nat_ftp</b>, <b>ip_nat_irc</b>, <b>ipt_REDIRECT</b>,<b>xt_mac</b>, <b>ipt_recent</b>, <b>ipt_owner</b>beancounters.</p>

<p style="margin-left:11%;margin-top: 1em">Note that forVSwap-enabled kernels (version 042stab042 or greater) theselimits are optional, you must only set <b>Network devices controlparameters <br>--netdev_addram</b> and<ib>name--swap</ib>(see above). For older kernels, these limitsare obligatory.</p>

<p style="margin-left:2211%;margin-top: 1em">move network device from Each optionrequires one or two arguments. In case of one argument,<b>vzctl</b> sets barrier and limit to the same value. Incase of two colon-separated arguments, the first is abarrier, and thesecond is a limit. Each argument is eitherhost system to a specified containernumber, a number with a suffix, or a special value<b>unlimited</b>.</p>

<p style="margin-left:11%;margin-top: 1em"><b>-Arguments arein items, pages or bytes. Note that page size isarchitecture-netdev_del</b>specific, it is 4096 bytes on x86 and x86_64<i>name</i>platforms.</p>

<p style="margin-left:2211%;margin-top: 1em">delete network device from aYou can alsospecified containerspecify different suffixes for User Beancounter parameters(except for those which names start with <b>num</b>). Forexample, <b>vzctl set</b> <i>CTID</i> <b>--privvmpages5M:6M</b> should set <b>privvmpages</b>&rsquo; barrier to 5megabytes and its limit to 6 megabytes.</p>

<p style="margin-left:11%;margin-top: 1em"><b>Disk quota parameters <br>Available--diskquota yes</b>|<b>no</b>suffixes are:</p>

<p style="margin-left:2211%;margin-top: 1em">allows to enable or disable&bull;<b>T</b>, <b>t</b> - terabytes; <br>&bull; <b>G</b>, <b>g</b> - gigabytes; <br>disk quota for a container. By default&bull; <b>M</b>, a global value<b>m</b> - megabytes; <br>(&bull; <b>K</b>, <b>DISK_QUOTAk</b>) from [[Man- kilobytes; <br>&bull; <b>P</vz.conf.5|b>, <b>vz.confp</b>- memory pages (5arch-specific,usually 4KB)]] is used; <br>&bull; <b>B</b>, <b>b</b> - bytes.</p>

<p style="margin-left:11%;margin-top: 1em">You can alsospecify the literal word <b>unlimited</b> in place of anumber. In that case the corresponding value will be set to<b>LONG_MAX</b>, i. e. the maximum possible value. <b><br>--diskspacenumproc</b><i>numitems</i>[:<i>numitems</i>]</p>

<p style="margin-left:22%;">sets soft Maximum number of processes and hard disk quotalimits, in blockskernel-level threads. First parameter is soft limit, second ishard Setting the barrier and the limit. One block is currently equal to 1Kb. Suffixes<b>G</b>, <b>M</b>, <b>K</b> can also be specified (see<b>Resource limits</b> section for more info onsuffixes)different values does not make practical sense.</p>

<p style="margin-left:11%;"><b>--diskinodesnumtcpsock</b><i>numitems</i>[:<i>numitems</i>]</p>

<p style="margin-left:22%;">sets soft Maximum number of TCP sockets.This parameter limits the number of TCP connections and hard disk quota,limitsthus, the number of clients the server application canhandle in i-nodesparallel. First parameter is soft Setting the barrier and the limit, second istohard limitdifferent values does not make practical sense.</p>

<p style="margin-left:11%;"><b>--quotatimenumothersock</b><i>secondsitems</i>[:<i>items</i>]</p>

<p style="margin-left:22%;">sets quota grace periodMaximum number of non-TCPsockets (local sockets, UDP and other types of sockets).Container is permitted to exceed its soft limits for Setting thegrace period, but once it has expired, barrier and the soft limit isto different values doesenforced as a hard limitnot make practical sense.</p>

<p style="margin-left:11%;"><b>--quotaugidlimitvmguarpages</b><i>numpages</i>[:<i>pages</i>]</p>

<p style="margin-left:22%;">sets maximum number ofMemory allocation guarantee.user/group IDs in This parameter controls how much memory is available to a container for which disk quota inside. The barrier is the amount of memory thatthe container will &rsquo;s applications are guaranteed to be accountedable toallocate. If this value The meaning of the limit is currently unspecified;it should be set to<b>0unlimited</b>, user and group quotas inside the container willnot be accounted.</p>

<p style="margin-left:2211%; margin-top: 1em">Note that ifyou have previously set value of this parameter to <b>0--kmemsize</b>,changing it while the container is running will not takeeffect.<i>bytes</i>[:<i>bytes</i>]</p>

<p style="margin-left:1122%;">Maximum amount of kernel memoryused. This parameter is related to <b>Mount option <br>--noatime yesnumproc</b> | . Eachprocess consumes certain amount of kernel memory - 16 KB atleast, 30-50 KB typically. Very large processes may consumea bit more. It is important to have a certain safety gapbetween the barrier and the limit of this parameter: equalbarrier and limit may lead to the situation where the kernelwill need to kill container&rsquo;s applications to keep the<b>nokmemsize</b>usage under the limit.</p>

<p style="margin-left:2211%;">Sets noatime flag (do not<b>--tcpsndbuf</b>update inode access times) on filesystem.<i>bytes</i>[:<i>bytes</i>]</p>

<p style="margin-left:1122%;"><b>Capability option <br>Maximum size of TCP sendbuffers. Barrier should be not less than 64 KB, anddifference between barrier and limit should be equal to or--capability</b> <i>capname</i>:<b>on</b>|more than value of <b>offnumtcpsock</b></p> <p style="margin-left:22%;">Sets a capability for acontainer. Note that setting capability when the containeris running does not take immediate effect; restart thecontainer in order for the changes to take effectmultiplied by 2. Note acontainer has default set of capabilities, thus anyoperation on capabilities is &quot;logical and&quot; with5the default capability maskKB.</p>

<p style="margin-left:2211%; margin-top: 1em">You can use thefollowing values for <i>capname</i>: <b>chown--tcprcvbuf</b>,<bi>dac_overridebytes</bi>, [:<bi>dac_read_searchbytes</b>, <b>fowner</b>,<b>fsetid</b>, <b>kill</b>, <b>setgid</b>, <b>setuid</b>,<b>setpcap</b>, <b>linux_immutable</b>,<b>net_bind_service</b>, <b>net_broadcast</b>,<b>net_admin</b>, <b>net_raw</b>, <b>ipc_lock</b>,<b>ipc_owner</b>, <b>sys_module</b>, <b>sys_rawio</b>,<b>sys_chroot</b>, <b>sys_ptrace</b>, <b>sys_pacct</b>,<b>sys_admin</b>, <b>sys_boot</b>, <b>sys_nice</b>,<b>sys_resource</b>, <b>sys_time</b>, <b>sys_tty_config</b>,<b>mknod</b>, <b>lease</b>, <b>setveid</b>, <b>ve_admin</b>.For detailed description, see <b>capabilities</bi>(7).]</p>

<p style="margin-left:22%; margin-top: 1em"><b>WARNING</b>:setting some Maximum size of those capabilities may have far reachingTCP receivesecurity implicationsbuffers. Barrier should be not less than 64 KB, so do not do it unless you know whatanddifference between barrier and limit should be equal to oryou are doing. Also note that setting more than value of <b>setpcap:onnumtcpsock</b> fora container will most probably lead to inability to startmultiplied by 2.5itKB.</p>

<p style="margin-left:11%;"><b>Device access management<br>--devnodesothersockbuf</b> <i>devicebytes</i>[:<bi>[r][w][q]|nonebytes</bi>]</p>

<p style="margin-left:22%;">Give the container an accessMaximum size of other (<b>r</b> non- read, <b>w</b> - write, <b>q</b> - disk quotaTCP)management, <b>none</b> - no access) socket send buffers. If container&rsquo;s processes needs to a device designatedby send very large datagrams, the special file /dev/<i>device</i>barrier should be setaccordingly. Device file Increased limit isnecessary for highcreated in a container by <b>vzctl</b>. Example: <b>vzctlperformance of communications through local (UNIX-domain)set 777 --devnodes sdb:rwq</b>sockets.</p>

<p style="margin-left:11%;"><b>--devicesb|cdgramrcvbuf</b>:<i>majorbytes</i>[:<i>minorbytes</i>|<b>all</b>:<b>[r][w][q]|none</b></p>

<p style="margin-left:22%;">Give the Maximum size of other (non-TCP)socket receive buffers. If container an access &rsquo;s processes needstoreceive very large datagrams, the barrier should be seta <b>b</b>lock or <b>c</b>haracter device designated by its<i>major</i> accordingly. The difference between the barrier and <i>minor</i> numbers. Device file have tothebe created manuallylimit is not needed.</p>

<p style="margin-left:11%;"><b>PCI device management <br>--pci_addoomguarpages</b>[<i>domainpages</i><b>[:</b>]<i>bus</i><b>:</b><i>slot</i><b>.</b><i>funcpages</i>]</p>

<p style="margin-left:22%;">Give Guarantees against OOM kill.Under this beancounter the kernel accounts the total amountof memory and swap space used by the container an access to&rsquo;sprocesses. The barrier of this parameter is thea specified PCI deviceout-of-memory guarantee. All numbers If the <b>oomguarpages</b> usage isbelow the barrier, processes of this container are hexadecimal (asprinted by guaranteed not to be killed in out-of-memory situations. Themeaning of limit is currently unspecified; it should be setto <b>lspciunlimited</b>(8) in the first column).</p>

<p style="margin-left:11%;"><b>--pci_dellockedpages</b>[<i>domainpages</i><b>[:</b>]<i>bus</i><b>:</b><i>slot</i><b>.</b><i>funcpages</i>]</p>

<p style="margin-left:22%;">Delete a PCI device from theMaximum number of pagescontaineracquired by <b>mlock</b>(2).</p>

<p style="margin-left:2211%; margin-top: 1em">Note that<b>vps-pci-privvmpages</b> configuration script is executed by<bi>vzctlpages</bi> then configuring PCI devices. The script isusually located at [:<bi>/usr/lib[64]/vzctl/scripts/pages</bi>.]</p>

<p style="margin-left:1122%;"><b>Features management <br>Allows controlling the amountof memory allocated by the applications. For shared (mapped--featuresas </b> <i>nameMAP_SHARED</i><b>:) pages, each container really using amemory page is charged for the fraction of the page(depending on</b>|the number of others using it). For&quot;potentially private&quot; pages (mapped as<b>offMAP_PRIVATE</b></p>), container is charged either for a <p style="margin-left:22%;">Enable fraction of the size or disable a specificfor the full size if the allocatedcontainer featureaddress space. Known features are: <b>sysfs</b>In the latter case,the physical pages<b>nfs</b>, <b>sit</b>, <b>ipip</b>, <b>ppp</b>,associated with the allocated address space may be in<b>ipgre</b>memory, <b>bridge</b>, <b>nfsd</b>in swap or not physically allocated yet.</p>

<p style="margin-left:1122%;margin-top: 1em">The barrier andthe limit of this parameter control the upper boundary ofthe total size of allocated memory. Note that this upperboundary does not guarantee that container will be able toallocate that much memory. The primary mechanism to controlmemory allocation is the <b>Apply config <br>--applyconfigvmguarpages</b> <i>name</i>guarantee.</p>

<p style="margin-left:2211%;">Read container parameters fromthe container sample configuration file<tt>/etc/vz/conf/ve-</tt><i>name</i><tt>.conf-sample</tt>,and apply them, if <b>--saveshmpages</b> option specified save tothe container config file. The following parameters are notchanged: <bi>HOSTNAMEpages</bi>, [:<bi>IP_ADDRESSpages</b>,<b>OSTEMPLATE</b>, <b>VE_ROOT</b>, and<b>VE_PRIVATE</bi>.]</p>

<p style="margin-left:1122%;"><b>--applyconfig_map</b>Maximum IPC SHM segment size.Setting the barrier and the limit to different values does<i>group</i>not make practical sense.</p>

<p style="margin-left:2211%;">Apply container configparameters selected by <ib>group--numfile</ib>. Now the only possiblevalue for <i>groupitems</i> is <b>name</b>[: to restore containername based on <bi>NAMEitems</bi> variable in containerconfiguration file.]</p>

<p style="margin-left:1122%;">Maximum number of open files.In most cases the barrier and the limit should be set to thesame value. Setting the barrier to <b>I0</O priority management <brb>effectivelydisables pre--ioprio</b> <i>priority</i>charging optimization for this beancounter inthe kernel, which leads to the held value being precise butcould slightly degrade file open performance.</p>

<p style="margin-left:2211%;">Assigns I/O priority tocontainer. <i>Priority</i> range is <b>0-7-numflock</b>. The greater<i>priorityitems</i> is, the more time for I/O activity containerhas. By default each container has [:<i>priorityitems</i> of<b>4</b>.]</p>

<p style=== Checkpointing "margin-left:22%;">Maximum number of file locks.Safety gap should be between barrier and restore ===limit.</p>

<p style="margin-topleft: 1em11%;">Checkpointing is a feature of<b>--numpty</b>OpenVZ kernel which allows to save a complete state of arunning container, and to restore it later.<i>items</i>[:<i>items</i>]</p>

<p style="margin-left:1122%;"><b>chkpnt</b> <i>CTID</i>Number of pseudo-terminals(PTY). Note that in OpenVZ each container can have not morethan 255 PTYs. Setting the barrier and the limit to[<b>--dumpfile</b> <i>name</i>]different values does not make practical sense.</p>

<p style="margin-left:1711%;">This command saves a completestate of a running container to a dump file, and stops thecontainer. If an option <b>--dumpfilenumsiginfo</b> is not set,default dump file name <bi>/vz/dump/Dump.items</bi>[:<i>CTIDitems</i> isused.]</p>

<p style="margin-left:1122%;"><b>restore</b> <i>CTID</i>Number of siginfo structures.Setting the barrier and the limit to different values does[<b>--dumpfile</b> <i>name</i>]not make practical sense.</p>

<p style="margin-left:1711%;">This command restores acontainer from the dump file created by the <b>chkpnt--dcachesize</b>command.<i>bytes</i>[:<i>bytes</i>]</p>

<p style=== Performing container actions ==="margin-left:22%;">Maximum size offilesystem-related caches, such as directory entry and inodecaches. Exists as a separate parameter to impose a limitcausing file operations to sense memory shortage and returnan errno to applications, protecting from memory shortagesduring critical operations that should not fail. Safety gapshould be between barrier and limit.</p>

<p style="margin-left:11%;"><b>create</b> <i>CTID</i>[<b>--ostemplate</b> <i>name</i>] [<b>--confignumiptent</b><i>namenum</i>] [<b>--private</b> <i>path</i>] <br>[<b>--root</b> <i>path</i>] [<b>--ipadd</b> <i>addr</i>][<b>--hostname</b> :<i>namenum</i>]</p>

<p style="margin-left:1722%;">Creates a new container areaNumber of iptables (netfilter)entries.This operation should be done once, before Setting the barrier and the first startlimit to differentof the containervalues does not make practical sense.</p>

<p style="margin-left:1711%; margin-top: 1em">If the<b>--configphyspages</b> option is specified, values from exampleconfiguration file<bi>/etc/vz/conf/ve-pages</bi>[:<i>namepages</i><b>.conf-sample</b> areput into the container configuration file. If this containerconfiguration file already exists, it will be removed.]</p>

<p style="margin-left:1722%; margin-top: 1em">You can useOn VSwap-enabled kernels, this<b>--root</b> <i>path</i> option to sets limits the path amount of physical memory (RAM) available to theamount point for the container root directory (default is<b>VE_ROOT</b> specified in [[Man/vz.conf.5|The barrier should be set to <b>vz.conf0</b>(5)]] file)., and theArgument limit to a total size of RAM that can contain literal string <b>$VEID</b>, which willbe used used by abe substituted with the numeric CT IDcontainer.</p>

<p style="margin-left:1722%; margin-top: 1em">You can useFor older<b>kernels, this is an accounting--private</b> <i>path</i> option to set only parameter, showing the path todirectory in which all the files and directories specific tousage of RAM by this very container are stored (default is <b>VE_PRIVATE</b>. Barrier should be set tospecified in [[Man/vz.conf.5|<b>vz.conf0</b>(5)]] file). Argument can containliteral string , and limit should be set to <b>$VEIDunlimited</b>, which will be substituted withthe numeric CT ID.</p>

<p style="margin-left:1711%; margin-top: 1em">You can use<b>--ipaddswappages</b> <i>pages</i>addr[:<i>pages</i> option to assign an IP address toa container. Note that this option can be used multipletimes.]</p>

<p style="margin-left:1722%; margin-top: 1em">You can useFor VSwap-enabled kernels(042stab042 or greater), this parameter limits the amount ofswap space available to a container. The barrier should beset to <b>--hostname0</b> <i>name</i> option , and the limit to set a host name fortotal size of swap thatcan be used by a container.</p>

<p style="margin-left:1122%;margin-top: 1em">For older(pre-VSwap) kernels, the limit is used to show a totalamount of swap space available inside the container. Thebarrier of this parameter is ignored. The default value is<b>destroyunlimited</b> |, meaning total swap will be reported as<b>delete</b>0.</p>

<p style="margin-left:17%;">Removes a container privatearea by deleting all files, directories and theconfiguration file of this container.</p>=== CPU fair scheduler parameters ====

<p style="margin-left:11%;margin-top: 1em">Theseparameters control CPU usage by container. <b>start</b> [<bbr>--waitcpuunits</b>][<bi>--forcenum</bi>]</p>

<p style="margin-left:1722%;">Mounts (if necessary) andstarts CPU weight for a container. Unless <b>Argument is positive non--wait</b> option zero number, passed to and used inthe kernel fair scheduler. The larger the number is, thespecifiedmore CPU time this container gets. Maximum value is 500000, <b>vzctl</b> will return immediately; otherwisean attempt minimal is 8. Number is relative to wait till weights of all the default runlevel is reached willotherbe made by running containers. If <b>vzctlcpuunits</b>are not specified,default value of 1000 is used.</p>

<p style="margin-left:1722%; margin-top: 1em">SpecifyYou can set CPUweight for CT0 (host system itself) as well (use <b>vzctlset 0 --forcecpuunits</b> if you want to start a container which is<i>num</i>). Usually, OpenVZ initscriptdisabled (see <b>--disabled/etc/init.d/vz</b>)takes care of setting this.</p>

<p style="margin-left:1711%; margin-top: 1em">Note that thiscommand can lead to execution of <b>premount--cpulimit</b>,<bi>mountnum</bi> and [<b>start</b> action scripts (see <b>ACTIONSCRIPTS%</b> below).]</p>

<p style="margin-left:1122%;">Limit of CPU usage for thecontainer, in per cent. Note if the computer has 2 CPUs, ithas total of 200% CPU time. Default CPU limit is <b>stop</b> [<b>--fast0</b>](no CPU limit).</p>

<p style="margin-left:1711%;">Stops and unmounts a container.Normally, <b>halt</b>(8) is executed inside a container;option <b>--fastcpus</b> makes <bi>vzctlnum</b> use <b>reboot</bi>(2)syscall instead which is faster but can lead to uncleancontainer shutdown.</p>

<p style="margin-left:1722%; margin-top: 1em">Note that thiscommand can lead to execution sets number of <b>stop</b>, <b>umount</b>CPUs availableand <b>postumount</b> action scripts (see <b>ACTIONSCRIPTS</b> below)in the container.</p>

<p style="margin-left:11%;"><b>restart--cpumask</b> <i>cpus</i> |<b>auto</b> | <b>all</b></p>

<p style="margin-left:1722%;">Restarts a Sets list of allowed CPUs forthe container, i.eInput format is a comma-separated list ofdecimal numbers and/or ranges.Consecutively set bits areshown as two hyphen-separated decimal numbers, the smalleststops it and largest bit numbers set in the range. For example, if it is runningyou want the container to execute on CPUs 0, 1, 2, 7, youshould pass <b>0-2, and starts again7</b>. Accepts Default value is <b>all </b> (thecontainer can execute on any CPU). If used with the<b>start--nodemask</b> and option, value of <b>stopauto</b> optionsassigns allCPUs from the specified NUMA node to a container.</p>

<p style="margin-left:1711%; margin"><b>--top: 1em"nodemask</b> <i>nodes</i>Note that thiscommand can lead to execution of some action scripts (see| <b>ACTION SCRIPTSall</b> below).</p>

<p style="margin-left:1122%;">Sets list of allowed NUMA nodesfor the container. Input format is the same as for<b>status--cpumask</b>. Note that <b>--nodemask</b> must be usedwith the <b>--cpumask</b> option.</p>

<p style="margin-left:17%;">Shows a container status. Thisis a line with five or six words, separated by spaces.</p>=== Memory output parameters ====

<p style="margin-left:1711%; margin-top: 1em">First word ForVSwap-enabled kernels (042stab042 or greater), thisparameter isignored. For older kernels, it controls theliterally output of /proc/meminfo inside a container. <b>CTID<br>--meminfo none</b>.</p>

<p style="margin-left:1722%; margin-top: 1em">Second word isNo /proc/meminfo virtualization(the numeric <i>CT ID</i>same as on host system).</p>

<p style="margin-left:1711%; margin-top: 1em">Third word isshowing whether this container exists or not, it can beeither <b>exist--meminfo</b> or <bi>mode</i>:<i>deletedvalue</bi>.</p>

<p style="margin-left:1722%; margin-top: 1em">Fourth word Configure total memory outputin a container. Reported free memory is evaluatedaccordingly to the mode being set. Reported swap isshowing evaluated according to the status settings of the container filesystem, it can beeither <b>mounted</b> or <b>unmounted--swappages</b>parameter.</p>

<p style="margin-left:1722%; margin-top: 1em">Fifth wordYou can use thefollowing modes for <i>mode</i>: <br>&bull; <b>pages</b>:<i>value</i> - sets total memory inshows if the container is running, it can be eitherpages; <br>&bull; <b>runningprivvmpages</b> or :<i>value</i> - sets total memoryas <b>downprivvmpages</b> * <i>value</i>.</p>

<p style="margin-left:1722%; margin-top: 1em">Sixth word, ifexists, Default is <b>suspended</b>. It appears if both a containerand its dump file exist (see <b>chkpntprivvmpages:1</b>).</p>

<p style="margin-left:17%; margin-top: 1em">This commandcan also be usable from scripts.</p>=== Netfilter (iptables) control parameters ====

<p style="margin-left:11%;"><b>mount--netfilter&nbsp;disabled</b>|<b>stateless</b>|<b>stateful</b>|<b>full</b></p>

<p style="margin-left:1722%;">Mounts container private area.Note that this command can lead Restrict access to execution of<b>premount<netfilter/b> and <b>mount</b> action scripts (seeiptables modules for a container. This optionreplaces obsoleted <b>ACTION SCRIPTS--iptables</b> below).</p>

<p style="margin-left:1122%;margin-top: 1em">Note thatchanging this parameter requires container restart, soconsider using <b>umount--setmode</b> option.</p> <p style="margin-left:22%; margin-top: 1em">The followingarguments can be used: <b><br>&bull; disabled</b></p>

<p style="margin-left:1732%;">Unmounts container privatearea. Note that this command can lead to execution of<b>umount</b> and <b>postumount</b> action scripts (see<b>ACTION SCRIPTS</b> below).no modules are allowed</p>

<p style="margin-left:1722%; margin-top: 1em">Note that<b>stop</b> does <b>umount&bull; stateless</b> automatically.</p>

<p style="margin-left:1132%;"><b>quotaon</b> <all modules except NAT andconntracks are allowed (i>ctid</i>.e. filter and mangle); this is thedefault</p>

<p style="margin-left:1722%;">Turn disk quota on. Not that<b>mount</b> and <b>start&bull; stateful</b> does that automatically.</p>

<p style="margin-left:1132%;"><b>quotaoff</b> <i>ctid</i>all modules except NAT areallowed</p>

<p styletable width="margin-left:17100%;" border="0" rules="none" frame="void" cellspacing="0" cellpadding="0">Turn disk quota off. Not that<btr valign="top" align="left">umount</btd width="22%"> and <b>stop</btd> does that automatically.</ptd width="9%">

<p style="margin-left:11%;"><b>quotainit&bull; full</b></p></td><itd width="1%">ctid</itd></ptd width="36%">

<p style>all modules are allowed</p></td><td width="margin-left:1732%;">Initialize disk quota (i.e. run<b/td>vzquota init</btr>) with the parameters taken from the CTconfiguration file [[Man/ctid.conf.5|<b>ctid.conf</b>(5)]].</ptable>

<p style="margin-left:11%;"><b>exec--iptables</b> <i>CTIDcommandname</i>[<b>,</b>...]</p>

<p style="margin-left:1722%;">Executes <ib>commandNote</ib> in athis option iscontainer. Environment variables are not set inside thecontainer. Signal handlers may differ from default settings.If <i>command</i> is obsoleted, <b>--netfilter</b>, commands are read fromstdinshould be used instead.</p>

<p style="margin-left:1122%;margin-top: 1em">Allow to usethe functionality of <i>name</i> iptables module inside thecontainer. Multiple comma-separated <i>name</i>s can bespecified.</p> <p style="margin-left:22%; margin-top: 1em">The defaultlist of enabled iptables modules is defined by the<b>exec2IPTABLES</b> variable in [[Man/vz.conf.5|<b>vz.conf</b>(5)]].</p> <p style="margin-left:22%; margin-top: 1em">You can use thefollowing values for <i>name</i>CTID: <b>iptable_filter</b>,<b>iptable_mangle</b>, <b>ipt_limit</b>,command<b>ipt_multiport</ib>, <b>ipt_tos</b>, <b>ipt_TOS</b>,<b>ipt_REJECT</b>, <b>ipt_TCPMSS</b>, <b>ipt_tcpmss</b>,<b>ipt_ttl</b>, <b>ipt_LOG</b>, <b>ipt_length</b>,<b>ip_conntrack</b>, <b>ip_conntrack_ftp</b>,<b>ip_conntrack_irc</b>, <b>ipt_conntrack</b>,<b>ipt_state</b>, <b>ipt_helper</b>, <b>iptable_nat</b>,<b>ip_nat_ftp</b>, <b>ip_nat_irc</b>, <b>ipt_REDIRECT</b>,<b>xt_mac</b>, <b>ipt_recent</b>, <b>ipt_owner</b>.</p>

<p style="margin-left:17%;">The same as <b>exec</b>, butreturn code is that of <i>command</i>.</p>=== Network devices control parameters ====

<p style="margin-left:11%;"><b>runscript--netdev_add</b> <i>CTIDscriptname</i></p>

<p style="margin-left:1722%;">Run specified shell script inmove network device from thethe container. Argument <i>script</i> is a file on the hostsystem which contents is read by vzctl and executed in thecontext of the container. For to a running specified container, thecommand jumps into the container and executes the script.For a stopped container, it enters the container, mountscontainer&rsquo;s root filesystem, executes the script, andunmounts CT root. In the latter case, the container is notreally started, no file systems other than root (such as<b>/proc</b>) are mounted, no startup scripts are executedetc. Thus the environment in which the script is running isfar from normal and is only usable for very basicoperations.</p>

<p style="margin-left:11%;"><b>enter</b> [<b>--execnetdev_del</b><i>command</i> [<i>argname</i> ...]]</p>

<p style="margin-left:1722%;">Enters into delete network device from a container (givinga specified container&rsquo;s root shell). This option is a back-doorfor host root only. The proper way to have CT root shell isto use <b>ssh</b>(1).</p>

<p style="margin-left:17%; margin-top: 1em">Option<b>--exec</b> is used to run <i>command</i> with argumentsafter entering into container. This is useful if command tobe run requires a terminal (so <b>vzctl exec</b> can not beused) and for some reason you can not use <b>ssh</b>(1).</p>=== Disk quota parameters ====

<p style="margin-left:1711%; margin-top: 1em">You need to logout manually from the shell to finish session (even if youspecified <b>--execdiskquota yes</b> |<b>no</b>).</p>

<p style=== Other options ==="margin-left:22%;">allows to enable or disabledisk quota for a container. By default, a global value(<b>DISK_QUOTA</b>) from [[Man/vz.conf.5|<b>vz.conf</b>(5)]] is used.</p>

<p style="margin-left:1122%;margin-top: 1em">Note that thisparameter is ignored for <b>--helpploop</b>layout.</p>

<p style="margin-left:1711%;">Prints help message with a<b>--diskspace</b>brief list of possible options.<i>num</i>[:<i>num</i>]</p>

<p style="margin-left:1122%;">For <b>--versionsimfs</b>layout, setssoft and hard disk quota limits. First parameter is softlimit, second is hard limit.</p>

<p style="margin-left:1722%;margin-top: 1em">Prints For<b>vzctlploop</b>layout, initiates the procedure of resizing theploop image file to the new size. Since there is nosoft/hard limit concept in ploop, second <i>num</i>, ifversionspecified, is ignored.</p>

<p style== ACTION SCRIPTS =="margin-left:22%; margin-top: 1em">By default,ploop resize is done online, i.e. on a mounted ploop. Thisis a preferred way of doing resize. Although, in a rare casea container was using lots of disk space and should now beresized to a much smaller size, an offline resize might bemore appropriate. In this case, make sure the container isstopped and unmounted and use additional<b>--offline-resize</b> option</p>

<p style="margin-left:1122%; margin-top: 1em"><b>vzctl</b>has an ability to execute user-defined scripts when aNote that ploopspecific <b>vzctl</b> command resize is run for a NOT performed on container. Thefollowing <b>vzctl</b> commands can trigger execution ofaction scripts: <b>start</b>, so forconsistency <b>stop</b>, <b>restart--diskspace</b>,must be used together with<b>mount</b> and <b>umount--save</b>flag.</p>

<p style="margin-left:1122%; margin-top: 1em">Action scriptsSuffixesare located in the <b>G</etc/vz/conf/b>, <b>M</b> directory. There areglobal and per-CT scripts. Global scripts have a literalprefix of , <b>vps.K</b> and are executed for all containers.can also be specified (seePer-CT scripts have a <ib>CTIDResource limits</ib> numeric prefix and aresection for more info on suffixes).executed for the given container onlyIf suffix is not specified, value is in kilobytes.</p>

<p style="margin-left:11%; margin-top: 1em">There are 8action scripts currently defined: <b><br>vps.premount--diskinodes</b>, <i>CTIDnum</i>[:<bi>.premountnum</bi>]</p>

<p style="margin-left:22%;">Global sets soft and perhard disk quotalimits, in i-CT mount scriptswhich are executed for a container before it is mountednodes.Scripts are executed in the host OS context, while a CT First parameter isnot yet mounted or running. Global script, if existssoft limit, second isexecuted firsthard limit.</p>

<p style="margin-left:1122%;margin-top: 1em">Note that thisparameter is ignored for <b>vps.mountploop</b>,<i>CTID</i><b>layout.mount</b></p>

<p style="margin-left:2211%;">Global and per-CT mount scriptswhich are executed for a container right after it ismounted. Otherwise they are the same as <b>.premount--quotatime</b>scripts.<i>seconds</i></p>

<p style="margin-left:1122%;"><i>CTID</i><b>sets quota grace period.Container is permitted to exceed its soft limits for thegrace period, but once it has expired, the soft limit isenforced as a hard limit.start</b></p>

<p style="margin-left:22%;margin-top: 1em">Right after Note that thisparameter is ignored for <b>vzctlploop</b> hasstarted a container, it executes this script in a containercontextlayout.</p>

<p style="margin-left:11%;"><ib>CTID--quotaugidlimit</ib><bi>.stopnum</bi></p>

<p style="margin-left:22%;">Right before Enables or disablesin-container per-user and per-group disk quotas. If thevalue is set to <b>vzctl0</b> hasor not set, disk quotas inside thestopped a container, it executes this script in a containercontextis disabled and not accounted.</p>

<p style="margin-left:1122%;margin-top: 1em">For<b>vps.umountsimfs</b>layout containers,non-zero value sets maximum<i>CTID<number of user/i><b>group IDs for which disk quota isaccounted.umount</b></p>

<p style="margin-left:22%;margin-top: 1em">Global and perFor<b>ploop</b> layout containers, any non-CT umountzero value enablesscripts which are executed for a disk quota inside the container before it isunmounted. Scripts are executed in ; the host OS context,number of user/groupwhile a CT is mounted. Global script, if exists, IDs used by disk quota is executedfirstnot limited by OpenVZ.</p>

<p style="margin-left:1122%;margin-top: 1em">Note thatenabling or disabling in-container disk quotas requirescontainer restart, so consider using <b>vps.postumount--setmode</b>,<i>CTID</i><b>option.postumount</b></p>

<p style="margin-left:22%;">Global and per-CT umountscripts which are executed for a container right after it isunmounted. Otherwise they are the same as <b>.umount</b>scripts.</p>=== Capability option ====

<p style="margin-left:2211%; margin-top: 1em">The environmentpassed to all the <b>*mount--capability</b> scripts is the standardenvironment of the parent (<i.e. <b>vzctlcapname</bi>) with twoadditional variables: <b>$VEIDon</b> and |<b>$VE_CONFFILEoff</b>.The first one holds the ID of the container, and the secondone holds the full path to the container configuration file.If the script needs to get other CT configurationparameters, such as [<b>$VE_ROOT,</b>, it needs to get thosefrom global and per-CT configuration files...]</p>

<p style="margin-left:22%; margin-top: 1em">Here is anexample of Sets a capability for a mount script, which makes host system&rsquo;s/mnt/disk available to container(s). Script name Multiple comma-separated capabilities can eitherbe <b>/etc/vz/conf/vps.mount</b> or<b>/etc/vz/conf/</b><i>CTID</i><b>.mount</b>specified.</p>

<p style="margin-left:22%; margin-top: 1em"># If one ofNote thatthese files setting a capability when the container is running does not exist then something <br># is really broken take immediate effect; restart the container in order forthe changes to take effect (consider using <brb>[ -f /etc/sysconfig/vz ] || exit 1 <br>[ -f $VE_CONFFILE ] || exit 1 setmode<br># Source both files. Note the order is important. <br>. /etc/vz/vz.conf <brb>option). $VE_CONFFILE <br>mount -n --bind /mnt/disk $VE_ROOT/mnt/disk</p>

<p style== EXIT STATUS =="margin-left:22%; margin-top: 1em">A container hasthe default set of capabilities, thus any operation oncapabilities is &quot;logical AND&quot; with the defaultcapability mask.</p>

<p style="margin-left:1122%; margin-top: 1em">Returns 0 uponYou can use thesuccessfollowing values for <i>capname</i>: <b>chown</b>,<b>dac_override</b>, <b>dac_read_search</b>, <b>fowner</b>,<b>fsetid</b>, <b>kill</b>, <b>setgid</b>, <b>setuid</b>,<b>setpcap</b>, <b>linux_immutable</b>,<b>net_bind_service</b>, <b>net_broadcast</b>,<b>net_admin</b>, <b>net_raw</b>, <b>ipc_lock</b>,<b>ipc_owner</b>, <b>sys_module</b>, <b>sys_rawio</b>,<b>sys_chroot</b>, <b>sys_ptrace</b>, <b>sys_pacct</b>,<b>sys_admin</b>, <b>sys_boot</b>, <b>sys_nice</b>,<b>sys_resource</b>, or an appropriate error code in case <b>sys_time</b>, <b>sys_tty_config</b>,<b>mknod</b>, <b>lease</b>, <b>setveid</b>, <b>ve_admin</b>.For detailed description, see <b>capabilities</b>(7).</p> <p style="margin-left:22%; margin-top: 1em"><b>WARNING</b>:setting some of anthose capabilities may have far reachingsecurity implications, so do not do it unless you know whaterroryou are doing. Also note that setting <b>setpcap:on</b> fora container will most probably lead to inability to startit.</p>

<table width="100%" border="0" rules="none" frame="void" cellspacingDevice access management ="0" cellpadding="0"><tr valign="top" align="left"><td width="11%"></td><td width="4%">

<pstyle="margin-left:11%;"><b>--devnodes</b><i>device</i>:[<b>1r</pb>][<b>w</b>][<b>q</b>]|<b>none</b></tdp> <td widthp style="7margin-left:22%;">Give the container an access(<b>r</tdb>- read, <b>w</b> - write, <b>q</b> - disk quotamanagement, <b>none</b> - no access) to a device designatedby the special file /dev/<i>device</i>. Device file iscreated in a container by <b>vzctl<td width/b>. Example:</p> <pre style="78margin-left:22%;"> vzctl set 777 --devnodes sdb:rwq</pre>

<pstyle="margin-left:11%;"><b>--devicesb</b>|<b>c</b>:<i>major</i>:<i>minor</i>|<b>Failed to set a UBC parameterall</pb>:[<b>r</tdb>][<b>w</trb>][<b>q<tr valign="top" align="left"/b>]|<td width="11%"b>none</tdb><td width="4%"/p>

<pstyle="margin-left:22%;">2Give the container an access toa <b>b</pb>lock or <b>c</tdb>haracter device designated by its<td width="7%"i>major</i> and <i>minor</tdi>numbers. Device file have tobe created manually.<td width="78%"/p>

<p>Failed to set a fair scheduler parameter</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%">PCI device management ====

<pstyle="margin-left:11%;"><b>--pci_add</b>[<i>domain</i>:]<i>3bus</pi>:<i>slot</tdi>.<td width="7%"i>func</tdi><td width="78%"/p>

<pstyle="margin-left:22%;">Generic system errorGive the container an access toa specified PCI device. All numbers are hexadecimal (asprinted by </pb>lspci</tdb>(8) in the first column).</trp> <tr valign="top" alignp style="margin-left:11%;"><b>--pci_del</b>[<i>domain<td width="11%"/i>:]<i>bus</i>:<i>slot</i>.<i>func</tdi><td width="4%"/p>

<p>5</p></td><td widthstyle="7margin-left:22%;">Delete a PCI device from thecontainer.</td><td width="78%"p>

<pstyle="margin-left:22%; margin-top: 1em">The running kernel is not an OpenVZ kernel (or someNote thatOpenVZ modules are not loaded)</pb>vps-pci</tdb>configuration script is executed by</trb>vzctl<tr valign="top" align="left"/b>then configuring PCI devices. The script isusually located at <td width="11%"b>/usr/libexec/vzctl/scripts/</tdb>.<td width="4%"/p>

<p>6</p></td><td width="7%"></td><td width="78%">== Features management ====

<pstyle="margin-left:11%;">Not enough system resources<b>--features</pb><i>name</tdi>:<b>on</trb>|<b>off<tr valign="top" align="left"/b>[<td width="11%"b>,</tdb>...]<td width="4%"/p>

<pstyle="margin-left:22%;">Enable or disable a specificcontainer feature. Known features are: <b>sysfs</b>,<b>nfs</b>, <b>sit</b>, <b>7ipip</pb>, <b>ppp</tdb>,<td width="7%"b>ipgre</b>, <b>bridge</b>, <b>nfsd</tdb>. A few features canbe specified at once, comma-separated.<td width="78%"/p>

<p><b>ENV_CREATE</b> ioctl failed</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%">Apply config ====

<pstyle="margin-left:11%;">8</pb>--applyconfig</tdb><td width="7%"i>name</tdi><td width="78%"/p>

<pstyle="margin-left:22%;">Command executed by Read container parameters fromthe container sample configuration file<tt>/etc/vz/conf/ve-</tt><i>name</i><tt>.conf-sample</tt>,and apply them, if <b>vzctl exec--save</b> returned non-zerooption specified save tothe container config file. The following parameters are notexit codechanged: <b>HOSTNAME</pb>, <b>IP_ADDRESS</tdb>,<b>OSTEMPLATE</trb>, <b>VE_ROOT<tr valign="top" align="left"/b>, and<td width="11%"b>VE_PRIVATE</tdb>.<td width="4%"/p>

<pstyle="margin-left:11%;">9</pb>--applyconfig_map</tdb><td width="7%"i>group</tdi><td width="78%"/p>

<pstyle="margin-left:22%;">Container is locked Apply container configparameters selected by another <bi>vzctlgroup</bi>. Now the only possibleinvocationvalue for </pi> group</tdi>is </trb>name<tr valign="top" align="left"/b>: to restore containername based on <td width="11%"b>NAME</tdb>variable in containerconfiguration file.<td width="4%"/p>

<p>10<==== I/p></td><td widthO scheduling ==="7%"></td><td width="78%">

<pstyle="margin-left:11%;">Global OpenVZ configuration file [[Man/vz.conf.5|<b>vz.conf--ioprio</b>(5)]] notfound</pi> priority</tdi></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"p>

<pstyle="margin-left:22%;">Assigns disk I/O priority tocontainer. <i>Priority</i> range is <b>0-7</b>. The greater<i>priority</i> is, the more time for I/O activity containerhas. By default each container has <i>priority</i> of<b>114</pb>.</tdp> <td widthp style="7margin-left:11%;"><b>--iolimit</b><i>limit</i>[<b>B</b>|<b>K</b>|<b>M</b>|<b>G</b>]</tdp> <td widthp style="78margin-left:22%;">Assigns disk I/O bandwidthlimit for a container. Value is either a number with anoptional suffix, or a literal string <b>unlimited</b>. Valueof <b>0</b> means &quot;unlimited&quot;. By default acontainer has no I/O limit. Maximum allowed limit is 2gigabytes per second; values exceeding the limit aretruncated.</p>

<pstyle="margin-left:22%; margin-top: 1em">If no suffix isprovided, the <i>A vzctl helper script file not foundlimit</pi> is assumed to be in megabytes persecond. Available suffixes are: <br>&bull; <b>b</tdb>, <b>B</trb> -- bytes per second; <br>&bull; <b>k</b>, <b>K</b> -- kilobytes per second; <tr valign="top" align="left"br>&bull; <td width="11%"b>m</b>, <b>M</tdb> -- megabytes per second (default);<br>&bull; <td width="4%"b>g</b>, <b>G</b> -- gigabytes per second;</p>

<pstyle="margin-left:11%;">12</pb>--iopslimit</tdb><td width="7%"i>iops</tdi><td width="78%"/p>

<pstyle="margin-left:22%;">Permission denied<Assigns IOPS limit for acontainer, in number of input/p>output operations per second.Value is a number or a literal string </tdb>unlimited</trb>.Value of <tr valign="top" align="left"><td width="11%"b>0</tdb>means &quot;unlimited&quot;. By default acontainer has no IOPS limit.<td width="4%"/p>

<p>13</p></td><td width="7%"></td><td width="78%">= Suspending and resuming ===

<p>Capability setting failed</p></td></tr><tr valignstyle="margin-top" align="left: 1em">Checkpointing is a feature ofOpenVZ kernel which allows to save a complete in-kernel<td width="11%">state of a running container, and to restore it later.</td><td width="4%"p>

<pstyle="margin-left:11%;"><b>14suspend</pb>|<b>chkpnt</tdb><td width="7%"i>CTID</i> [<b>--dumpfile</b> <i>name</tdi>]<td width="78%"/p>

<pstyle="margin-left:17%;">Container configuration This command suspends acontainer to a dump file [[Man/ctid.conf.5|If an option <b>ctid.conf--dumpfile</b>(5)]] isnotset, default dump file namefound<b>/pvz/dump/Dump.</b><i> CTID</tdi>is used.</trp> <tr valign="top" alignp style="margin-left:11%;"><b>resume</b>|<b>restore</b><td width="11%"i>CTID</i> [<b>--dumpfile</b> <i>name</tdi>]<td width="4%"/p>

<p>15</p></td><td widthstyle="7margin-left:17%;">This command restores acontainer from the dump file created by the <b>suspend</tdb>command.<td width="78%"/p>

<p>Timeout on <b>vzctl exec</b></p></td></tr><tr valign="top" align="left"><td width="11%"></td><td widthSnapshotting ==="4%">

<p>16</p></td><td widthstyle="7%margin-top: 1em">Snapshotting is a feature basedon checkpointing and ploop shapshots. It allows to save acomplete state of container file system. Plus, if thecontainer is running, it&rsquo;s in-memory state (as incheckpointing). Note that snapshot functionality is onlyworking for containers on ploop device.</td><td width="78%"p>

<pstyle="margin-left:11%;"><b>snapshot</b> <i>CTID</i>Error during [<b>vzctl chkpnt--id</b><i>uuid</pi>] [<b>--name</tdb><i>name</tri>][<b>--description</b> <tr valign="top" align="left"i>desc</i>] <br>[<b>--skip-suspend</b>] [<td width="11%"b>--skip-config</tdb>]<td width="4%"/p>

<p>17</p></td><td widthstyle="7margin-left:17%;">Creates a container snapshot,i.e. saves the current container state, including its filesystem state, running processes state, and configurationfile.</td><td width="78%"p>

<p>Error during <b>vzctl restore</b></p></td></tr><tr valignstyle="margin-left:17%; margin-top" align="left: 1em">If a containeris running, and <td width="11%"b>--skip-suspend</tdb>option is notspecified, a container is checkpointed and then restored,and CT memory dump becomes the part of snapshot.<td width="4%"/p>

<p>18</p></td><td widthstyle="7margin-left:17%; margin-top: 1em">Unless<b>--skip-config</tdb>option is given, containerconfiguration file is saved to the snapshot.<td width="78%"/p>

<pstyle="margin-left:17%; margin-top: 1em">If <i>uuid</i>Error from is not specified, it is auto-generated. Options<b>setluid()--name</b> syscalland <b>--description</pb> can be used tospecify the snapshot name and description, respectively.Name is displayed by <b>snapshot-list</tdb>.</trp> <tr valign="top" alignp style="margin-left:11%;"><b>snapshot-switch</b><td width="11%"i>CTID</i> [<b>--skip-resume</b> | <b>--must-resume</tdb>][<td width="4%"b>--skip-config</b>] <b><br>--id</b> <i>uuid</i></p>

<p>20</p></td><td widthstyle="7margin-left:17%;">Switches the container to asnapshot identified by <i>uuid</tdi>, restoring its filesystem state, configuration (if available) and its runningstate (if available).<td width="78%"/p>

<p>Invalid command line parameter</p></td></tr><tr valignstyle="margin-left:17%; margin-top" align="left: 1em"><td width="11%"b>Note thatthe current state of a container (including its file systemstate and its configuration file) is lost!</tdb><td width="4%"/p>

<pstyle="margin-left:17%; margin-top: 1em">21Option</pb>--skip-resume</tdb>is used to ignore a CT memory dump filein a snapshot, as a result the container will end up beingin a stopped state (same as if a snapshot has been takenwith <td width="7%"b>--skip-suspend</tdb>).<td width="78%"/p>

<p>Invalid value for command line parameter</p></td></tr><tr valignstyle="margin-left:17%; margin-top" align="left: 1em">If option<td width="11%"b>--must-resume</tdb>is set, absense of a memory dump istreated as an error, and the inability to restore from thememory dump is treated as an error rather than warning.<td width="4%"/p>

<p>22</p></td><td widthstyle="7margin-left:17%; margin-top: 1em">Option option<b>--skip-config</tdb>is used to ignore the CT configurationfile in a snapshot, i.e. the current configuration file willbe left as is.<td width="78%"/p>

<pstyle="margin-left:11%;">Container root directory (<b>VE_ROOTsnapshot-delete</b>) not set</pi>CTID</tdi></trb>--id<tr valign="top" align="left"/b><td width="11%"i>uuid</tdi><td width="4%"/p>

<pstyle="margin-left:17%;">23Removes a specifiedsnapshot.</p> <p style="margin-left:11%;"><b>snapshot-mount</b><i>CTID</i> <b>--id</b> <i>uuid</i> <b>--target</b><i>directory</i></tdp> <td widthp style="7margin-left:17%;">Mounts a snapshot specified by<i>uuid</i> to a <i>directory</i>. Note this mount isread-only.</tdp> <td widthp style="78margin-left:11%;"><b>snapshot-umount</b><i>CTID</i> <b>--id</b> <i>uuid</i></p> <p style="margin-left:17%;">Unmounts a specifiedsnapshot.</p> <p style="margin-left:11%;"><b>snapshot-list</b><i>CTID</i> [<b>-H</b>] [<b>-o</b><i>field</i>[,<i>field</i>...] [<b>--id</b> <i>uuid</i>]</p> <p style="margin-left:17%;">List container&rsquo;ssnapshots.</p> <p style="margin-left:17%; margin-top: 1em">You cansuppress displaying header using <b>-H</b> option.</p>

<pstyle="margin-left:17%; margin-top: 1em">Container private directory (You can use the<b>VE_PRIVATE-o</b>) notoption to display only the specifiedset</p> </tdi>field</tri>(s). List of available fields can be obtainedusing <tr valign="top" align="left"b>-L<td width="11%"/b>option.</td><td width="4%"p>

<p>24</p></td><td width="7%"></td><td width="78%">= Performing container actions ===

<p>Container template directory (<b>TEMPLATE</b>) nottable width="100%" border="0" rules="none" frame="void"set</p> </td></tr cellspacing="0" cellpadding="0">

<td width="49%">

<pstyle="margin-top: 1em"><b>create</b>28</p></td><td width="72%"></td>

<pstyle="margin-top: 1em"><i>CTID</i>[<b>--ostemplate&nbsp;</b><i>name</i>][<b>--config&nbsp;</b><i>name</i>][<b>--layout&nbsp;simfs</b>|<b>ploop</b>[<b>:</b>{<b>expanded</b>|<b>plain</b>|<b>raw</b>}]][<b>--diskspace&nbsp;</b><i>kbytes</i>][<b>--diskinodes&nbsp;</b><i>num</i>][<b>--private&nbsp;</b><i>path</i>][<b>--root&nbsp;</b><i>path</i>][<b>--ipadd&nbsp;</b><i>addr</i>Not all required UBC parameters are set, unable to start]container[<b>--hostname&nbsp;</b><i>name</pi>][<b> --name&nbsp;</tdb><i>name</tri>][<b>--local_uid&nbsp;</b><i>uid<tr valign="top" align="left"/i>][<b>--local_gid&nbsp;</b><i>gid</i>]</p> </td width="11%"></tdtr></table> <td widthp style="4margin-left:17%; margin-top: 1em">Creates a newcontainer area. This operation should be done once, beforethe first start of the container.</p>

<pstyle="margin-left:17%; margin-top: 1em">By default, anOS template denoted by <b>29DEF_OSTEMPLATE</pb> parameter of[[Man/vz.conf.5|<b>vz.conf</tdb>(5)]] is used to create a container. This can beoverwritten by <td width="7%"b>--ostemplate</tdb>option.<td width="78%"/p>

<pstyle="margin-left:17%; margin-top: 1em">OS template is not specifiedBy default, unable to createanew containerconfiguration file is created from a sampleconfiguration denoted by value of </pb> CONFIGFILE</tdb><parameter of [[Man/tr>vz.conf.5|<tr valign="top" align="left"><td width="11%"b>vz.conf</tdb>(5)]]. If the containerconfiguration file already exists, it will not bemodified.<td width="4%"/p>

<pstyle="margin-left:17%; margin-top: 1em">31The value of<b>CONFIGFILE</pb> can be overwritten by using the<b>--config</tdb><td width="7%"i>name</tdi>option. This option can not beused if the container configuration file already exists.<td width="78%"/p>

<pstyle="margin-left:17%; margin-top: 1em">Container not runningA new containercan either be created using <b>simfs</b> filesystem or on a<b>ploop</b> device. The default is set by value of<b>VE_LAYOUT</b> parameter of [[Man/vz.conf.5|<b>vz.conf</pb>(5)]] and can beoverwritten by <b>--layout</tdb>option. In case <b>ploop</trb>is used, one can additionally specify ploop disk imageformat after a colon. Possible ploop formats are<b>expanded</b>, <b>plain<tr valign="top" align="left"/b> and <b>raw</b>. Default is<td width="11%"b>expanded</b>. Using value other than <b>expanded</tdb>isnot recommended and is currently not supported.<td width="4%"/p>

<pstyle="margin-left:17%; margin-top: 1em">32You can use<b>--diskspace</pb> and <b>--diskinodes</tdb>options tospecify container file system size. Note that for<td width="7%"b>ploop</tdb>layout, you will not be able to change inodesvalue later.<td width="78%"/p>

<pstyle="margin-left:17%; margin-top: 1em">Container already runningIf<b>DISKSPACE</pb> is not specified either in the sampleconfiguration file used for creation or in globalconfiguration file [[Man/vz.conf.5|<b>vz.conf</tdb>(5)]], </trb>--diskspace<tr valign="top" align="left"/b>parameter is required for <td width="11%"b>ploop</tdb>layout.<td width="4%"/p>

<pstyle="margin-left:17%; margin-top: 1em">33Suffixes<b>G</pb>, <b>M</b>, <b>K</tdb>can also be specified (see<td width="7%"b>Resource limits</tdb>section for more info onsuffixes).<td width="78%"/p>

<pstyle="margin-left:17%; margin-top: 1em">You can use<b>--root</b> <i>Unable path</i> option to stop sets the path to themount point for the containerroot directory (default is</pb>VE_ROOT</tdb>specified in [[Man/vz.conf.5|</trb>vz.conf<tr valign="top" align="left"/b>(5)]] file).Argument can contain literal string <td width="11%"b>$VEID</tdb>, which willbe substituted with the numeric CT ID.<td width="4%"/p>

<pstyle="margin-left:17%; margin-top: 1em">You can use<b>--private</b> <i>path</i> option to set the path todirectory in which all the files and directories specific tothis very container are stored (default is <b>34VE_PRIVATE</pb>specified in [[Man/vz.conf.5|<b>vz.conf</tdb>(5)]] file). Argument can containliteral string <td width="7%"b>$VEID</tdb>, which will be substituted withthe numeric CT ID.<td width="78%"/p>

<pstyle="margin-left:17%; margin-top: 1em">You can use<b>Unable to add IP address to container--ipadd</pb></tdi>addr</tri>option to assign an IP address to<tr valign="top" align="left">a container. Note that this option can be used multiple<td width="11%">times.</td><td width="4%"p>

<pstyle="margin-left:17%; margin-top: 1em">40You can use</pb>--hostname</tdb><td width="7%"i>name</tdi>option to set a host name fora container.<td width="78%"/p>

<pstyle="margin-left:17%; margin-top: 1em">When runningwith an upstream Linux Kernel that supports user namespaces(&gt;= 3.8), the parameters <b>--local_uid</b> and<b>Container not mounted--local_gid</b> can be used to select which <i>uid</pi>and <i>gid</tdi> respectively will be used as a base user inthe host system. Note that user namespaces provide a 1:1mapping between container users and host users. If theseoptions are not specified, the values <b>LOCAL_UID</trb>and<tr valign="top" align="left"b>LOCAL_GID</b>from global configuration file[[Man/vz.conf.5|<b>vz.conf</b>(5)]] are used. An explicit <td width="11%"b>--local_uid</tdb>value of 0 will disable user namespace support, and run thecontainer as a privileged user. In this case,<b>--local_gid</b> is ignored.<td width="4%"/p>

<pstyle="margin-left:17%; margin-top: 1em"><b>41Warning:</pb>use <b>--local_uid</tdb>and <td width="7%"b>--local_gid</tdb>with care,specially when migrating containers. In all situations, thecontainer&rsquo;s files in the filesystem needs to becorrectly owned by the host-side users.<td width="78%"/p>

<pstyle="margin-left:11%;">Container already mounted</pb>destroy</tdb>| </trb>delete<tr valign="top" align="left"/b><td width="11%"i>CTID</tdi><td width="4%"/p>

<p>43</p></td><td widthstyle="7margin-left:17%;">Removes a container privatearea by deleting all files, directories and theconfiguration file of this container.</td><td width="78%"p>

<pstyle="margin-left:11%;">Container private area not found<b>start</pb> <i>CTID</i>[<b>--wait</tdb>] [<b>--force</trb>] [<b>--skip-fsck<tr valign="top" align="left"/b>][<td width="11%"b>--skip-remount</tdb>]<td width="4%"/p>

<pstyle="margin-left:17%;">Mounts (if necessary) andstarts a container. Unless <b>44--wait</pb> option isspecified, <b>vzctl</tdb>will return immediately; otherwisean attempt to wait till the default runlevel is reached willbe made by <td width="7%"b>vzctl</tdb>.<td width="78%"/p>

<pstyle="margin-left:17%; margin-top: 1em">Container private area already existsSpecify</pb>--force</td></tr><tr valign="top" align="left"b>if you want to start a container which isdisabled (see <td width="11%"b>--disabled</tdb>).<td width="4%"/p>

<p>46</p></td><td widthstyle="7margin-left:17%; margin-top: 1em">Specify<b>--skip-fsck</tdb>to skip fsck for ploop-based containerfilesystem (this option is used by vz initscript).<td width="78%"/p>

<p>Not enough disk space</p></td></tr><tr valignstyle="margin-left:17%; margin-top" align="left: 1em">By default, ifa container to be started happens to be already mounted, itis unmounted and mounted again. This behavior can be turnedoff by using <td width="11%"b>--skip-remount</tdb>flag.<td width="4%"/p>

<pstyle="margin-left:17%; margin-top: 1em">Note that thiscommand can lead to execution of <b>47premount</pb>,<b>mount</tdb>and <td width="7%"b>start</tdb> action scripts (see <b>ACTIONSCRIPTS<td width="78%"/b> below).</p>

<pstyle="margin-left:11%;">Bad/broken container (<b>/sbin/initstop</b> or<bi>CTID</bin/shi>[</b> not found)--fast</pb>] [</tdb>--skip-umount</tr><tr valign="top" align="left"><td width="11%"b>]</td><td width="4%"p>

<pstyle="margin-left:17%;">Stops a container and unmountsit (unless <b>48--skip-umount</pb> is given). Normally,<b>halt</tdb>(8) is executed inside a container; option<td width="7%"b>--fast</b> makes <b>vzctl</b> use <b>reboot</tdb>(2)syscall instead which is faster but can lead to uncleancontainer shutdown.<td width="78%"/p>

<pstyle="margin-left:17%; margin-top: 1em">Unable Note that<b>vzctl stop</b> is not asyncronous, in other words vzctlwaits for container&rsquo;s init to exit (unless<b>--fast</b> is given), which can take up to create a new container private areafew minutes.Default wait timeout is 120 seconds; it can be changedglobally, by setting <b>STOP_TIMEOUT</pb> in[[Man/vz.conf.5|<b>vz.conf</tdb>(5)]], or per container (<b>STOP_TIMEOUT</trb>in[[Man/ctid.conf.5|<b>ctid.conf<tr valign="top" align="left"/b>(5)]], see <td width="11%"b>--stop-timeout</tdb>).<td width="4%"/p>

<pstyle="margin-left:17%; margin-top: 1em">49Note that thiscommand can lead to execution of <b>stop</pb>, <b>umount</tdb>and <td width="7%"b>postumount</tdb> action scripts (see <b>ACTIONSCRIPTS</b> below).<td width="78%"/p>

<pstyle="margin-left:11%;">Unable to create a new container root area<b>restart</pb> <i>CTID</i>[<b>--wait</tdb>] [<b>--force</trb>] [<b>--fast<tr valign="top" align="left"/b>][<td width="11%"b>--skip-fsck</tdb>]<td width="4%"/p>

<pstyle="margin-left:17%;">50Restarts a container, i.e.stops it if it is running, and starts again. Accepts all the</pb>start</tdb>and <td width="7%"b>stop</tdb>options.<td width="78%"/p>

<p>Unable to mount container</p></td></tr><tr valignstyle="margin-left:17%; margin-top" align="left: 1em">Note that thiscommand can lead to execution of some action scripts (see<td width="11%"b>ACTION SCRIPTS</tdb>below).<td width="4%"/p>

<pstyle="margin-left:11%;">51</pb>status</tdb><td width="7%"i>CTID</tdi><td width="78%"/p>

<p>Unable to unmount container</p></td></tr><tr valign="top" alignstyle="margin-left:17%;">Shows a container status. This<td width="11%">is a line with five or six words, separated by spaces.</td><td width="4%"p>

<p>52</p></td><td widthstyle="7margin-left:17%; margin-top: 1em">First word isliterally <b>CTID</tdb>.<td width="78%"/p>

<p>Unable to delete a container</p></td></tr><tr valignstyle="margin-left:17%; margin-top" align="left: 1em">Second word isthe numeric <td width="11%"i>CT ID</tdi>.<td width="4%"/p>

<pstyle="margin-left:17%; margin-top: 1em">53Third word isshowing whether this container exists or not, it can beeither </pb>exist</tdb>or <td width="7%"b>deleted</tdb>.<td width="78%"/p>

<pstyle="margin-left:17%; margin-top: 1em">Container private area not existFourth word isshowing the status of the container filesystem, it can beeither </pb>mounted</tdb>or </trb>unmounted<tr valign="top" align="left"><td width="11%"/b>.</td><td width="4%"p>

<pstyle="margin-left:17%; margin-top: 1em">60Fifth wordshows if the container is running, it can be either</pb>running</tdb>or <td width="7%"b>down</tdb>.<td width="78%"/p>

<pstyle="margin-left:17%; margin-top: 1em">Sixth word, ifexists, is <b>vzquota onsuspended</b> failed. It appears if a dump fileexists for a stopped container (see </pb>suspend</tdb>).</tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"p>

<p>61</p></td><td widthstyle="7margin-left:17%; margin-top: 1em">This commandcan also be usable from scripts.</td><td width="78%"p>

<pstyle="margin-left:11%;"><b>vzquota initmount</b> failed</pi>CTID</tdi></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"p>

<pstyle="margin-left:17%;">62Mounts container private area.Note that this command can lead to execution of<b>premount</pb> and <b>mount</tdb>action scripts (see<td width="7%"b>ACTION SCRIPTS</tdb>below).<td width="78%"/p>

<pstyle="margin-left:11%;"><b>vzquota setlimitumount</b> failed</pi>CTID</tdi></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"p>

<pstyle="margin-left:17%;">63Unmounts container privatearea. Note that this command can lead to execution of<b>umount</pb> and <b>postumount</tdb>action scripts (see<td width="7%"b>ACTION SCRIPTS</tdb>below).<td width="78%"/p>

<pstyle="margin-left:17%; margin-top: 1em">Parameter Note that<b>DISKSPACEstop</b> not setdoes </pb>umount</tdb>automatically.</tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"p>

<pstyle="margin-left:11%;">64<b>convert</pb> <i>CTID</tdi>[<td width="7%"b>--layoutploop</b>[<b>:</b>{<b>expanded</b>|<b>plain</b>|<b>raw</tdb>}]]<td width="78%"/p>

<p>Parameter <b>DISKINODES</b> not set</p></td></tr><tr valign="top" alignstyle="margin-left:17%;">Convert CT private area toreside on a ploop device (available in kernel version042stab052.8 and greater). Conversion should be performedwhen a container is stopped, plus disk space quota should be<td width="11%">set.</td><td width="4%"p>

<pstyle="margin-left:11%;">66</pb>compact</tdb><td width="7%"i>CTID</tdi><td width="78%"/p>

<p><b>vzquota off</b> failed</p></td></tr><tr valign="top" alignstyle="margin-left:17%;">Compact container image. This<td width="11%">only makes sense for ploop layout.</td><td width="4%"p>

<pstyle="margin-left:11%;">67</pb>quotaon</tdb><td width="7%"i>CTID</tdi><td width="78%"/p>

<pstyle="margin-left:17%;">ugid Turn disk quota not initializedon. Not that</pb>mount</tdb>and </trb>start<tr valign="top" align="left"><td width="11%"/b>does that automatically.</td><td width="4%"p>

<pstyle="margin-left:11%;">71</pb>quotaoff</tdb><td width="7%"i>CTID</tdi><td width="78%"/p>

<pstyle="margin-left:17%;">Incorrect IP address formatTurn disk quota off. Not that</pb>umount</tdb>and </trb>stop<tr valign="top" align="left"><td width="11%"/b>does that automatically.</td><td width="4%"p>

<pstyle="margin-left:11%;">74</pb>quotainit</tdb><td width="7%"i>CTID</tdi><td width="78%"/p>

<pstyle="margin-left:17%;">Error changing passwordInitialize disk quota (i.e. run</pb>vzquota init</tdb><) with the parameters taken from the CTconfiguration file [[Man/tr>ctid.conf.5|<tr valign="top" align="left"b>ctid.conf<td width="11%"/b>(5)]].</td><td width="4%"p>

<pstyle="margin-left:11%;">78</pb>exec</tdb><td width="7%"i>CTIDcommand</tdi><td width="78%"/p>

<pstyle="margin-left:17%;">IP address already in useExecutes </pi>command</tdi>in acontainer. Environment variables are not set inside thecontainer. Signal handlers may differ from default settings.If </tri>command<tr valign="top" align="left"/i>is <td width="11%"b>-</tdb>, commands are read fromstdin.<td width="4%"/p>

<pstyle="margin-left:11%;">79</pb>exec2</tdb><td width="7%"i>CTIDcommand</tdi><td width="78%"/p>

<pstyle="margin-left:17%;">Container action script returned an error</p>The same as </tdb>exec</trb>, butreturn code is that of <tr valign="top" align="left"i>command<td width="11%"/i>.</td><td width="4%"p>

<pstyle="margin-left:11%;">82</pb>runscript</tdb><td width="7%"i>CTIDscript</tdi><td width="78%"/p>

<pstyle="margin-left:17%;">Config file copying errorRun specified shell script inthe container. Argument </pi>script</td></tri>is a file on the hostsystem which contents is read by vzctl and executed in thecontext of the container. For a running container, thecommand jumps into the container and executes the script.For a stopped container, it enters the container, mountscontainer&rsquo;s root filesystem, executes the script, andunmounts CT root. In the latter case, the container is not<tr valign="top" align="left">really started, no file systems other than root (such as<td width="11%"b>/proc</tdb>) are mounted, no startup scripts are executedetc. Thus the environment in which the script is running isfar from normal and is only usable for very basicoperations.<td width="4%"/p>

<pstyle="margin-left:11%;"><b>86enter</pb> <i>CTID</tdi>[<b>--exec</b> <i>command</i> [<td width="7%"i>arg</tdi>...]]<td width="78%"/p>

<pstyle="margin-left:17%;">Error setting devices Enters into a container (<b>givinga container&rsquo;s root shell). This option is a back--devices</b> ordoorfor host root only. The proper way to have CT root shell isto use <b>--devnodesssh</b>(1).</p> </td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%">

<pstyle="margin-left:17%; margin-top: 1em">Option<b>89--exec</pb> is used to run <i>command</i> with argumentsafter entering into container. This is useful if command tobe run requires a terminal (so <b>vzctl exec</tdb>can not beused) and for some reason you can not use <b>ssh<td width="7%"/b>(1).</tdp> <td widthp style="78margin-left:17%; margin-top: 1em">You need to logout manually from the shell to finish session (even if youspecified <b>--exec</b>).</p>

<pstyle="margin-left:11%;">IP address not available</pb>console</tdb></tri>CTID<tr valign="top" align="left"/i>[<td width="11%"i>ttynum</tdi>]<td width="4%"/p>

<pstyle="margin-left:17%;">Attach to a container console.Optional <i>ttynum</i> argument is tty number (such as<b>4</b> for <b>91tty4</pb>), default is <b>1</tdb>which is usedfor container&rsquo;s <td width="7%"b>/dev/console</tdb>.<td width="78%"/p>

<p>OS template not found</p></td></tr><tr valignstyle="margin-left:17%; margin-top: 1em" align="left">Note theconsoles are persistent, meaning that: <br>&bull; it can be attached to even if the container is notrunning; <td width="11%"br>&bull; there is no automatic detachment upon the containerstop; </tdbr>&bull; detaching from the console leaves anything running inthis console as is.<td width="4%"/p>

<p>100</p></td><td widthstyle="7margin-left:17%; margin-top: 1em">The followingescape sequences are recognized by <b>vzctl console</tdb>.Note that these sequences are only recognized at thebeginning of a line.<td width="78%"/p>

<pstyle="margin-left:17%; margin-top: 1em">Unable to find container IP address&bull;</pb>Esc</tdb>then </trb>.<tr valign="top" align="left"><td width="11%"/b>to detach from the console.</td><td width="4%"p>

<pstyle="margin-left:17%; margin-top: 1em">104&bull;</pb>Esc</tdb>then <td width="7%"b>!</tdb>to kill anything running on theconsole (SAK). This is helpful when one expects a loginprompt but there isn&rsquo;t one.<td width="78%"/p>

<p><b>VE_NETDEV</b> ioctl error</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td widthOther options ==="4%">

<p>105</p></td><td widthstyle="7margin-left:11%;"><b>--help</tdb><td width="78%"/p>

<p>Container start disabled</p></td></tr><tr valign="top" alignstyle="margin-left:17%;">Prints help message with a<td width="11%">brief list of possible options.</td><td width="4%"p>

<p>106</p></td><td widthstyle="7margin-left:11%;"><b>--version</tdb><td width="78%"/p>

<p>Unable to set iptables on a running container</p></td></tr><tr valign="top" alignstyle="margin-left:17%;">Prints <td width="11%"b>vzctl</tdb>version.<td width="4%"/p>

<p>107</p></td><td width="7%"></td><td width="78%">ACTION SCRIPTS ==

<pstyle="margin-left:11%; margin-top: 1em"><b>Distributionvzctl</b>has an ability to execute user-defined scripts when aspecific configuration file not found<b>vzctl</pb> command is run for a container. Thefollowing <b>vzctl</b> commands can trigger execution ofaction scripts: <b>start</b>, <b>stop</tdb>, <b>restart</trb>,<tr valign="top" align="left"b>mount</b>and <td width="11%"b>umount</tdb>.<td width="4%"/p>

<pstyle="margin-left:11%; margin-top: 1em">Action scriptsare located in the <b>109/etc/vz/conf/</pb> directory. There areglobal and per-CT scripts. Global scripts have a literalprefix of <b>vps.</tdb>and are executed for all containers.Per-CT scripts have a <td width="7%"i>CTID</i><b>.</tdb>numeric prefix andare executed for the given container only.<td width="78%"/p>

<pstyle="margin-left:11%; margin-top: 1em">Unable to apply Please notescripts are executed in a confighost system (CT0) context, withthe exception of </pb>.start</tdb>and </trb>.stop<tr valign="top" align="left"/b>scripts,<td width="11%">which are executed in a container context.</td><td width="4%"p>

<pstyle="margin-left:11%; margin-top: 1em">The followingaction scripts are currently defined: <b><br>129vps.premount</pb>, <i>CTID</tdi><b>.premount<td width="7%"/b></tdp> <td widthp style="78margin-left:22%;">Global and per-CT mount scriptswhich are executed for a container before it is mounted.Scripts are executed in the host system context, while a CTis not yet mounted or running. Global script, if exists, isexecuted first.</p>

<pstyle="margin-left:11%;">Unable to set meminfo parameter</pb>vps.mount</tdb>,</tri>CTID<tr valign="top" align="left"/i><td width="11%"b>.mount</tdb><td width="4%"/p>

<p>130</p></td><td widthstyle="7margin-left:22%;">Global and per-CT mount scriptswhich are executed for a container right after it ismounted. Otherwise they are the same as <b>.premount</tdb>scripts.<td width="78%"/p>

<pstyle="margin-left:11%;">Error setting veth interface</pi>CTID</tdi></trb>.start<tr valign="top" align="left"><td width="11%"/b></td><td width="4%"p>

<p>131</p></td><td widthstyle="7margin-left:22%;">Right after <b>vzctl</tdb>hasstarted a container, it executes this script in a containercontext.<td width="78%"/p>

<pstyle="margin-left:11%;">Error setting container name</pi>CTID</tdi></trb>.stop<tr valign="top" align="left"><td width="11%"/b></td><td width="4%"p>

<p>133</p></td><td widthstyle="7margin-left:22%;">Right before <b>vzctl</tdb>hasstopped a container, it executes this script in a containercontext.<td width="78%"/p>

<pstyle="margin-left:11%;">Waiting for container start failed</pb>vps.umount</tdb>,</tri>CTID<tr valign="top" align="left"/i><td width="11%"b>.umount</tdb><td width="4%"/p>

<p>139</p></td><td widthstyle="7margin-left:22%;">Global and per-CT umountscripts which are executed for a container before it isunmounted. Scripts are executed in the host system context,while a CT is mounted. Global script, if exists, is executedfirst.</td><td width="78%"p>

<pstyle="margin-left:11%;">Error saving container configuration file</pb>vps.postumount</tdb>,</tri>CTID<tr valign="top" align="left"/i><td width="11%"b>.postumount</tdb><td width="4%"/p>

<p>148</p></td><td widthstyle="7margin-left:22%;">Global and per-CT umountscripts which are executed for a container right after it isunmounted. Otherwise they are the same as <b>.umount</tdb>scripts.<td width="78%"/p>

<pstyle="margin-left:11%; margin-top: 1em">Error setting container IO parameters The environmentpassed to all the <b>*mount</b> scripts is the standardenvironment of the parent (ioprioi.e. <b>vzctl</b>)with twoadditional variables: <b>$VEID</pb> and <b>$VE_CONFFILE</tdb>.The first one holds the ID of the container, and the secondone holds the full path to the container configuration file.If the script needs to get other CT configurationparameters, such as <b>$VE_ROOT</trb>, it needs to get thosefrom global and per-CT configuration files.</tablep>

== EXAMPLES == <p style="margin-left:11%; margin-top: 1em">To create andHere is anstart example of a mount script, which makes host system&quot;basic&quotrsquo; s/mnt/disk available to container with ID of 1000 using(s). Script name can eitherbe <b>/etc/vz/conf/vps.mount</b> or<b>/etc/vz/conf/</b><i>fedora-core-5CTID</i> OS template and IP address of192<b>.168mount</b>.10.200: <br/p>vzctl create 1000 <pre style="margin-left:11%; margin-top: 1em"> # If one of these files does not exist then something # is really broken [ -ostemplate fedoraf /etc/vz/vz.conf ] || exit 1 [ -coref $VE_CONFFILE ] || exit 1 # Source both files. Note the order is important. . /etc/vz/vz.conf . $VE_CONFFILE SRC=/mnt/disk DST=/mnt/disk mount -5 n -t simfs $SRC ${VE_ROOT}${DST} -config basico $SRC<br/pre>vzctl set 1000 == EXIT STATUS == <p style="margin-left:11%; margin-ipadd 192.168.10.200 --save top: 1em">Returns 0 uponsuccess, or an appropriate error code in case of anerror:</p> <table width="100%" border="0" rules="none" frame="void" cellspacing="0" cellpadding="0"><tr valign="top" align="left"><td width="11%"><br/td>vzctl start 1000<td width="4%"> <p>1</p></td><td width="7%"></td><td width="78%">

<p>Failed to set a UBC parameter</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>2</p></td><td width="7%"></td><td width="78%"> <p>Failed to set a fair scheduler parameter</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>3</p></td><td width="7%"></td><td width="78%"> <p>Generic system error</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>5</p></td><td width="7%"></td><td width="78%"> <p>The running kernel is not an OpenVZ kernel (or someOpenVZ modules are not loaded)</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>6</p></td><td width="7%"></td><td width="78%"> <p>Not enough system resources</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>7</p></td><td width="7%"></td><td width="78%"> <p><b>ENV_CREATE</b> ioctl failed</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>8</p></td><td width="7%"></td><td width="78%"> <p>Command executed by <b>vzctl exec</b> returned non-zeroexit code</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>9</p></td><td width="7%"></td><td width="78%"> <p>Container is locked by another <b>vzctl</b>invocation</p> </td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>10</p></td><td width="7%"></td><td width="78%"> <p>Global OpenVZ configuration file [[Man/vz.conf.5|<b>vz.conf</b>(5)]] notfound</p> </td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>11</p></td><td width="7%"></td><td width="78%"> <p>A vzctl helper script file not found</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>12</p></td><td width="7%"></td><td width="78%"> <p>Permission denied</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>13</p></td><td width="7%"></td><td width="78%"> <p>Capability setting failed</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>14</p></td><td width="7%"></td><td width="78%"> <p>Container configuration file [[Man/ctid.conf.5|<b>ctid.conf</b>(5)]] notfound</p> </td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>15</p></td><td width="7%"></td><td width="78%"> <p>Timeout on <b>vzctl exec</b></p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>16</p></td><td width="7%"></td><td width="78%"> <p>Error during <b>vzctl suspend</b></p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>17</p></td><td width="7%"></td><td width="78%"> <p>Error during <b>vzctl resume</b></p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>18</p></td><td width="7%"></td><td width="78%"> <p>Error from <b>setluid()</b> syscall</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>20</p></td><td width="7%"></td><td width="78%"> <p>Invalid command line parameter</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>21</p></td><td width="7%"></td><td width="78%"> <p>Invalid value for command line parameter</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>22</p></td><td width="7%"></td><td width="78%"> <p>Container root directory (<b>VE_ROOT</b>) not set</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>23</p></td><td width="7%"></td><td width="78%"> <p>Container private directory (<b>VE_PRIVATE</b>) notset</p> </td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>24</p></td><td width="7%"></td><td width="78%"> <p>Container template directory (<b>TEMPLATE</b>) notset</p> </td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>28</p></td><td width="7%"></td><td width="78%"> <p>Not all required UBC parameters are set, unable to startcontainer</p> </td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>29</p></td><td width="7%"></td><td width="78%"> <p>OS template is not specified, unable to createcontainer</p> </td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>31</p></td><td width="7%"></td><td width="78%"> <p>Container not running</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>32</p></td><td width="7%"></td><td width="78%"> <p>Container already running</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>33</p></td><td width="7%"></td><td width="78%"> <p>Unable to stop container</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>34</p></td><td width="7%"></td><td width="78%"> <p>Unable to add IP address to container</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>40</p></td><td width="7%"></td><td width="78%"> <p>Container not mounted</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>41</p></td><td width="7%"></td><td width="78%"> <p>Container already mounted</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>43</p></td><td width="7%"></td><td width="78%"> <p>Container private area not found</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>44</p></td><td width="7%"></td><td width="78%"> <p>Container private area already exists</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>46</p></td><td width="7%"></td><td width="78%"> <p>Not enough disk space</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>47</p></td><td width="7%"></td><td width="78%"> <p>Bad/broken container (<b>/sbin/init</b> or<b>/bin/sh</b> not found)</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>48</p></td><td width="7%"></td><td width="78%"> <p>Unable to create a new container private area</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>49</p></td><td width="7%"></td><td width="78%"> <p>Unable to create a new container root area</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>50</p></td><td width="7%"></td><td width="78%"> <p>Unable to mount container</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>51</p></td><td width="7%"></td><td width="78%"> <p>Unable to unmount container</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>52</p></td><td width="7%"></td><td width="78%"> <p>Unable to delete a container</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>53</p></td><td width="7%"></td><td width="78%"> <p>Container private area not exist</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>60</p></td><td width="7%"></td><td width="78%"> <p><b>vzquota on</b> failed</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>61</p></td><td width="7%"></td><td width="78%"> <p><b>vzquota init</b> failed</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>62</p></td><td width="7%"></td><td width="78%"> <p><b>vzquota setlimit</b> failed</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>63</p></td><td width="7%"></td><td width="78%"> <p>Parameter <b>DISKSPACE</b> not set</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>64</p></td><td width="7%"></td><td width="78%"> <p>Parameter <b>DISKINODES</b> not set</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>65</p></td><td width="7%"></td><td width="78%"> <p>Error setting in-container disk quotas</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>66</p></td><td width="7%"></td><td width="78%"> <p><b>vzquota off</b> failed</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>67</p></td><td width="7%"></td><td width="78%"> <p>ugid quota not initialized</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>71</p></td><td width="7%"></td><td width="78%"> <p>Incorrect IP address format</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>74</p></td><td width="7%"></td><td width="78%"> <p>Error changing password</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>78</p></td><td width="7%"></td><td width="78%"> <p>IP address already in use</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>79</p></td><td width="7%"></td><td width="78%"> <p>Container action script returned an error</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>82</p></td><td width="7%"></td><td width="78%"> <p>Config file copying error</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>86</p></td><td width="7%"></td><td width="78%"> <p>Error setting devices (<b>--devices</b> or<b>--devnodes</b>)</p> </td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>89</p></td><td width="7%"></td><td width="78%"> <p>IP address not available</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>91</p></td><td width="7%"></td><td width="78%"> <p>OS template not found</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>99</p></td><td width="7%"></td><td width="78%"> <p>Ploop is not supported by either the running kernel orvzctl.</p> </td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>100</p></td><td width="7%"></td><td width="78%"> <p>Unable to find container IP address</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>104</p></td><td width="7%"></td><td width="78%"> <p><b>VE_NETDEV</b> ioctl error</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>105</p></td><td width="7%"></td><td width="78%"> <p>Container start disabled</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>106</p></td><td width="7%"></td><td width="78%"> <p>Unable to set iptables on a running container</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>107</p></td><td width="7%"></td><td width="78%"> <p>Distribution-specific configuration file not found</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>109</p></td><td width="7%"></td><td width="78%"> <p>Unable to apply a config</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>129</p></td><td width="7%"></td><td width="78%"> <p>Unable to set meminfo parameter</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>130</p></td><td width="7%"></td><td width="78%"> <p>Error setting veth interface</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>131</p></td><td width="7%"></td><td width="78%"> <p>Error setting container name</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>133</p></td><td width="7%"></td><td width="78%"> <p>Waiting for container start failed</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>139</p></td><td width="7%"></td><td width="78%"> <p>Error saving container configuration file</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>148</p></td><td width="7%"></td><td width="78%"> <p>Error setting container IO parameters (ioprio)</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>150</p></td><td width="7%"></td><td width="78%"> <p>Ploop image file not found</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>151</p></td><td width="7%"></td><td width="78%"> <p>Error creating ploop image</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>152</p></td><td width="7%"></td><td width="78%"> <p>Error mounting ploop image</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>153</p></td><td width="7%"></td><td width="78%"> <p>Error unmounting ploop image</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>154</p></td><td width="7%"></td><td width="78%"> <p>Error resizing ploop image</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>155</p></td><td width="7%"></td><td width="78%"> <p>Error converting container to ploop layout</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>156</p></td><td width="7%"></td><td width="78%"> <p>Error creating ploop snapshot</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>157</p></td><td width="7%"></td><td width="78%"> <p>Error merging ploop snapshot</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>158</p></td><td width="7%"></td><td width="78%"> <p>Error deleting ploop snapshot</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>159</p></td><td width="7%"></td><td width="78%"> <p>Error switching ploop snapshot</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>166</p></td><td width="7%"></td><td width="78%"> <p>Error compacting ploop image</p></td></tr><tr valign="top" align="left"><td width="11%"></td><td width="4%"> <p>167</p></td><td width="7%"></td><td width="78%"> <p>Error listing ploop snapsots</p></td></tr></table> == EXAMPLES == <p style="margin-left:11%; margin-top: 1em">To create andstart &quot;basic&quot; container with ID of 1000 using<b>centos-5</b> OS template and IP address of192.168.10.200:</p> <pre style="margin-left:11%; margin-top: 1em"> vzctl create 1000 --ostemplate centos-5 --config basic vzctl set 1000 --ipadd 192.168.10.200 --save vzctl start 1000</pre> <p style="margin-left:11%; margin-top: 1em">To set numberof processes barrier/limit to 80/100, and PTY barrier/limitto 16/20 PTYs: <br/p> <pre style="margin-left:11%; margin-top: 1em"> vzctl set 1000 --numproc 80:100 -t 16:20 --save</pre> <pstyle="margin-left:11%; margin-top: 1em">To executecommand <b>ls -la</b> in this container:</p> <pre style="margin-left:11%; margin-top: 1em"> vzctl exec 1000 /bin/ls -la</pre>

command pipe <b>ls -lal / | sort</b> in this container: <br>vzctl exec 1000 /bin/ls -la</p> <p pre style="margin-left:11%; margin-top: 1em">To executecommand pipe <b>ls -l / | sort</b> in this container: <br> vzctl exec 1000 &rsquo;ls -l / | sort&rsquo;</ppre> <p style="margin-left:11%; margin-top: 1em">To enter thiscontainer and execute command <b>apt-get install vim</b>:</p> <brpre style="margin-left:11%; margin-top: 1em"> vzctl enter 1000 --exec apt-get install vim</ppre> <p style="margin-left:11%; margin-top: 1em">Note that inthe above example you will need to log out from thecontainer&rsquo;s shell after apt-get finishes.</p> <p style="margin-left:11%; margin-top: 1em">To enter thiscontainer, execute command <b>apt-get install vim</b> andlogout after successful installation (or stay inside thecontainer if installation process failed) use<b>&amp;&amp;</b>: <br/p> <pre style="margin-left:11%; margin-top: 1em"> vzctl enter 1000 --exec &quot;apt-get install vim &amp;&amp;logout&quot;</ppre> <p style="margin-left:11%; margin-top: 1em">To enter thiscontainer, execute command <b>apt-get install vim</b> andlogout independently of exit code of installation processuse <b>;</b>: <br/p> <pre style="margin-left:11%; margin-top: 1em"> vzctl enter 1000 --exec &quot;apt-get install vim ;logout&quot;</ppre> <p style="margin-left:11%; margin-top: 1em">Note that youneed to quote the command if you use <b>&amp;&amp;</b> or<b>;</b>.</p> <p style="margin-left:11%; margin-top: 1em">To stop thiscontainer: <br/p> <pre style="margin-left:11%; margin-top: 1em"> vzctl stop 1000</pre> <p style="margin-left:11%; margin-top: 1em">To permanentlyremove this container:</p>

<p pre style="margin-left:11%; margin-top: 1em">To permanentlyremove this container: <br> vzctl destroy 1000</ppre>

<p pre style="margin-left:11%; margin-top: 1em">/etc/vz/vz.conf<br>/etc/vz/conf/<i>CTID</i>.conf <br>/etc/vz/conf/vps.{premount,mount,umount,postumount} <br> 

<br>/proc/vz/veinfo <br>/proc/vz/vzquota <br>/proc/user_beancounters <br>/proc/bc/* <br>/proc/fairsched</ppre>

[[Man/vzquota.8|<b>vzquota</b>(8)]], [[Man/vzsplit.8|<b>vzsplit</b>(8)]], [[Man/vzubc.8|<b>vzubc</b>(8)]],

2000-20112013, Parallels, Inc. Licensed under GNU GPL.</p>