Difference between revisions of "Man/vzctl.8"

From OpenVZ Virtuozzo Containers Wiki
< Man
Jump to: navigation, search
(Automated import of articles *** existing text overwritten ***)
(Automated import of articles *** existing text overwritten ***)
 
(16 intermediate revisions by 3 users not shown)
Line 17: Line 17:
  
 
<p style="margin-top: 1em">[<i>flags</i>] <b>create</b>
 
<p style="margin-top: 1em">[<i>flags</i>] <b>create</b>
<i>CTID --parameter value [...]</i></p></td></tr>
+
<i>CTID --parameter value</i> [...]</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
Line 27: Line 27:
  
 
<p>[<i>flags</i>] <b>start</b> <i>CTID</i> [<b>--wait</b>]
 
<p>[<i>flags</i>] <b>start</b> <i>CTID</i> [<b>--wait</b>]
[<b>--force</b>]</p> </td></tr>
+
[<b>--force</b>] [<b>--skip-fsck</b>]
 +
[<b>--skip-remount</b>]</p> </td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
Line 36: Line 37:
 
<td width="80%">
 
<td width="80%">
  
<p>[<i>flags</i>] <b>stop</b> <i>CTID</i>
+
<p>[<i>flags</i>] <b>stop</b> <i>CTID</i> [<b>--fast</b>]
[<b>--fast</b>]</p> </td></tr>
+
[<b>--skip-umount</b>]</p> </td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
Line 47: Line 48:
  
 
<p>[<i>flags</i>] <b>restart</b> <i>CTID</i>
 
<p>[<i>flags</i>] <b>restart</b> <i>CTID</i>
[<b>--wait</b>] [<b>--force</b>] [<b>--fast</b>]</p></td></tr>
+
[<b>--wait</b>] [<b>--force</b>] [<b>--fast</b>]
 +
[<b>--skip-fsck</b>] [<b>--skip-remount</b>]</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
Line 56: Line 58:
 
<td width="80%">
 
<td width="80%">
  
<p>[<i>flags</i>] <b>chkpnt</b> | <b>restore</b>
+
<p>[<i>flags</i>] <b>suspend</b> | <b>resume</b>
[<b>--dumpfile&nbsp;</b><i>name</i>]</p> </td></tr>
+
<i>CTID</i> [<b>--dumpfile&nbsp;</b><i>name</i>]</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
Line 66: Line 68:
 
<td width="80%">
 
<td width="80%">
  
<p>[<i>flags</i>] <b>snapshot</b>
+
<p>[<i>flags</i>] <b>snapshot</b> <i>CTID</i>
 
[<b>--id&nbsp;</b><i>uuid</i>]
 
[<b>--id&nbsp;</b><i>uuid</i>]
 
[<b>--name&nbsp;</b><i>name</i>]
 
[<b>--name&nbsp;</b><i>name</i>]
[<b>--description&nbsp;</b><i>desc</i>]</p> </td></tr>
+
[<b>--description&nbsp;</b><i>desc</i>]
 +
[<b>--skip-suspend</b>] [<b>--skip-config</b>]</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
Line 78: Line 81:
 
<td width="80%">
 
<td width="80%">
  
<p>[<i>flags</i>] <b>snapshot-switch</b> |
+
<p>[<i>flags</i>] <b>snapshot-switch</b> <i>CTID</i>
<b>snapshot-delete --id</b> <i>uuid</i></p></td></tr>
+
[<b>--skip-resume</b> | <b>--must-resume</b>]
 +
[<b>--skip-config</b>] <b>--id</b> <i>uuid</i></p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
Line 88: Line 92:
 
<td width="80%">
 
<td width="80%">
  
<p>[<i>flags</i>] <b>snapshot-list</b></p></td></tr>
+
<p>[<i>flags</i>] <b>snapshot-delete</b> <i>CTID</i>
 +
<b>--id</b> <i>uuid</i></p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
Line 97: Line 102:
 
<td width="80%">
 
<td width="80%">
  
<p>[<i>flags</i>] <b>set</b> <i>CTID --parameter value
+
<p>[<i>flags</i>] <b>snapshot-mount</b> <i>CTID</i>
[...]</i> [<b>--save</b>] [<b>--force</b>]
+
<b>--id</b> <i>uuid</i> <b>--target</b> <i>dir</i></p></td></tr>
[<b>--setmode&nbsp;restart</b>|<b>ignore</b>]</p> </td></tr>
 
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
Line 108: Line 112:
 
<td width="80%">
 
<td width="80%">
  
<p>[<i>flags</i>] <b>destroy</b> | <b>delete</b> |
+
<p>[<i>flags</i>] <b>snapshot-umount</b> <i>CTID</i>
<b>mount</b> | <b>umount</b> | <b>status</b> |
+
<b>--id</b> <i>uuid</i></p></td></tr>
<b>quotaon</b> | <b>quotaoff</b> | <b>quotainit</b> |
 
<b>console</b> <i>CTID</i></p></td></tr>
 
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
Line 120: Line 122:
 
<td width="80%">
 
<td width="80%">
  
<p>[<i>flags</i>] <b>convert</b> <i>CTID</i>
+
<p>[<i>flags</i>] <b>snapshot-list</b> <i>CTID</i>
[<b>--layout&nbsp;ploop</b>[<b>:</b>{<b>expanded</b>|<b>plain</b>|<b>raw</b>}]]</p> </td></tr>
+
[<b>-H</b>] [<b>-o</b> <i>field</i>[,<i>field</i>...]
 +
[<b>--id</b> <i>uuid</i>]</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
Line 130: Line 133:
 
<td width="80%">
 
<td width="80%">
  
<p>[<i>flags</i>] <b>exec</b> | <b>exec2</b> <i>CTID
+
<p>[<i>flags</i>] <b>set</b> <i>CTID --parameter value</i>
command</i> [<i>arg</i> ...]</p></td></tr>
+
[...] [<b>--save</b>] [<b>--force</b>]
 +
[<b>--setmode&nbsp;restart</b>|<b>ignore</b>]</p> </td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
Line 140: Line 144:
 
<td width="80%">
 
<td width="80%">
  
<p>[<i>flags</i>] <b>enter</b> <i>CTID</i>
+
<p>[<i>flags</i>] <b>set</b> <i>CTID</i>
[<b>--exec&nbsp;</b><i>command&nbsp;</i>[<i>arg&nbsp;</i>...]]</p> </td></tr>
+
<b>--reset_ub</b></p> </td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
Line 150: Line 154:
 
<td width="80%">
 
<td width="80%">
  
<p>[<i>flags</i>] <b>runscript</b> <i>CTID script</i></p></td></tr>
+
<p>[<i>flags</i>] <b>destroy</b> | <b>delete</b> |
 +
<b>mount</b> | <b>umount</b> | <b>status</b> |
 +
<b>quotaon</b> | <b>quotaoff</b> | <b>quotainit</b>
 +
<i>CTID</i></p> </td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
Line 159: Line 166:
 
<td width="80%">
 
<td width="80%">
  
<p><b>--help</b> | <b>--version</b></p></td></tr>
+
<p>[<i>flags</i>] <b>console</b> <i>CTID</i>
</table>
+
[<i>ttynum</i>]</p> </td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="7%">
  
== DESCRIPTION ==
+
<p><b>vzctl</b></p></td>
 +
<td width="2%"></td>
 +
<td width="80%">
  
<p style="margin-left:11%; margin-top: 1em">Utility
+
<p>[<i>flags</i>] <b>convert</b> <i>CTID</i>
<b>vzctl</b> runs on the host system (otherwise known as
+
[<b>--layout&nbsp;ploop</b>[<b>:</b>{<b>expanded</b>|<b>plain</b>|<b>raw</b>}]]</p> </td></tr>
Hardware Node, or HN) and performs direct manipulations with
+
<tr valign="top" align="left">
containers (CTs).</p>
+
<td width="11%"></td>
 +
<td width="7%">
  
<p style="margin-left:11%; margin-top: 1em">Containers can
+
<p><b>vzctl</b></p></td>
be referred to by either numeric <i>CTID</i> or by name (see
+
<td width="2%"></td>
<b>--name</b> option). Note that CT ID &lt;= 100 are
+
<td width="80%">
reserved for OpenVZ internal purposes.</p>
 
  
== OPTIONS ==
+
<p>[<i>flags</i>] <b>compact</b> <i>CTID</i></p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="7%">
  
=== Flags ===
+
<p><b>vzctl</b></p></td>
 +
<td width="2%"></td>
 +
<td width="80%">
  
<p style="margin-top: 1em">These flags come before a
+
<p>[<i>flags</i>] <b>exec</b> | <b>exec2</b> <i>CTID
command, and can be used with any command. They affect
+
command</i> [<i>arg</i> ...]</p></td></tr>
logging to console (terminal) only, and do not affect
+
<tr valign="top" align="left">
logging to a log file.</p>
+
<td width="11%"></td>
 +
<td width="7%">
  
<p style="margin-left:11%;"><b>--quiet</b></p>
+
<p><b>vzctl</b></p></td>
 +
<td width="2%"></td>
 +
<td width="80%">
  
<p style="margin-left:17%;">Disables output. Note that
+
<p>[<i>flags</i>] <b>enter</b> <i>CTID</i>
scripts run by vzctl are still able to produce some
+
[<b>--exec&nbsp;</b><i>command&nbsp;</i>[<i>arg&nbsp;</i>...]]</p> </td></tr>
output.</p>
+
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="7%">
  
<p style="margin-left:11%;"><b>--verbose</b></p>
+
<p><b>vzctl</b></p></td>
 +
<td width="2%"></td>
 +
<td width="80%">
  
<p style="margin-left:17%;">Increments logging level up
+
<p>[<i>flags</i>] <b>runscript</b> <i>CTID script</i></p></td></tr>
from the default. Can be used multiple times. Default value
 
is set to the value of <b>VERBOSE</b> parameter in the
 
global configuration file [[Man/vz.conf.5|<b>vz.conf</b>(5)]], or to <b>0</b>
 
if not set by <b>VERBOSE</b> parameter.</p>
 
 
 
=== Setting container parameters ===
 
 
 
<table width="100%" border="0" rules="none" frame="void"
 
      cellspacing="0" cellpadding="0">
 
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
<td width="4%">
+
<td width="7%">
  
<p style="margin-top: 1em"><b>set</b></p></td>
+
<p><b>vzctl</b></p></td>
 
<td width="2%"></td>
 
<td width="2%"></td>
<td width="83%">
+
<td width="80%">
 +
 
 +
<p><b>--help</b> | <b>--version</b></p></td></tr>
 +
</table>
 +
 
 +
== DESCRIPTION ==
  
<p style="margin-top: 1em"><i>CTID</i>
+
<p style="margin-left:11%; margin-top: 1em">Utility
[<b>--onboot&nbsp;yes</b>|<b>no</b>]
+
<b>vzctl</b> runs on the host system (otherwise known as
[<b>--bootorder&nbsp;</b><i>number</i>]
+
Hardware Node, or HN) and performs direct manipulations with
[<b>--root&nbsp;</b><i>path</i>]
+
containers (CTs).</p>
[<b>--private&nbsp;</b><i>path</i>]
+
 
[<b>--userpasswd&nbsp;</b><i>user</i>:<i>pass</i>]
+
<p style="margin-left:11%; margin-top: 1em">Containers can
[<b>--disabled&nbsp;yes</b>|<b>no</b>]
+
be referred to by either numeric <i>CTID</i> or by name (see
[<b>--name&nbsp;</b><i>name</i>]
+
<b>--name</b> option). Note that CT ID &lt;= 100 are
[<b>--description&nbsp;</b><i>string</i>]
+
reserved for OpenVZ internal purposes. A numeric ID should
[<b>--ipadd&nbsp;</b><i>addr</i>]
+
not be more than <b>2147483644</b>.</p>
[<b>--ipdel&nbsp;</b><i>addr</i>|<b>all</b>]
+
 
[<b>--hostname&nbsp;</b><i>name</i>]
+
== OPTIONS ==
[<b>--nameserver&nbsp;</b><i>addr</i>]
+
 
[<b>--searchdomain&nbsp;</b><i>name</i>]
+
=== Flags ===
[<b>--netif_add&nbsp;</b><i>dev</i>[,<i>params</i>...]]
+
 
[<b>--netif_del&nbsp;</b><i>dev</i>|<b>all</b>]
+
<p style="margin-top: 1em">These flags come before a
[<b>--ifname</b> <i>dev</i>
+
command, and can be used with any command. They affect
[<b>--mac&nbsp;</b><i>hwaddr</i>]
+
logging to console (terminal) only, and do not affect
[<b>--host_ifname&nbsp;</b><i>dev</i>]
+
logging to a log file.</p>
[<b>--host_mac&nbsp;</b><i>hwaddr</i>]
+
 
[<b>--bridge&nbsp;</b><i>name</i>]
+
<p style="margin-left:11%;"><b>--quiet</b></p>
[<b>--mac_filter&nbsp;on</b>|<b>off</b>]]
+
 
[<b>--numproc&nbsp;</b><i>items</i>]
+
<p style="margin-left:17%;">Disables output. Note that
[<b>--numtcpsock&nbsp;</b><i>items</i>]
+
scripts run by vzctl are still able to produce some
[<b>--numothersock&nbsp;</b><i>items</i>]
+
output.</p>
[<b>--vmguarpages&nbsp;</b><i>pages</i>]
+
 
[<b>--kmemsize&nbsp;</b><i>bytes</i>]
+
<p style="margin-left:11%;"><b>--verbose</b></p>
[<b>--tcpsndbuf&nbsp;</b><i>bytes</i>]
+
 
[<b>--tcprcvbuf&nbsp;</b><i>bytes</i>]
+
<p style="margin-left:17%;">Increments logging level up
[<b>--othersockbuf&nbsp;</b><i>bytes</i>]
+
from the default. Can be used multiple times. Default value
[<b>--dgramrcvbuf&nbsp;</b><i>bytes</i>]
+
is set to the value of <b>VERBOSE</b> parameter in the
[<b>--oomguarpages&nbsp;</b><i>pages</i>]
+
global configuration file [[Man/vz.conf.5|<b>vz.conf</b>(5)]], or to <b>0</b>
[<b>--lockedpages&nbsp;</b><i>pages</i>]
+
if not set by <b>VERBOSE</b> parameter.</p>
[<b>--privvmpages&nbsp;</b><i>pages</i>]
+
 
[<b>--shmpages&nbsp;</b><i>pages</i>]
+
=== Setting container parameters ===
[<b>--numfile&nbsp;</b><i>items</i>]
+
 
[<b>--numflock&nbsp;</b><i>items</i>]
+
<table width="100%" border="0" rules="none" frame="void"
[<b>--numpty&nbsp;</b><i>items</i>]
+
      cellspacing="0" cellpadding="0">
[<b>--numsiginfo&nbsp;</b><i>items</i>]
 
[<b>--dcachesize&nbsp;</b><i>bytes</i>]
 
[<b>--numiptent&nbsp;</b><i>num</i>]
 
[<b>--physpages&nbsp;</b><i>pages</i>]
 
[<b>--swappages&nbsp;</b><i>pages</i>]
 
[<b>--ram&nbsp;</b><i>bytes</i>]
 
[<b>--swap&nbsp;</b><i>bytes</i>]
 
[<b>--cpuunits&nbsp;</b><i>num</i>]
 
[<b>--cpulimit&nbsp;</b><i>num</i>]
 
[<b>--cpus&nbsp;</b><i>num</i>]
 
[<b>--cpumask&nbsp;</b><i>cpus</i>|<b>all</b>]
 
[<b>--meminfo&nbsp;none</b>|<i>mode</i>:<i>value</i>]
 
[<b>--iptables&nbsp;</b><i>name</i>]
 
[<b>--netdev_add&nbsp;</b><i>ifname</i>]
 
[<b>--netdev_del&nbsp;</b><i>ifname</i>]
 
[<b>--diskquota&nbsp;yes</b>|<b>no</b>]
 
[<b>--diskspace&nbsp;</b><i>num</i>]
 
[<b>--diskinodes&nbsp;</b><i>num</i>]
 
[<b>--quotatime&nbsp;</b><i>seconds</i>]
 
[<b>--quotaugidlimit&nbsp;</b><i>num</i>]
 
[<b>--noatime&nbsp;yes</b>|<b>no</b>]
 
[<b>--capability&nbsp;</b><i>capname</i>:<b>on</b>|<b>off</b>]
 
[<b>--devnodes&nbsp;</b><i>param</i>]
 
[<b>--devices&nbsp;</b><i>param</i>]
 
[<b>--pci_add&nbsp;</b><i>dev</i>]
 
[<b>--pci_del&nbsp;</b><i>dev</i>]
 
[<b>--features&nbsp;</b><i>param</i>:<b>on</b>|<b>off</b>]
 
[<b>--applyconfig&nbsp;</b><i>name</i>]
 
[<b>--applyconfig_map&nbsp;</b><i>group</i>]
 
[<b>--ioprio&nbsp;</b><i>num</i>] [<b>--save</b>]
 
[<b>--force</b>]
 
[<b>--setmode&nbsp;restart</b>|<b>ignore</b>]</p> </td></tr>
 
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
</td>
+
 
 +
<p style="margin-top: 1em"><b>set</b></p></td>
 
<td width="2%"></td>
 
<td width="2%"></td>
 
<td width="83%">
 
<td width="83%">
  
<p>This command sets various container parameters.</p></td></tr>
+
<p style="margin-top: 1em"><i>CTID</i>
</table>
+
[<b>--onboot&nbsp;yes</b>|<b>no</b>]
 
+
[<b>--bootorder&nbsp;</b><i>number</i>]
<p style="margin-left:17%; margin-top: 1em">If a
+
[<b>--root&nbsp;</b><i>path</i>]
<b>--save</b> flag is given, parameters are saved in
+
[<b>--private&nbsp;</b><i>path</i>]
container configuration file [[Man/ctid.conf.5|<b>ctid.conf</b>(5)]]. Use
+
[<b>--mount_opts&nbsp;</b><i>options</i>]
<b>--force</b> to save the parameters even if the current
+
[<b>--userpasswd&nbsp;</b><i>user</i>:<i>pass</i>]
kernel doesn&rsquo;t support OpenVZ.</p>
+
[<b>--disabled&nbsp;yes</b>|<b>no</b>]
 
+
[<b>--name&nbsp;</b><i>name</i>]
<p style="margin-left:17%; margin-top: 1em">If the
+
[<b>--description&nbsp;</b><i>string</i>]
container is currently running, <b>vzctl</b> applies these
+
[<b>--ostemplate&nbsp;</b><i>string</i>]
parameters to the container.</p>
+
[<b>--stop-timeout&nbsp;</b><i>seconds</i>]
 
+
[<b>--ipadd&nbsp;</b><i>addr</i>]
<p style="margin-left:17%; margin-top: 1em">Note that a few
+
[<b>--ipdel&nbsp;</b><i>addr</i>|<b>all</b>]
parameters can only be applied by restarting the container.
+
[<b>--hostname&nbsp;</b><i>name</i>]
By default, <b>vzctl</b> warns if such parameters are
+
[<b>--nameserver&nbsp;</b><i>addr</i>]
present and a container is running. Use <b>--setmode
+
[<b>--searchdomain&nbsp;</b><i>name</i>]
restart</b> to restart a container in such a case, or
+
[<b>--netif_add&nbsp;</b><i>dev</i>[,<i>params</i>...]]
<b>--setmode ignore</b> to suppress the above mentioned
+
[<b>--netif_del&nbsp;</b><i>dev</i>|<b>all</b>]
warning.</p>
+
[<b>--ifname</b> <i>dev</i>
 
+
[<b>--mac&nbsp;</b><i>hwaddr</i>]
<p style="margin-left:17%; margin-top: 1em">The following
+
[<b>--host_ifname&nbsp;</b><i>dev</i>]
parameters can be used with <b>set</b> command.</p>
+
[<b>--host_mac&nbsp;</b><i>hwaddr</i>]
 
+
[<b>--bridge&nbsp;</b><i>name</i>]
==== Miscellaneous ====
+
[<b>--mac_filter&nbsp;on</b>|<b>off</b>]]
 
+
[<b>--numproc&nbsp;</b><i>items</i>]
<p style="margin-left:11%;"><b>--onboot yes</b> |
+
[<b>--numtcpsock&nbsp;</b><i>items</i>]
<b>no</b></p>
+
[<b>--numothersock&nbsp;</b><i>items</i>]
 
+
[<b>--vmguarpages&nbsp;</b><i>pages</i>]
<p style="margin-left:17%;">Sets whether the container will
+
[<b>--kmemsize&nbsp;</b><i>bytes</i>]
be started during system boot. The container will not be
+
[<b>--tcpsndbuf&nbsp;</b><i>bytes</i>]
auto-started unless this parameter is set to <b>yes</b>.</p>
+
[<b>--tcprcvbuf&nbsp;</b><i>bytes</i>]
 
+
[<b>--othersockbuf&nbsp;</b><i>bytes</i>]
<p style="margin-left:11%;"><b>--bootorder</b>
+
[<b>--dgramrcvbuf&nbsp;</b><i>bytes</i>]
<i>number</i></p>
+
[<b>--oomguarpages&nbsp;</b><i>pages</i>]
 
+
[<b>--lockedpages&nbsp;</b><i>pages</i>]
<p style="margin-left:17%;">Sets the boot order priority
+
[<b>--privvmpages&nbsp;</b><i>pages</i>]
for this CT. The higher the <i>number</i> is, the earlier in
+
[<b>--shmpages&nbsp;</b><i>pages</i>]
the boot process this container starts. By default this
+
[<b>--numfile&nbsp;</b><i>items</i>]
parameter is unset, which is considered to be the lowest
+
[<b>--numflock&nbsp;</b><i>items</i>]
priority, so containers with unset <b>bootorder</b> will
+
[<b>--numpty&nbsp;</b><i>items</i>]
start last.</p>
+
[<b>--numsiginfo&nbsp;</b><i>items</i>]
 
+
[<b>--dcachesize&nbsp;</b><i>bytes</i>]
<p style="margin-left:11%;"><b>--root</b> <i>path</i></p>
+
[<b>--numiptent&nbsp;</b><i>num</i>]
 
+
[<b>--physpages&nbsp;</b><i>pages</i>]
<p style="margin-left:17%;">Sets the path to root directory
+
[<b>--swappages&nbsp;</b><i>pages</i>]
(<b>VE_ROOT</b>) for this container. This is essentially a
+
[<b>--ram&nbsp;</b><i>bytes</i>]
mount point for container&rsquo;s root directory. Argument
+
[<b>--swap&nbsp;</b><i>bytes</i>]
can contain literal string <b>$VEID</b>, which will be
+
[<b>--vm_overcommit&nbsp;</b><i>float</i>]
substituted with the numeric CT ID.</p>
+
[<b>--cpuunits&nbsp;</b><i>num</i>]
 
+
[<b>--cpulimit&nbsp;</b><i>num</i>]
<p style="margin-left:11%;"><b>--private</b>
+
[<b>--cpus&nbsp;</b><i>num</i>]
<i>path</i></p>
+
[<b>--cpumask&nbsp;</b><i>cpus</i>|<b>auto</b>|<b>all</b>]
 
+
[<b>--nodemask&nbsp;</b><i>nodes</i>|<b>all</b>]
<p style="margin-left:17%;">Sets the path to private
+
[<b>--meminfo&nbsp;none</b>|<i>mode</i>:<i>value</i>]
directory (<b>VE_PRIVATE</b>) for this container. This is a
+
[<b>--iptables&nbsp;</b><i>name</i>[<b>,</b>...]]
directory in which all the container&rsquo;s files are
+
[<b>--netfilter&nbsp;disabled</b>|<b>stateless</b>|<b>stateful</b>|<b>full</b>]
stored. Argument can contain literal string <b>$VEID</b>,
+
[<b>--netdev_add&nbsp;</b><i>ifname</i>]
which will be substituted with the numeric CT ID.</p>
+
[<b>--netdev_del&nbsp;</b><i>ifname</i>]
 
+
[<b>--diskquota&nbsp;yes</b>|<b>no</b>]
<p style="margin-left:11%;"><b>--userpasswd</b>
+
[<b>--diskspace&nbsp;</b><i>num</i>]
<i>user</i>:<i>password</i></p>
+
[<b>--diskinodes&nbsp;</b><i>num</i>]
 
+
[<b>--quotatime&nbsp;</b><i>seconds</i>]
<p style="margin-left:17%;">Sets password for the given
+
[<b>--quotaugidlimit&nbsp;</b><i>num</i>]
user in a container, creating the user if it does not
+
[<b>--capability&nbsp;</b><i>capname</i>:<b>on</b>|<b>off</b>[<b>,</b>...]]
exists. Note that this option is not saved in configuration
+
[<b>--devnodes&nbsp;</b><i>param</i>]
file at all (so <b>--save</b> flag is useless), it is
+
[<b>--devices&nbsp;</b><i>param</i>]
applied to the container (by modifying its /etc/passwd and
+
[<b>--pci_add&nbsp;</b><i>dev</i>]
/etc/shadow files).</p>
+
[<b>--pci_del&nbsp;</b><i>dev</i>]
 +
[<b>--features&nbsp;</b><i>name</i>:<b>on</b>|<b>off</b>[<b>,</b>...]]
 +
[<b>--applyconfig&nbsp;</b><i>name</i>]
 +
[<b>--applyconfig_map&nbsp;</b><i>group</i>]
 +
[<b>--ioprio&nbsp;</b><i>num</i>]
 +
[<b>--iolimit&nbsp;</b><i>mbps</i>]
 +
[<b>--iopslimit&nbsp;</b><i>iops</i>] [<b>--save</b>]
 +
[<b>--force</b>] [<b>--reset_ub</b>]
 +
[<b>--setmode&nbsp;restart</b>|<b>ignore</b>]</p> </td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
</td>
 +
<td width="2%"></td>
 +
<td width="83%">
 +
 
 +
<p>This command sets various container parameters. If the
 +
container is currently running, <b>vzctl</b> applies these
 +
parameters to the container. The following options can be
 +
used with <b>set</b> command.</p></td></tr>
 +
</table>
  
<p style="margin-left:17%; margin-top: 1em">In case
+
==== Flags ====
container root filesystem is not mounted, it is
 
automatically mounted, then all the appropriate file changes
 
are applied, then it is unmounted.</p>
 
  
<p style="margin-left:17%; margin-top: 1em">Note that
+
<p style="margin-left:11%;"><b>--save</b></p>
container should be created before using this option.</p>
 
  
<p style="margin-left:11%;"><b>--disabled yes</b> |
+
<p style="margin-left:17%;">If this flag is given,
<b>no</b></p>
+
parameters are saved in container configuration file
 +
[[Man/ctid.conf.5|<b>ctid.conf</b>(5)]].</p>
  
<p style="margin-left:17%;">Disable container start. To
+
<p style="margin-left:11%;"><b>--force</b></p>
force the start of a disabled container, use <b>vzctl start
 
--force</b>.</p>
 
  
<p style="margin-left:11%;"><b>--name</b> <i>name</i></p>
+
<p style="margin-left:17%;">If this flag is given together
 +
with <b>--save</b>, parameters are saved even if the current
 +
kernel doesn&rsquo;t support OpenVZ. Note this flag does not
 +
make sense without <b>--save</b>, so <b>--save</b> is
 +
required.</p>
  
<p style="margin-left:17%;">Add a name for a container. The
+
<p style="margin-left:11%;"><b>--reset_ub</b></p>
<i>name</i> can later be used in subsequent calls to
 
<b>vzctl</b> in place of <i>CTID</i>.</p>
 
  
<p style="margin-left:11%;"><b>--description</b>
+
<p style="margin-left:17%;">If this flag is given,
<i>string</i></p>
+
<b>vzctl</b> applies all User Beancounter parameters from
 +
the configuration file to a running container. This is
 +
helpful in case configuration file is modified manually.
 +
Please note this flag is exclusive, i.e. it can not be
 +
combined with any other options or flags.</p>
  
<p style="margin-left:17%;">Add a textual description for a
+
<p style="margin-left:11%;"><b>--setmode restart</b> |
container.</p>
+
<b>ignore</b></p>
  
==== Networking ====
+
<p style="margin-left:17%;">A few parameters can only be
 +
applied by restarting the container. By default,
 +
<b>vzctl</b> prints a warning if such parameters are
 +
supplied and a container is running. Use <b>--setmode
 +
restart</b> together with <b>--save</b> flag to restart a
 +
container in such a case, or <b>--setmode ignore</b> to
 +
suppress the warning.</p>
  
<p style="margin-left:11%;"><b>--ipadd</b> <i>addr</i></p>
+
==== Miscellaneous ====
  
<p style="margin-left:17%;">Adds an IP address <i>addr</i>
+
<p style="margin-left:11%;"><b>--onboot yes</b> |
to a given container. Address can optionally have a netmask
+
<b>no</b></p>
specified in the CIDR notation (e.g. <b>10.1.2.3/25</b>).
 
Note that this option is incremental, so <i>addr</i> are
 
added to already existing ones.</p>
 
  
<p style="margin-left:11%;"><b>--ipdel</b> <i>addr</i> |
+
<p style="margin-left:17%;">Sets whether the container will
<b>all</b></p>
+
be started during system boot. The container will be started
 +
on boot by <b>vz</b> initscript if either this parameter is
 +
set to <b>yes</b>, or the container was running just before
 +
last reboot, and this parameter is not set to <b>no</b>.
 +
Default value is unset, meaning the container will be
 +
started if it was running before the last reboot.</p>
  
<p style="margin-left:17%;">Removes IP address <i>addr</i>
+
<p style="margin-left:11%;"><b>--bootorder</b>
from a container. If you want to remove all the addresses,
+
<i>number</i></p>
use <b>--ipdel all</b>.</p>
 
  
<p style="margin-left:11%;"><b>--hostname</b>
+
<p style="margin-left:17%;">Sets the boot order priority
<i>name</i></p>
+
for this CT. The higher the <i>number</i> is, the earlier in
 +
the boot process this container starts. By default this
 +
parameter is unset, which is considered to be the lowest
 +
priority, so containers with unset <b>bootorder</b> will
 +
start last.</p>
 +
 
 +
<p style="margin-left:11%;"><b>--root</b> <i>path</i></p>
  
<p style="margin-left:17%;">Sets container hostname.
+
<p style="margin-left:17%;">Sets the path to root directory
<b>vzctl</b> writes it to the appropriate file inside a
+
(<b>VE_ROOT</b>) for this container. This is essentially a
container (distribution-dependent).</p>
+
mount point for container&rsquo;s root directory. Argument
 +
can contain literal string <b>$VEID</b>, which will be
 +
substituted with the numeric CT ID.</p>
  
<p style="margin-left:11%;"><b>--nameserver</b>
+
<p style="margin-left:11%;"><b>--private</b>
<i>addr</i></p>
+
<i>path</i></p>
  
<p style="margin-left:17%;">Sets DNS server IP address for
+
<p style="margin-left:17%;">Sets the path to private
a container. If you want to set several nameservers, you
+
directory (<b>VE_PRIVATE</b>) for this container. This is a
should do it at once, so use <b>--nameserver</b> option
+
directory in which all the container&rsquo;s files are
multiple times in one call to <b>vzctl</b>, as all the name
+
stored. Argument can contain literal string <b>$VEID</b>,
server values set in previous calls to <b>vzctl</b> are
+
which will be substituted with the numeric CT ID.</p>
overwritten.</p>
 
  
<p style="margin-left:11%;"><b>--searchdomain</b>
+
<p style="margin-left:11%;"><b>--mount_opts</b>
<i>name</i></p>
+
<i>option</i>[<b>,</b><i>option</i>...]</p>
  
<p style="margin-left:17%;">Sets DNS search domains for a
+
<p style="margin-left:17%;">Sets additional mount options
container. If you want to set several search domains, you
+
for container file system. Only applicable for <b>ploop</b>
should do it at once, so use <b>--searchdomain</b> option
+
layout, ignored otherwise.</p>
multiple times in one call to <b>vzctl</b>, as all the
 
search domain values set in previous calls to <b>vzctl</b>
 
are overwritten.</p>
 
  
<p style="margin-left:11%;"><b>--netif_add</b>
+
<p style="margin-left:11%;"><b>--userpasswd</b>
<i>ifname[</i>,<i>mac</i>,<i>host_ifname</i>,<i>host_mac</i>,<i>bridge]</i></p>
+
<i>user</i>:<i>password</i></p>
  
<p style="margin-left:17%;">Adds a virtual Ethernet device
+
<p style="margin-left:17%;">Sets password for the given
(veth) to a given container. Here <i>ifname</i> is the
+
user in a container, creating the user if it does not
Ethernet device name in the container, <i>mac</i> is its MAC
+
exists. Note that this option is not saved in configuration
address, <i>host_ifname</i> is the Ethernet device name on
+
file at all (so <b>--save</b> flag is useless), it is
the host, and <i>host_mac</i> is its MAC address. MAC
+
applied directly to the container, by running
addresses should be in the format like XX:XX:XX:XX:XX:XX.
+
distribution-specific programs inside the container. It is
<i>bridge</i> is an optional parameter which can be used in
+
not recommended to combine this option with any other
custom network start scripts to automatically add the
+
options.</p>
interface to a bridge. All parameters except <i>ifname</i>
 
are optional and are automatically generated if not
 
specified.</p>
 
  
<p style="margin-left:11%;"><b>--netif_del</b>
+
<p style="margin-left:17%; margin-top: 1em">In case
<i>dev_name</i> | <b>all</b></p>
+
container was not running, it is automatically started then
 +
all the appropriate changes are applied, then it is
 +
stopped.</p>
  
<p style="margin-left:17%;">Removes virtual Ethernet device
+
<p style="margin-left:17%; margin-top: 1em">Note that
from a container. If you want to remove all devices, use
+
container should be created before using this option.</p>
<b>all</b>.</p>
 
  
==== veth interface configuration ====
+
<p style="margin-left:11%;"><b>--disabled yes</b> |
 +
<b>no</b></p>
  
<p style="margin-left:11%; margin-top: 1em">The following
+
<p style="margin-left:17%;">Disable container start. To
options can be used to reconfigure the already-created
+
force the start of a disabled container, use <b>vzctl start
virtual Ethernet interface. To select the interface to
+
--force</b>.</p>
configure, use <b>--ifname</b> <i>name</i> option. <b><br>
 
--mac</b> <i>XX:XX:XX:XX:XX:XX</i></p>
 
  
<p style="margin-left:22%;">MAC address of interface inside
+
<p style="margin-left:11%;"><b>--name</b> <i>name</i></p>
a container.</p>
 
  
<p style="margin-left:11%;"><b>--host_ifname</b>
+
<p style="margin-left:17%;">Add a name for a container. The
<i>name</i></p>
+
<i>name</i> can later be used in subsequent calls to
 +
<b>vzctl</b> in place of <i>CTID</i>. Note this option can
 +
not be used without <b>--save</b>.</p>
  
<p style="margin-left:22%;">interface name for virtual
+
<p style="margin-left:11%;"><b>--description</b>
interface in the host system.</p>
+
<i>string</i></p>
  
<p style="margin-left:11%;"><b>--host_mac</b>
+
<p style="margin-left:17%;">Add a textual description for a
<i>XX:XX:XX:XX:XX:XX</i></p>
+
container.</p>
  
<p style="margin-left:22%;">MAC address of interface in the
+
<p style="margin-left:11%;"><b>--ostemplate</b>
host system.</p>
+
<i>string</i></p>
  
<p style="margin-left:11%;"><b>--bridge</b> <i>name</i></p>
+
<p style="margin-left:17%;">Sets a new value of
 +
<b>OSTEMPLATE</b> parameter in container configuration file
 +
[[Man/ctid.conf.5|<b>ctid.conf</b>(5)]]. Requires <b>--save</b> flag. Useful
 +
after a change/upgrade of a distribution running inside
 +
container, as vzctl uses the value of OSTEMPLATE to run
 +
distribution-specific scripts.</p>
  
<p style="margin-left:22%;">Bridge name. Custom network
+
<p style="margin-left:11%;"><b>--stop-timeout</b>
start scripts can use this value to automatically add the
+
<i>seconds</i></p>
interface to a bridge.</p>
 
  
<p style="margin-left:11%;"><b>--mac_filter on</b> |
+
<p style="margin-left:17%;">Sets a time to wait for
<b>off</b></p>
+
container to stop on <b>vzctl stop</b> before forcibly
 +
killing it, in seconds. Note this option can not be used
 +
without <b>--save</b> flag.</p>
  
<p style="margin-left:22%;">Enables/disables MAC address
+
<p style="margin-left:17%; margin-top: 1em">Special value
filtering for the Container veth device and the possibility
+
of <b>0</b> means to use compiled-in default.</p>
of configuring the MAC address of this device from inside
 
the Container. If the filtering is turned on: <br>
 
&bull; the veth device accepts only those packets that have
 
a MAC address in their headers corresponding to that of this
 
device (excluding all broadcast and multicast packets); <br>
 
&bull; it is impossible to modify the veth MAC address from
 
inside the Container.</p>
 
  
<p style="margin-left:22%; margin-top: 1em">By default,
+
==== Networking ====
this functionality is enabled for all veth devices existing
 
inside the Container.</p>
 
  
==== VSwap limits ====
+
<p style="margin-left:11%;"><b>--ipadd</b> <i>addr</i></p>
  
<p style="margin-left:11%; margin-top: 1em">The following
+
<p style="margin-left:17%;">Adds an IP address <i>addr</i>
options sets memory and swap limits for VSwap-enabled
+
to a given container. Address can optionally have a netmask
kernels (kernel version 042stab042 or greater).</p>
+
specified in the CIDR notation (e.g. <b>10.1.2.3/25</b>).
 +
Note that this option is incremental, so <i>addr</i> are
 +
added to already existing ones.</p>
  
<p style="margin-left:11%; margin-top: 1em">Argument is in
+
<p style="margin-left:11%;"><b>--ipdel</b> <i>addr</i> |
bytes, unless otherwise specified by an optional suffix.
+
<b>all</b></p>
Available suffixes are:</p>
 
  
<p style="margin-left:11%; margin-top: 1em">&bull;
+
<p style="margin-left:17%;">Removes IP address <i>addr</i>
<b>T</b>, <b>t</b> - terabytes; <br>
+
from a container. If you want to remove all the addresses,
&bull; <b>G</b>, <b>g</b> - gigabytes; <br>
+
use <b>--ipdel all</b>.</p>
&bull; <b>M</b>, <b>m</b> - megabytes; <br>
 
&bull; <b>K</b>, <b>k</b> - kilobytes; <br>
 
&bull; <b>P</b>, <b>p</b> - memory pages (arch-specific,
 
usually 4KB); <br>
 
&bull; <b>B</b>, <b>b</b> - bytes. <b><br>
 
--ram</b> <i>bytes</i></p>
 
  
<p style="margin-left:22%;">Sets physical memory (RAM)
+
<p style="margin-left:11%;"><b>--hostname</b>
available to a container. Actually, the option is a shortcut
+
<i>name</i></p>
for setting <b>--physpages</b> limit (the barrier is set to
 
0).</p>
 
  
<p style="margin-left:11%;"><b>--swap</b> <i>bytes</i></p>
+
<p style="margin-left:17%;">Sets container hostname.
 +
<b>vzctl</b> writes it to the appropriate file inside a
 +
container (distribution-dependent).</p>
  
<p style="margin-left:22%;">Set swap space available to a
+
<p style="margin-left:11%;"><b>--nameserver</b>
container. Actually, the option is a shortcut for setting
+
<i>addr</i></p>
<b>--swappages</b> limit (the barrier is set to 0).</p>
 
  
<p style="margin-left:11%; margin-top: 1em">Here is an
+
<p style="margin-left:17%;">Sets DNS server IP address for
example of setting container 777 to have 512 megabytes of
+
a container. If you want to set several nameservers, you
RAM and 1 gigabyte of swap:</p>
+
should do it at once, so use <b>--nameserver</b> option
 +
multiple times in one call to <b>vzctl</b>, as all the name
 +
server values set in previous calls to <b>vzctl</b> are
 +
overwritten.</p>
  
<pre style="margin-left:11%;">   vzctl set 777 --ram 512M --swap 1G --save</pre>
+
<p style="margin-left:17%; margin-top: 1em">A special value
 +
of <b>inherit</b> can be used to auto-propagate nameserver
 +
value(s) from the host system&rsquo;s
 +
<b>/etc/resolv.conf</b> file.</p>
  
==== User Beancounter limits ====
+
<p style="margin-left:11%;"><b>--searchdomain</b>
 +
<i>name</i></p>
  
<p style="margin-left:11%; margin-top: 1em">The following
+
<p style="margin-left:17%;">Sets DNS search domains for a
options sets barrier and limit for various user
+
container. If you want to set several search domains, you
beancounters.</p>
+
should do it at once, so use <b>--searchdomain</b> option
 +
multiple times in one call to <b>vzctl</b>, as all the
 +
search domain values set in previous calls to <b>vzctl</b>
 +
are overwritten.</p>
  
<p style="margin-left:11%; margin-top: 1em">Note that for
+
<p style="margin-left:17%; margin-top: 1em">A special value
VSwap-enabled kernels (version 042stab042 or greater) these
+
of <b>inherit</b> can be used to auto-propagate search
limits are optional, you must only set <b>--ram</b> and
+
domain value(s) from the host system&rsquo;s
<b>--swap</b> (see above). For older kernels, these limits
+
<b>/etc/resolv.conf</b> file.</p>
are obligatory.</p>
 
  
<p style="margin-left:11%; margin-top: 1em">Each option
+
<p style="margin-left:11%;"><b>--netif_add</b>
requires one or two arguments. In case of one argument,
+
<i>ifname[</i>,<i>mac</i>,<i>host_ifname</i>,<i>host_mac</i>,<i>bridge]</i></p>
<b>vzctl</b> sets barrier and limit to the same value. In
 
case of two colon-separated arguments, the first is a
 
barrier, and the second is a limit. Each argument is either
 
a number, a number with a suffix, or a special value
 
<b>unlimited</b>.</p>
 
  
<p style="margin-left:11%; margin-top: 1em">Arguments are
+
<p style="margin-left:17%;">Adds a virtual Ethernet device
in items, pages or bytes. Note that page size is
+
(veth) to a given container. Here <i>ifname</i> is the
architecture-specific, it is 4096 bytes on x86 and x86_64
+
Ethernet device name in the container, <i>mac</i> is its MAC
platforms.</p>
+
address, <i>host_ifname</i> is the Ethernet device name on
 +
the host, and <i>host_mac</i> is its MAC address. MAC
 +
addresses should be in the format like XX:XX:XX:XX:XX:XX.
 +
<i>bridge</i> is an optional parameter which can be used in
 +
custom network start scripts to automatically add the
 +
interface to a bridge. All parameters except <i>ifname</i>
 +
are optional and are automatically generated if not
 +
specified.</p>
 +
 
 +
<p style="margin-left:11%;"><b>--netif_del</b>
 +
<i>dev_name</i> | <b>all</b></p>
  
<p style="margin-left:11%; margin-top: 1em">You can also
+
<p style="margin-left:17%;">Removes virtual Ethernet device
specify different suffixes for User Beancounter parameters
+
from a container. If you want to remove all devices, use
(except for those which names start with <b>num</b>). For
+
<b>all</b>.</p>
example, <b>vzctl set</b> <i>CTID</i> <b>--privvmpages
 
5M:6M</b> should set <b>privvmpages</b>&rsquo; barrier to 5
 
megabytes and its limit to 6 megabytes.</p>
 
  
<p style="margin-left:11%; margin-top: 1em">Available
+
==== veth interface configuration ====
suffixes are:</p>
 
  
<p style="margin-left:11%; margin-top: 1em">&bull;
+
<p style="margin-left:11%; margin-top: 1em">The following
<b>T</b>, <b>t</b> - terabytes; <br>
+
options can be used to reconfigure the already-created
&bull; <b>G</b>, <b>g</b> - gigabytes; <br>
+
virtual Ethernet interface. To select the interface to
&bull; <b>M</b>, <b>m</b> - megabytes; <br>
+
configure, use <b>--ifname</b> <i>name</i> option. <b><br>
&bull; <b>K</b>, <b>k</b> - kilobytes; <br>
+
--mac</b> <i>XX:XX:XX:XX:XX:XX</i></p>
&bull; <b>P</b>, <b>p</b> - memory pages (arch-specific,
+
 
usually 4KB); <br>
+
<p style="margin-left:22%;">MAC address of interface inside
&bull; <b>B</b>, <b>b</b> - bytes.</p>
+
a container.</p>
  
<p style="margin-left:11%; margin-top: 1em">You can also
+
<p style="margin-left:11%;"><b>--host_ifname</b>
specify the literal word <b>unlimited</b> in place of a
+
<i>name</i></p>
number. In that case the corresponding value will be set to
 
<b>LONG_MAX</b>, i. e. the maximum possible value. <b><br>
 
--numproc</b> <i>items</i>[:<i>items</i>]</p>
 
  
<p style="margin-left:22%;">Maximum number of processes and
+
<p style="margin-left:22%;">interface name for virtual
kernel-level threads. Setting the barrier and the limit to
+
interface in the host system.</p>
different values does not make practical sense.</p>
 
  
<p style="margin-left:11%;"><b>--numtcpsock</b>
+
<p style="margin-left:11%;"><b>--host_mac</b>
<i>items</i>[:<i>items</i>]</p>
+
<i>XX:XX:XX:XX:XX:XX</i></p>
  
<p style="margin-left:22%;">Maximum number of TCP sockets.
+
<p style="margin-left:22%;">MAC address of interface in the
This parameter limits the number of TCP connections and,
+
host system.</p>
thus, the number of clients the server application can
 
handle in parallel. Setting the barrier and the limit to
 
different values does not make practical sense.</p>
 
  
<p style="margin-left:11%;"><b>--numothersock</b>
+
<p style="margin-left:22%; margin-top: 1em">If you want an
<i>items</i>[:<i>items</i>]</p>
+
independent communication with the Container through the
 +
bridge, you should specify a multicast MAC address here
 +
(FE:FF:FF:FF:FF:FF).</p>
  
<p style="margin-left:22%;">Maximum number of non-TCP
+
<p style="margin-left:11%;"><b>--bridge</b> <i>name</i></p>
sockets (local sockets, UDP and other types of sockets).
 
Setting the barrier and the limit to different values does
 
not make practical sense.</p>
 
  
<p style="margin-left:11%;"><b>--vmguarpages</b>
+
<p style="margin-left:22%;">Bridge name. Custom network
<i>pages</i>[:<i>pages</i>]</p>
+
start scripts can use this value to automatically add the
 +
interface to a bridge.</p>
  
<p style="margin-left:22%;">Memory allocation guarantee.
+
<p style="margin-left:11%;"><b>--mac_filter on</b> |
This parameter controls how much memory is available to a
+
<b>off</b></p>
container. The barrier is the amount of memory that
 
container&rsquo;s applications are guaranteed to be able to
 
allocate. The meaning of the limit is currently unspecified;
 
it should be set to <b>unlimited</b>.</p>
 
  
<p style="margin-left:11%;"><b>--kmemsize</b>
+
<p style="margin-left:22%;">Enables/disables MAC address
<i>bytes</i>[:<i>bytes</i>]</p>
+
filtering for the Container veth device and the possibility
 
+
of configuring the MAC address of this device from inside
<p style="margin-left:22%;">Maximum amount of kernel memory
+
the Container. If the filtering is turned on: <br>
used. This parameter is related to <b>--numproc</b>. Each
+
&bull; the veth device accepts only those packets that have
process consumes certain amount of kernel memory - 16 KB at
+
a MAC address in their headers corresponding to that of this
least, 30-50 KB typically. Very large processes may consume
+
device (excluding all broadcast and multicast packets); <br>
a bit more. It is important to have a certain safety gap
+
&bull; it is impossible to modify the veth MAC address from
between the barrier and the limit of this parameter: equal
+
inside the Container.</p>
barrier and limit may lead to the situation where the kernel
 
will need to kill container&rsquo;s applications to keep the
 
<b>kmemsize</b> usage under the limit.</p>
 
  
<p style="margin-left:11%;"><b>--tcpsndbuf</b>
+
<p style="margin-left:22%; margin-top: 1em">By default,
<i>bytes</i>[:<i>bytes</i>]</p>
+
this functionality is enabled for all veth devices existing
 +
inside the Container.</p>
  
<p style="margin-left:22%;">Maximum size of TCP send
+
==== VSwap limits ====
buffers. Barrier should be not less than 64 KB, and
 
difference between barrier and limit should be equal to or
 
more than value of <b>numtcpsock</b> multiplied by 2.5
 
KB.</p>
 
  
<p style="margin-left:11%;"><b>--tcprcvbuf</b>
+
<p style="margin-left:11%; margin-top: 1em">The following
<i>bytes</i>[:<i>bytes</i>]</p>
+
options sets memory and swap limits for VSwap-enabled
 +
kernels (kernel version 042stab042 or greater).</p>
  
<p style="margin-left:22%;">Maximum size of TCP receive
+
<p style="margin-left:11%; margin-top: 1em">Argument is in
buffers. Barrier should be not less than 64 KB, and
+
bytes, unless otherwise specified by an optional suffix.
difference between barrier and limit should be equal to or
+
Available suffixes are:</p>
more than value of <b>numtcpsock</b> multiplied by 2.5
 
KB.</p>
 
  
<p style="margin-left:11%;"><b>--othersockbuf</b>
+
<p style="margin-left:11%; margin-top: 1em">&bull;
<i>bytes</i>[:<i>bytes</i>]</p>
+
<b>T</b>, <b>t</b> - terabytes; <br>
 +
&bull; <b>G</b>, <b>g</b> - gigabytes; <br>
 +
&bull; <b>M</b>, <b>m</b> - megabytes; <br>
 +
&bull; <b>K</b>, <b>k</b> - kilobytes; <br>
 +
&bull; <b>P</b>, <b>p</b> - memory pages (arch-specific,
 +
usually 4KB); <br>
 +
&bull; <b>B</b>, <b>b</b> - bytes (this is the default).
 +
<b><br>
 +
--ram</b> <i>bytes</i></p>
  
<p style="margin-left:22%;">Maximum size of other (non-TCP)
+
<p style="margin-left:22%;">Sets physical memory (RAM)
socket send buffers. If container&rsquo;s processes needs to
+
available to a container. Actually, the option is a shortcut
send very large datagrams, the barrier should be set
+
for setting <b>--physpages</b> limit (the barrier is set to
accordingly. Increased limit is necessary for high
+
0).</p>
performance of communications through local (UNIX-domain)
 
sockets.</p>
 
  
<p style="margin-left:11%;"><b>--dgramrcvbuf</b>
+
<p style="margin-left:11%;"><b>--swap</b> <i>bytes</i></p>
<i>bytes</i>[:<i>bytes</i>]</p>
 
  
<p style="margin-left:22%;">Maximum size of other (non-TCP)
+
<p style="margin-left:22%;">Set swap space available to a
socket receive buffers. If container&rsquo;s processes needs
+
container. Actually, the option is a shortcut for setting
to receive very large datagrams, the barrier should be set
+
<b>--swappages</b> limit (the barrier is set to 0).</p>
accordingly. The difference between the barrier and the
+
 
limit is not needed.</p>
+
<p style="margin-left:11%;"><b>--vm_overcommit</b>
 +
<i>float</i></p>
 +
 
 +
<p style="margin-left:22%;">Set VM overcommitment value to
 +
<i>float</i>. If set, it is used to calculate
 +
<b>privmmpages</b> parameter in case it is not set
 +
explicitly (see below). Default value is <b>0</b>, meaning
 +
unlimited privvmpages.</p>
 +
 
 +
<p style="margin-left:11%; margin-top: 1em"><b>vzctl</b>
 +
checks if running kernel is VSwap capable, and refuses to
 +
use these parameters otherwise. This behavior can be
 +
overriden by using <b>--force</b> flag before
 +
parameters.</p>
 +
 
 +
<p style="margin-left:11%; margin-top: 1em">In VSwap mode,
 +
all beancounters other than RAM and swap become optional.
 +
Note though that if some optional beancounters are not set,
 +
they are calculated and set by vzctl implicitly, using the
 +
following formulae:</p>
  
<p style="margin-left:11%;"><b>--oomguarpages</b>
+
<p style="margin-left:11%; margin-top: 1em"><b>&bull;
<i>pages</i>[:<i>pages</i>]</p>
+
lockedpages.barrier = oomguarpages.barrier = ram</b></p>
  
<p style="margin-left:22%;">Guarantees against OOM kill.
+
<p style="margin-left:11%; margin-top: 1em"><b>&bull;
Under this beancounter the kernel accounts the total amount
+
lockedpages.limit = oomguarpages.limit = unlimited</b></p>
of memory and swap space used by the container&rsquo;s
 
processes. The barrier of this parameter is the
 
out-of-memory guarantee. If the <b>oomguarpages</b> usage is
 
below the barrier, processes of this container are
 
guaranteed not to be killed in out-of-memory situations. The
 
meaning of limit is currently unspecified; it should be set
 
to <b>unlimited</b>.</p>
 
  
<p style="margin-left:11%;"><b>--lockedpages</b>
+
<p style="margin-left:11%; margin-top: 1em"><b>&bull;
<i>pages</i>[:<i>pages</i>]</p>
+
vmguarpages.barrier = vmguarpages.limit = ram + swap</b></p>
  
<p style="margin-left:22%;">Maximum number of pages
+
<p style="margin-left:11%; margin-top: 1em"><b>&bull;
acquired by <b>mlock</b>(2).</p>
+
privvmpages.barrier = privvmpages.limit = (ram + swap) *
 +
vm_overcommit</b></p>
  
<p style="margin-left:11%;"><b>--privvmpages</b>
+
<p style="margin-left:11%; margin-top: 1em">(if
<i>pages</i>[:<i>pages</i>]</p>
+
<b>vm_overcommit</b> is <b>0</b> or not set,
 +
<b>privvmpages</b> is set to &quot;unlimited&quot;)</p>
  
<p style="margin-left:22%;">Allows controlling the amount
+
<p style="margin-left:11%; margin-top: 1em">Here is an
of memory allocated by the applications. For shared (mapped
+
example of setting container 777 to have 512 megabytes of
as <b>MAP_SHARED</b>) pages, each container really using a
+
RAM and 1 gigabyte of swap:</p>
memory page is charged for the fraction of the page
 
(depending on the number of others using it). For
 
&quot;potentially private&quot; pages (mapped as
 
<b>MAP_PRIVATE</b>), container is charged either for a
 
fraction of the size or for the full size if the allocated
 
address space. In the latter case, the physical pages
 
associated with the allocated address space may be in
 
memory, in swap or not physically allocated yet.</p>
 
  
<p style="margin-left:22%; margin-top: 1em">The barrier and
+
<pre style="margin-left:11%;">   vzctl set 777 --ram 512M --swap 1G --save</pre>
the limit of this parameter control the upper boundary of
 
the total size of allocated memory. Note that this upper
 
boundary does not guarantee that container will be able to
 
allocate that much memory. The primary mechanism to control
 
memory allocation is the <b>--vmguarpages</b> guarantee.</p>
 
  
<p style="margin-left:11%;"><b>--shmpages</b>
+
==== User Beancounter limits ====
<i>pages</i>[:<i>pages</i>]</p>
 
  
<p style="margin-left:22%;">Maximum IPC SHM segment size.
+
<p style="margin-left:11%; margin-top: 1em">The following
Setting the barrier and the limit to different values does
+
options sets barrier and limit for various user
not make practical sense.</p>
+
beancounters.</p>
  
<p style="margin-left:11%;"><b>--numfile</b>
+
<p style="margin-left:11%; margin-top: 1em">Note that for
<i>items</i>[:<i>items</i>]</p>
+
VSwap-enabled kernels (version 042stab042 or greater) these
 +
limits are optional, you must only set <b>--ram</b> and
 +
<b>--swap</b> (see above). For older kernels, these limits
 +
are obligatory.</p>
  
<p style="margin-left:22%;">Maximum number of open files.
+
<p style="margin-left:11%; margin-top: 1em">Each option
In most cases the barrier and the limit should be set to the
+
requires one or two arguments. In case of one argument,
same value. Setting the barrier to <b>0</b> effectively
+
<b>vzctl</b> sets barrier and limit to the same value. In
disables pre-charging optimization for this beancounter in
+
case of two colon-separated arguments, the first is a
the kernel, which leads to the held value being precise but
+
barrier, and the second is a limit. Each argument is either
could slightly degrade file open performance.</p>
+
a number, a number with a suffix, or a special value
 +
<b>unlimited</b>.</p>
  
<p style="margin-left:11%;"><b>--numflock</b>
+
<p style="margin-left:11%; margin-top: 1em">Arguments are
<i>items</i>[:<i>items</i>]</p>
+
in items, pages or bytes. Note that page size is
 +
architecture-specific, it is 4096 bytes on x86 and x86_64
 +
platforms.</p>
  
<p style="margin-left:22%;">Maximum number of file locks.
+
<p style="margin-left:11%; margin-top: 1em">You can also
Safety gap should be between barrier and limit.</p>
+
specify different suffixes for User Beancounter parameters
 +
(except for those which names start with <b>num</b>). For
 +
example, <b>vzctl set</b> <i>CTID</i> <b>--privvmpages
 +
5M:6M</b> should set <b>privvmpages</b>&rsquo; barrier to 5
 +
megabytes and its limit to 6 megabytes.</p>
  
<p style="margin-left:11%;"><b>--numpty</b>
+
<p style="margin-left:11%; margin-top: 1em">Available
<i>items</i>[:<i>items</i>]</p>
+
suffixes are:</p>
  
<p style="margin-left:22%;">Number of pseudo-terminals
+
<p style="margin-left:11%; margin-top: 1em">&bull;
(PTY). Note that in OpenVZ each container can have not more
+
<b>T</b>, <b>t</b> - terabytes; <br>
than 255 PTYs. Setting the barrier and the limit to
+
&bull; <b>G</b>, <b>g</b> - gigabytes; <br>
 +
&bull; <b>M</b>, <b>m</b> - megabytes; <br>
 +
&bull; <b>K</b>, <b>k</b> - kilobytes; <br>
 +
&bull; <b>P</b>, <b>p</b> - memory pages (arch-specific,
 +
usually 4KB); <br>
 +
&bull; <b>B</b>, <b>b</b> - bytes.</p>
 +
 
 +
<p style="margin-left:11%; margin-top: 1em">You can also
 +
specify the literal word <b>unlimited</b> in place of a
 +
number. In that case the corresponding value will be set to
 +
<b>LONG_MAX</b>, i. e. the maximum possible value. <b><br>
 +
--numproc</b> <i>items</i>[:<i>items</i>]</p>
 +
 
 +
<p style="margin-left:22%;">Maximum number of processes and
 +
kernel-level threads. Setting the barrier and the limit to
 +
different values does not make practical sense.</p>
 +
 
 +
<p style="margin-left:11%;"><b>--numtcpsock</b>
 +
<i>items</i>[:<i>items</i>]</p>
 +
 
 +
<p style="margin-left:22%;">Maximum number of TCP sockets.
 +
This parameter limits the number of TCP connections and,
 +
thus, the number of clients the server application can
 +
handle in parallel. Setting the barrier and the limit to
 
different values does not make practical sense.</p>
 
different values does not make practical sense.</p>
  
<p style="margin-left:11%;"><b>--numsiginfo</b>
+
<p style="margin-left:11%;"><b>--numothersock</b>
 
<i>items</i>[:<i>items</i>]</p>
 
<i>items</i>[:<i>items</i>]</p>
  
<p style="margin-left:22%;">Number of siginfo structures.
+
<p style="margin-left:22%;">Maximum number of non-TCP
 +
sockets (local sockets, UDP and other types of sockets).
 
Setting the barrier and the limit to different values does
 
Setting the barrier and the limit to different values does
 
not make practical sense.</p>
 
not make practical sense.</p>
  
<p style="margin-left:11%;"><b>--dcachesize</b>
+
<p style="margin-left:11%;"><b>--vmguarpages</b>
 +
<i>pages</i>[:<i>pages</i>]</p>
 +
 
 +
<p style="margin-left:22%;">Memory allocation guarantee.
 +
This parameter controls how much memory is available to a
 +
container. The barrier is the amount of memory that
 +
container&rsquo;s applications are guaranteed to be able to
 +
allocate. The meaning of the limit is currently unspecified;
 +
it should be set to <b>unlimited</b>.</p>
 +
 
 +
<p style="margin-left:11%;"><b>--kmemsize</b>
 
<i>bytes</i>[:<i>bytes</i>]</p>
 
<i>bytes</i>[:<i>bytes</i>]</p>
  
<p style="margin-left:22%;">Maximum size of
+
<p style="margin-left:22%;">Maximum amount of kernel memory
filesystem-related caches, such as directory entry and inode
+
used. This parameter is related to <b>--numproc</b>. Each
caches. Exists as a separate parameter to impose a limit
+
process consumes certain amount of kernel memory - 16 KB at
causing file operations to sense memory shortage and return
+
least, 30-50 KB typically. Very large processes may consume
an errno to applications, protecting from memory shortages
+
a bit more. It is important to have a certain safety gap
during critical operations that should not fail. Safety gap
+
between the barrier and the limit of this parameter: equal
should be between barrier and limit.</p>
+
barrier and limit may lead to the situation where the kernel
 +
will need to kill container&rsquo;s applications to keep the
 +
<b>kmemsize</b> usage under the limit.</p>
  
<p style="margin-left:11%;"><b>--numiptent</b>
+
<p style="margin-left:11%;"><b>--tcpsndbuf</b>
<i>num</i>[:<i>num</i>]</p>
+
<i>bytes</i>[:<i>bytes</i>]</p>
  
<p style="margin-left:22%;">Number of iptables (netfilter)
+
<p style="margin-left:22%;">Maximum size of TCP send
entries. Setting the barrier and the limit to different
+
buffers. Barrier should be not less than 64 KB, and
values does not make practical sense.</p>
+
difference between barrier and limit should be equal to or
 +
more than value of <b>numtcpsock</b> multiplied by 2.5
 +
KB.</p>
  
<p style="margin-left:11%;"><b>--physpages</b>
+
<p style="margin-left:11%;"><b>--tcprcvbuf</b>
<i>pages</i>[:<i>pages</i>]</p>
+
<i>bytes</i>[:<i>bytes</i>]</p>
  
<p style="margin-left:22%;">On VSwap-enabled kernels, this
+
<p style="margin-left:22%;">Maximum size of TCP receive
limits the amount of physical memory (RAM) available to a
+
buffers. Barrier should be not less than 64 KB, and
container. The barrier should be set to <b>0</b>, and the
+
difference between barrier and limit should be equal to or
limit to a total size of RAM that can be used used by a
+
more than value of <b>numtcpsock</b> multiplied by 2.5
container.</p>
+
KB.</p>
  
<p style="margin-left:22%; margin-top: 1em">For older
+
<p style="margin-left:11%;"><b>--othersockbuf</b>
kernels, this is an accounting-only parameter, showing the
+
<i>bytes</i>[:<i>bytes</i>]</p>
usage of RAM by this container. Barrier should be set to
 
<b>0</b>, and limit should be set to <b>unlimited</b>.</p>
 
  
<p style="margin-left:11%;"><b>--swappages</b>
+
<p style="margin-left:22%;">Maximum size of other (non-TCP)
<i>pages</i>[:<i>pages</i>]</p>
+
socket send buffers. If container&rsquo;s processes needs to
 +
send very large datagrams, the barrier should be set
 +
accordingly. Increased limit is necessary for high
 +
performance of communications through local (UNIX-domain)
 +
sockets.</p>
  
<p style="margin-left:22%;">For VSwap-enabled kernels
+
<p style="margin-left:11%;"><b>--dgramrcvbuf</b>
(042stab042 or greater), this parameter limits the amount of
+
<i>bytes</i>[:<i>bytes</i>]</p>
swap space available to a container. The barrier should be
 
set to <b>0</b>, and the limit to a total size of swap that
 
can be used by a container.</p>
 
  
<p style="margin-left:22%; margin-top: 1em">For older
+
<p style="margin-left:22%;">Maximum size of other (non-TCP)
(pre-VSwap) kernels, the limit is used to show a total
+
socket receive buffers. If container&rsquo;s processes needs
amount of swap space available inside the container. The
+
to receive very large datagrams, the barrier should be set
barrier of this parameter is ignored. The default value is
+
accordingly. The difference between the barrier and the
<b>unlimited</b>, meaning total swap will be reported as
+
limit is not needed.</p>
0.</p>
 
  
==== CPU fair scheduler parameters ====
+
<p style="margin-left:11%;"><b>--oomguarpages</b>
 +
<i>pages</i>[:<i>pages</i>]</p>
  
<p style="margin-left:11%; margin-top: 1em">These
+
<p style="margin-left:22%;">Guarantees against OOM kill.
parameters control CPU usage by container. <b><br>
+
Under this beancounter the kernel accounts the total amount
--cpuunits</b> <i>num</i></p>
+
of memory and swap space used by the container&rsquo;s
 +
processes. The barrier of this parameter is the
 +
out-of-memory guarantee. If the <b>oomguarpages</b> usage is
 +
below the barrier, processes of this container are
 +
guaranteed not to be killed in out-of-memory situations. The
 +
meaning of limit is currently unspecified; it should be set
 +
to <b>unlimited</b>.</p>
  
<p style="margin-left:22%;">CPU weight for a container.
+
<p style="margin-left:11%;"><b>--lockedpages</b>
Argument is positive non-zero number, passed to and used in
+
<i>pages</i>[:<i>pages</i>]</p>
the kernel fair scheduler. The larger the number is, the
 
more CPU time this container gets. Maximum value is 500000,
 
minimal is 8. Number is relative to weights of all the other
 
running containers. If <b>cpuunits</b> are not specified,
 
default value of 1000 is used.</p>
 
  
<p style="margin-left:22%; margin-top: 1em">You can set CPU
+
<p style="margin-left:22%;">Maximum number of pages
weight for CT0 (host system itself) as well (use <b>vzctl
+
acquired by <b>mlock</b>(2).</p>
set 0 --cpuunits</b> <i>num</i>). Usually, OpenVZ initscript
 
(<b>/etc/init.d/vz</b>) takes care of setting this.</p>
 
  
<p style="margin-left:11%;"><b>--cpulimit</b>
+
<p style="margin-left:11%;"><b>--privvmpages</b>
<i>num</i>[<b>%</b>]</p>
+
<i>pages</i>[:<i>pages</i>]</p>
  
<p style="margin-left:22%;">Limit of CPU usage for the
+
<p style="margin-left:22%;">Allows controlling the amount
container, in per cent. Note if the computer has 2 CPUs, it
+
of memory allocated by the applications. For shared (mapped
has total of 200% CPU time. Default CPU limit is <b>0</b>
+
as <b>MAP_SHARED</b>) pages, each container really using a
(no CPU limit).</p>
+
memory page is charged for the fraction of the page
 +
(depending on the number of others using it). For
 +
&quot;potentially private&quot; pages (mapped as
 +
<b>MAP_PRIVATE</b>), container is charged either for a
 +
fraction of the size or for the full size if the allocated
 +
address space. In the latter case, the physical pages
 +
associated with the allocated address space may be in
 +
memory, in swap or not physically allocated yet.</p>
  
<p style="margin-left:11%;"><b>--cpus</b> <i>num</i></p>
+
<p style="margin-left:22%; margin-top: 1em">The barrier and
 +
the limit of this parameter control the upper boundary of
 +
the total size of allocated memory. Note that this upper
 +
boundary does not guarantee that container will be able to
 +
allocate that much memory. The primary mechanism to control
 +
memory allocation is the <b>--vmguarpages</b> guarantee.</p>
  
<p style="margin-left:22%;">sets number of CPUs available
+
<p style="margin-left:11%;"><b>--shmpages</b>
in the container.</p>
+
<i>pages</i>[:<i>pages</i>]</p>
  
<p style="margin-left:11%;"><b>--cpumask</b> <i>cpus</i> |
+
<p style="margin-left:22%;">Maximum IPC SHM segment size.
<b>all</b></p>
+
Setting the barrier and the limit to different values does
 +
not make practical sense.</p>
  
<p style="margin-left:22%;">sets list of allowed CPUs for
+
<p style="margin-left:11%;"><b>--numfile</b>
the container. Input format is a comma-separated list of
+
<i>items</i>[:<i>items</i>]</p>
decimal numbers and ranges. Consecutively set bits are shown
 
as two hyphen-separated decimal numbers, the smallest and
 
largest bit numbers set in the range. For example, if you
 
want the container to execute on CPUs 0, 1, 2, 7, you should
 
pass <b>0-2,7</b>. Default value is <b>all</b> (the
 
container can execute on any CPU).</p>
 
  
==== Memory output parameters ====
+
<p style="margin-left:22%;">Maximum number of open files.
 
+
In most cases the barrier and the limit should be set to the
<p style="margin-left:11%; margin-top: 1em">For
+
same value. Setting the barrier to <b>0</b> effectively
VSwap-enabled kernels (042stab042 or greater), this
+
disables pre-charging optimization for this beancounter in
parameter is ignored. For older kernels, it controls the
+
the kernel, which leads to the held value being precise but
output of /proc/meminfo inside a container. <b><br>
+
could slightly degrade file open performance.</p>
--meminfo none</b></p>
 
  
<p style="margin-left:22%;">No /proc/meminfo virtualization
+
<p style="margin-left:11%;"><b>--numflock</b>
(the same as on host system).</p>
+
<i>items</i>[:<i>items</i>]</p>
  
<p style="margin-left:11%;"><b>--meminfo</b>
+
<p style="margin-left:22%;">Maximum number of file locks.
<i>mode</i>:<i>value</i></p>
+
Safety gap should be between barrier and limit.</p>
  
<p style="margin-left:22%;">Configure total memory output
+
<p style="margin-left:11%;"><b>--numpty</b>
in a container. Reported free memory is evaluated
+
<i>items</i>[:<i>items</i>]</p>
accordingly to the mode being set. Reported swap is
 
evaluated according to the settings of <b>--swappages</b>
 
parameter.</p>
 
  
<p style="margin-left:22%; margin-top: 1em">You can use the
+
<p style="margin-left:22%;">Number of pseudo-terminals
following modes for <i>mode</i>: <br>
+
(PTY). Note that in OpenVZ each container can have not more
&bull; <b>pages</b>:<i>value</i> - sets total memory in
+
than 255 PTYs. Setting the barrier and the limit to
pages; <br>
+
different values does not make practical sense.</p>
&bull; <b>privvmpages</b>:<i>value</i> - sets total memory
 
as <b>privvmpages</b> * <i>value</i>.</p>
 
  
<p style="margin-left:22%; margin-top: 1em">Default is
+
<p style="margin-left:11%;"><b>--numsiginfo</b>
<b>privvmpages:1</b>.</p>
+
<i>items</i>[:<i>items</i>]</p>
 +
 
 +
<p style="margin-left:22%;">Number of siginfo structures.
 +
Setting the barrier and the limit to different values does
 +
not make practical sense.</p>
  
==== iptables control parameters ====
+
<p style="margin-left:11%;"><b>--dcachesize</b>
 +
<i>bytes</i>[:<i>bytes</i>]</p>
  
<p style="margin-left:11%;"><b>--iptables</b>
+
<p style="margin-left:22%;">Maximum size of
<i>name</i></p>
+
filesystem-related caches, such as directory entry and inode
 +
caches. Exists as a separate parameter to impose a limit
 +
causing file operations to sense memory shortage and return
 +
an errno to applications, protecting from memory shortages
 +
during critical operations that should not fail. Safety gap
 +
should be between barrier and limit.</p>
  
<p style="margin-left:22%;">Allow to use the functionality
+
<p style="margin-left:11%;"><b>--numiptent</b>
of <i>name</i> iptables module inside the container. To
+
<i>num</i>[:<i>num</i>]</p>
specify multiple <i>name</i>s, repeat --iptables for each,
 
or use space-separated list as an argument (enclosed in
 
single or double quotes to protect spaces).</p>
 
  
<p style="margin-left:22%; margin-top: 1em">The default
+
<p style="margin-left:22%;">Number of iptables (netfilter)
list of enabled iptables modules is specified by the
+
entries. Setting the barrier and the limit to different
<b>IPTABLES</b> variable in [[Man/vz.conf.5|<b>vz.conf</b>(5)]].</p>
+
values does not make practical sense.</p>
  
<p style="margin-left:22%; margin-top: 1em">You can use the
+
<p style="margin-left:11%;"><b>--physpages</b>
following values for <i>name</i>: <b>iptable_filter</b>,
+
<i>pages</i>[:<i>pages</i>]</p>
<b>iptable_mangle</b>, <b>ipt_limit</b>,
 
<b>ipt_multiport</b>, <b>ipt_tos</b>, <b>ipt_TOS</b>,
 
<b>ipt_REJECT</b>, <b>ipt_TCPMSS</b>, <b>ipt_tcpmss</b>,
 
<b>ipt_ttl</b>, <b>ipt_LOG</b>, <b>ipt_length</b>,
 
<b>ip_conntrack</b>, <b>ip_conntrack_ftp</b>,
 
<b>ip_conntrack_irc</b>, <b>ipt_conntrack</b>,
 
<b>ipt_state</b>, <b>ipt_helper</b>, <b>iptable_nat</b>,
 
<b>ip_nat_ftp</b>, <b>ip_nat_irc</b>, <b>ipt_REDIRECT</b>,
 
<b>xt_mac</b>, <b>ipt_recent</b>, <b>ipt_owner</b>.</p>
 
  
==== Network devices control parameters ====
+
<p style="margin-left:22%;">On VSwap-enabled kernels, this
 +
limits the amount of physical memory (RAM) available to a
 +
container. The barrier should be set to <b>0</b>, and the
 +
limit to a total size of RAM that can be used used by a
 +
container.</p>
  
<p style="margin-left:11%;"><b>--netdev_add</b>
+
<p style="margin-left:22%; margin-top: 1em">For older
<i>name</i></p>
+
kernels, this is an accounting-only parameter, showing the
 +
usage of RAM by this container. Barrier should be set to
 +
<b>0</b>, and limit should be set to <b>unlimited</b>.</p>
  
<p style="margin-left:22%;">move network device from the
+
<p style="margin-left:11%;"><b>--swappages</b>
host system to a specified container</p>
+
<i>pages</i>[:<i>pages</i>]</p>
  
<p style="margin-left:11%;"><b>--netdev_del</b>
+
<p style="margin-left:22%;">For VSwap-enabled kernels
<i>name</i></p>
+
(042stab042 or greater), this parameter limits the amount of
 +
swap space available to a container. The barrier should be
 +
set to <b>0</b>, and the limit to a total size of swap that
 +
can be used by a container.</p>
  
<p style="margin-left:22%;">delete network device from a
+
<p style="margin-left:22%; margin-top: 1em">For older
specified container</p>
+
(pre-VSwap) kernels, the limit is used to show a total
 +
amount of swap space available inside the container. The
 +
barrier of this parameter is ignored. The default value is
 +
<b>unlimited</b>, meaning total swap will be reported as
 +
0.</p>
  
==== Disk quota parameters ====
+
==== CPU fair scheduler parameters ====
  
<p style="margin-left:11%;"><b>--diskquota yes</b> |
+
<p style="margin-left:11%; margin-top: 1em">These
<b>no</b></p>
+
parameters control CPU usage by container. <b><br>
 +
--cpuunits</b> <i>num</i></p>
  
<p style="margin-left:22%;">allows to enable or disable
+
<p style="margin-left:22%;">CPU weight for a container.
disk quota for a container. By default, a global value
+
Argument is positive non-zero number, passed to and used in
(<b>DISK_QUOTA</b>) from [[Man/vz.conf.5|<b>vz.conf</b>(5)]] is used.</p>
+
the kernel fair scheduler. The larger the number is, the
 +
more CPU time this container gets. Maximum value is 500000,
 +
minimal is 8. Number is relative to weights of all the other
 +
running containers. If <b>cpuunits</b> are not specified,
 +
default value of 1000 is used.</p>
  
<p style="margin-left:22%; margin-top: 1em">Note that this
+
<p style="margin-left:22%; margin-top: 1em">You can set CPU
parameter is ignored for <b>ploop</b> layout.</p>
+
weight for CT0 (host system itself) as well (use <b>vzctl
 +
set 0 --cpuunits</b> <i>num</i>). Usually, OpenVZ initscript
 +
(<b>/etc/init.d/vz</b>) takes care of setting this.</p>
  
<p style="margin-left:11%;"><b>--diskspace</b>
+
<p style="margin-left:11%;"><b>--cpulimit</b>
<i>num</i>[:<i>num</i>]</p>
+
<i>num</i>[<b>%</b>]</p>
  
<p style="margin-left:22%;">For <b>simfs</b> layout, sets
+
<p style="margin-left:22%;">Limit of CPU usage for the
soft and hard disk quota limits, in blocks. First parameter
+
container, in per cent. Note if the computer has 2 CPUs, it
is soft limit, second is hard limit. One block is currently
+
has total of 200% CPU time. Default CPU limit is <b>0</b>
equal to 1Kb.</p>
+
(no CPU limit).</p>
  
<p style="margin-left:22%; margin-top: 1em">For
+
<p style="margin-left:11%;"><b>--cpus</b> <i>num</i></p>
<b>ploop</b> layout, sets the size of the ploop image file,
 
in kilobytes.</p>
 
  
<p style="margin-left:22%; margin-top: 1em">Suffixes
+
<p style="margin-left:22%;">sets number of CPUs available
<b>G</b>, <b>M</b>, <b>K</b> can also be specified (see
+
in the container.</p>
<b>Resource limits</b> section for more info on
 
suffixes).</p>
 
  
<p style="margin-left:11%;"><b>--diskinodes</b>
+
<p style="margin-left:11%;"><b>--cpumask</b> <i>cpus</i> |
<i>num</i>[:<i>num</i>]</p>
+
<b>auto</b> | <b>all</b></p>
  
<p style="margin-left:22%;">sets soft and hard disk quota
+
<p style="margin-left:22%;">Sets list of allowed CPUs for
limits, in i-nodes. First parameter is soft limit, second is
+
the container. Input format is a comma-separated list of
hard limit.</p>
+
decimal numbers and/or ranges. Consecutively set bits are
 +
shown as two hyphen-separated decimal numbers, the smallest
 +
and largest bit numbers set in the range. For example, if
 +
you want the container to execute on CPUs 0, 1, 2, 7, you
 +
should pass <b>0-2,7</b>. Default value is <b>all</b> (the
 +
container can execute on any CPU). If used with the
 +
<b>--nodemask</b> option, value of <b>auto</b> assigns all
 +
CPUs from the specified NUMA node to a container.</p>
  
<p style="margin-left:22%; margin-top: 1em">Note that this
+
<p style="margin-left:11%;"><b>--nodemask</b> <i>nodes</i>
parameter is ignored for <b>ploop</b> layout.</p>
+
| <b>all</b></p>
  
<p style="margin-left:11%;"><b>--quotatime</b>
+
<p style="margin-left:22%;">Sets list of allowed NUMA nodes
<i>seconds</i></p>
+
for the container. Input format is the same as for
 +
<b>--cpumask</b>. Note that <b>--nodemask</b> must be used
 +
with the <b>--cpumask</b> option.</p>
  
<p style="margin-left:22%;">sets quota grace period.
+
==== Memory output parameters ====
Container is permitted to exceed its soft limits for the
 
grace period, but once it has expired, the soft limit is
 
enforced as a hard limit.</p>
 
  
<p style="margin-left:22%; margin-top: 1em">Note that this
+
<p style="margin-left:11%; margin-top: 1em">For
parameter is ignored for <b>ploop</b> layout.</p>
+
VSwap-enabled kernels (042stab042 or greater), this
 +
parameter is ignored. For older kernels, it controls the
 +
output of /proc/meminfo inside a container. <b><br>
 +
--meminfo none</b></p>
 +
 
 +
<p style="margin-left:22%;">No /proc/meminfo virtualization
 +
(the same as on host system).</p>
 +
 
 +
<p style="margin-left:11%;"><b>--meminfo</b>
 +
<i>mode</i>:<i>value</i></p>
  
<p style="margin-left:11%;"><b>--quotaugidlimit</b>
+
<p style="margin-left:22%;">Configure total memory output
<i>num</i></p>
+
in a container. Reported free memory is evaluated
 +
accordingly to the mode being set. Reported swap is
 +
evaluated according to the settings of <b>--swappages</b>
 +
parameter.</p>
  
<p style="margin-left:22%;">sets maximum number of
+
<p style="margin-left:22%; margin-top: 1em">You can use the
user/group IDs in a container for which disk quota inside
+
following modes for <i>mode</i>: <br>
the container will be accounted. If this value is set to
+
&bull; <b>pages</b>:<i>value</i> - sets total memory in
<b>0</b>, user and group quotas inside the container will
+
pages; <br>
not be accounted.</p>
+
&bull; <b>privvmpages</b>:<i>value</i> - sets total memory
 +
as <b>privvmpages</b> * <i>value</i>.</p>
  
<p style="margin-left:22%; margin-top: 1em">Note that if
+
<p style="margin-left:22%; margin-top: 1em">Default is
you have previously set value of this parameter to <b>0</b>,
+
<b>privvmpages:1</b>.</p>
changing it while the container is running will not take
 
effect.</p>
 
  
==== Mount option ====
+
==== Netfilter (iptables) control parameters ====
  
<p style="margin-left:11%;"><b>--noatime yes</b> |
+
<p style="margin-left:11%;"><b>--netfilter&nbsp;disabled</b>|<b>stateless</b>|<b>stateful</b>|<b>full</b></p>
<b>no</b></p>
 
  
<p style="margin-left:22%;">Sets noatime flag (do not
+
<p style="margin-left:22%;">Restrict access to
update inode access times) on filesystem.</p>
+
netfilter/iptables modules for a container. This option
 +
replaces obsoleted <b>--iptables</b>.</p>
  
==== Capability option ====
+
<p style="margin-left:22%; margin-top: 1em">Note that
 +
changing this parameter requires container restart, so
 +
consider using <b>--setmode</b> option.</p>
  
<p style="margin-left:11%;"><b>--capability</b>
+
<p style="margin-left:22%; margin-top: 1em">The following
<i>capname</i>:<b>on</b>|<b>off</b></p>
+
arguments can be used: <b><br>
 +
&bull; disabled</b></p>
  
<p style="margin-left:22%;">Sets a capability for a
+
<p style="margin-left:32%;">no modules are allowed</p>
container. Note that setting capability when the container
 
is running does not take immediate effect; restart the
 
container in order for the changes to take effect. Note a
 
container has default set of capabilities, thus any
 
operation on capabilities is &quot;logical and&quot; with
 
the default capability mask.</p>
 
  
<p style="margin-left:22%; margin-top: 1em">You can use the
+
<p style="margin-left:22%;"><b>&bull; stateless</b></p>
following values for <i>capname</i>: <b>chown</b>,
 
<b>dac_override</b>, <b>dac_read_search</b>, <b>fowner</b>,
 
<b>fsetid</b>, <b>kill</b>, <b>setgid</b>, <b>setuid</b>,
 
<b>setpcap</b>, <b>linux_immutable</b>,
 
<b>net_bind_service</b>, <b>net_broadcast</b>,
 
<b>net_admin</b>, <b>net_raw</b>, <b>ipc_lock</b>,
 
<b>ipc_owner</b>, <b>sys_module</b>, <b>sys_rawio</b>,
 
<b>sys_chroot</b>, <b>sys_ptrace</b>, <b>sys_pacct</b>,
 
<b>sys_admin</b>, <b>sys_boot</b>, <b>sys_nice</b>,
 
<b>sys_resource</b>, <b>sys_time</b>, <b>sys_tty_config</b>,
 
<b>mknod</b>, <b>lease</b>, <b>setveid</b>, <b>ve_admin</b>.
 
For detailed description, see <b>capabilities</b>(7).</p>
 
  
<p style="margin-left:22%; margin-top: 1em"><b>WARNING</b>:
+
<p style="margin-left:32%;">all modules except NAT and
setting some of those capabilities may have far reaching
+
conntracks are allowed (i.e. filter and mangle); this is the
security implications, so do not do it unless you know what
+
default</p>
you are doing. Also note that setting <b>setpcap:on</b> for
 
a container will most probably lead to inability to start
 
it.</p>
 
  
==== Device access management ====
+
<p style="margin-left:22%;"><b>&bull; stateful</b></p>
  
<p style="margin-left:11%;"><b>--devnodes</b>
+
<p style="margin-left:32%;">all modules except NAT are
<i>device</i>:[<b>r</b>][<b>w</b>][<b>q</b>]|<b>none</b></p>
+
allowed</p>
  
<p style="margin-left:22%;">Give the container an access
+
<table width="100%" border="0" rules="none" frame="void"
(<b>r</b> - read, <b>w</b> - write, <b>q</b> - disk quota
+
      cellspacing="0" cellpadding="0">
management, <b>none</b> - no access) to a device designated
+
<tr valign="top" align="left">
by the special file /dev/<i>device</i>. Device file is
+
<td width="22%"></td>
created in a container by <b>vzctl</b>. Example:</p>
+
<td width="9%">
  
<pre style="margin-left:22%;">   vzctl set 777 --devnodes sdb:rwq</pre>
+
<p><b>&bull; full</b></p></td>
 +
<td width="1%"></td>
 +
<td width="36%">
  
<p style="margin-left:11%;"><b>--devices
+
<p>all modules are allowed</p></td>
b</b>|<b>c</b>:<i>major</i>:<i>minor</i>|<b>all</b>:[<b>r</b>][<b>w</b>][<b>q</b>]|<b>none</b></p>
+
<td width="32%">
 +
</td></tr>
 +
</table>
  
<p style="margin-left:22%;">Give the container an access to
+
<p style="margin-left:11%;"><b>--iptables</b>
a <b>b</b>lock or <b>c</b>haracter device designated by its
+
<i>name</i>[<b>,</b>...]</p>
<i>major</i> and <i>minor</i> numbers. Device file have to
 
be created manually.</p>
 
  
==== PCI device management ====
+
<p style="margin-left:22%;"><b>Note</b> this option is
 +
obsoleted, <b>--netfilter</b> should be used instead.</p>
  
<p style="margin-left:11%;"><b>--pci_add</b>
+
<p style="margin-left:22%; margin-top: 1em">Allow to use
[<i>domain</i>:]<i>bus</i>:<i>slot</i>.<i>func</i></p>
+
the functionality of <i>name</i> iptables module inside the
 +
container. Multiple comma-separated <i>name</i>s can be
 +
specified.</p>
  
<p style="margin-left:22%;">Give the container an access to
+
<p style="margin-left:22%; margin-top: 1em">The default
a specified PCI device. All numbers are hexadecimal (as
+
list of enabled iptables modules is defined by the
printed by <b>lspci</b>(8) in the first column).</p>
+
<b>IPTABLES</b> variable in [[Man/vz.conf.5|<b>vz.conf</b>(5)]].</p>
  
<p style="margin-left:11%;"><b>--pci_del</b>
+
<p style="margin-left:22%; margin-top: 1em">You can use the
[<i>domain</i>:]<i>bus</i>:<i>slot</i>.<i>func</i></p>
+
following values for <i>name</i>: <b>iptable_filter</b>,
 +
<b>iptable_mangle</b>, <b>ipt_limit</b>,
 +
<b>ipt_multiport</b>, <b>ipt_tos</b>, <b>ipt_TOS</b>,
 +
<b>ipt_REJECT</b>, <b>ipt_TCPMSS</b>, <b>ipt_tcpmss</b>,
 +
<b>ipt_ttl</b>, <b>ipt_LOG</b>, <b>ipt_length</b>,
 +
<b>ip_conntrack</b>, <b>ip_conntrack_ftp</b>,
 +
<b>ip_conntrack_irc</b>, <b>ipt_conntrack</b>,
 +
<b>ipt_state</b>, <b>ipt_helper</b>, <b>iptable_nat</b>,
 +
<b>ip_nat_ftp</b>, <b>ip_nat_irc</b>, <b>ipt_REDIRECT</b>,
 +
<b>xt_mac</b>, <b>ipt_recent</b>, <b>ipt_owner</b>.</p>
  
<p style="margin-left:22%;">Delete a PCI device from the
+
==== Network devices control parameters ====
container.</p>
 
  
<p style="margin-left:22%; margin-top: 1em">Note that
+
<p style="margin-left:11%;"><b>--netdev_add</b>
<b>vps-pci</b> configuration script is executed by
+
<i>name</i></p>
<b>vzctl</b> then configuring PCI devices. The script is
+
 
usually located at <b>/usr/lib[64]/vzctl/scripts/</b>.</p>
+
<p style="margin-left:22%;">move network device from the
 +
host system to a specified container</p>
  
==== Features management ====
+
<p style="margin-left:11%;"><b>--netdev_del</b>
 +
<i>name</i></p>
  
<p style="margin-left:11%;"><b>--features</b>
+
<p style="margin-left:22%;">delete network device from a
<i>name</i>:<b>on</b>|<b>off</b></p>
+
specified container</p>
  
<p style="margin-left:22%;">Enable or disable a specific
+
==== Disk quota parameters ====
container feature. Known features are: <b>sysfs</b>,
 
<b>nfs</b>, <b>sit</b>, <b>ipip</b>, <b>ppp</b>,
 
<b>ipgre</b>, <b>bridge</b>, <b>nfsd</b>.</p>
 
  
==== Apply config ====
+
<p style="margin-left:11%;"><b>--diskquota yes</b> |
 +
<b>no</b></p>
  
<p style="margin-left:11%;"><b>--applyconfig</b>
+
<p style="margin-left:22%;">allows to enable or disable
<i>name</i></p>
+
disk quota for a container. By default, a global value
 +
(<b>DISK_QUOTA</b>) from [[Man/vz.conf.5|<b>vz.conf</b>(5)]] is used.</p>
  
<p style="margin-left:22%;">Read container parameters from
+
<p style="margin-left:22%; margin-top: 1em">Note that this
the container sample configuration file
+
parameter is ignored for <b>ploop</b> layout.</p>
<tt>/etc/vz/conf/ve-</tt><i>name</i><tt>.conf-sample</tt>,
 
and apply them, if <b>--save</b> option specified save to
 
the container config file. The following parameters are not
 
changed: <b>HOSTNAME</b>, <b>IP_ADDRESS</b>,
 
<b>OSTEMPLATE</b>, <b>VE_ROOT</b>, and
 
<b>VE_PRIVATE</b>.</p>
 
  
<p style="margin-left:11%;"><b>--applyconfig_map</b>
+
<p style="margin-left:11%;"><b>--diskspace</b>
<i>group</i></p>
+
<i>num</i>[:<i>num</i>]</p>
  
<p style="margin-left:22%;">Apply container config
+
<p style="margin-left:22%;">For <b>simfs</b> layout, sets
parameters selected by <i>group</i>. Now the only possible
+
soft and hard disk quota limits. First parameter is soft
value for <i>group</i> is <b>name</b>: to restore container
+
limit, second is hard limit.</p>
name based on <b>NAME</b> variable in container
 
configuration file.</p>
 
  
==== I/O priority management ====
+
<p style="margin-left:22%; margin-top: 1em">For
 +
<b>ploop</b> layout, initiates the procedure of resizing the
 +
ploop image file to the new size. Since there is no
 +
soft/hard limit concept in ploop, second <i>num</i>, if
 +
specified, is ignored.</p>
  
<p style="margin-left:11%;"><b>--ioprio</b>
+
<p style="margin-left:22%; margin-top: 1em">By default,
<i>priority</i></p>
+
ploop resize is done online, i.e. on a mounted ploop. This
 +
is a preferred way of doing resize. Although, in a rare case
 +
a container was using lots of disk space and should now be
 +
resized to a much smaller size, an offline resize might be
 +
more appropriate. In this case, make sure the container is
 +
stopped and unmounted and use additional
 +
<b>--offline-resize</b> option</p>
  
<p style="margin-left:22%;">Assigns I/O priority to
+
<p style="margin-left:22%; margin-top: 1em">Note that ploop
container. <i>Priority</i> range is <b>0-7</b>. The greater
+
resize is NOT performed on container start, so for
<i>priority</i> is, the more time for I/O activity container
+
consistency <b>--diskspace</b> must be used together with
has. By default each container has <i>priority</i> of
+
<b>--save</b> flag.</p>
<b>4</b>.</p>
 
  
=== Checkpointing and restore ===
+
<p style="margin-left:22%; margin-top: 1em">Suffixes
 +
<b>G</b>, <b>M</b>, <b>K</b> can also be specified (see
 +
<b>Resource limits</b> section for more info on suffixes).
 +
If suffix is not specified, value is in kilobytes.</p>
  
<p style="margin-top: 1em">Checkpointing is a feature of
+
<p style="margin-left:11%;"><b>--diskinodes</b>
OpenVZ kernel which allows to save a complete state of a
+
<i>num</i>[:<i>num</i>]</p>
running container, and to restore it later.</p>
 
  
<p style="margin-left:11%;"><b>chkpnt</b> <i>CTID</i>
+
<p style="margin-left:22%;">sets soft and hard disk quota
[<b>--dumpfile</b> <i>name</i>]</p>
+
limits, in i-nodes. First parameter is soft limit, second is
 +
hard limit.</p>
  
<p style="margin-left:17%;">This command saves a complete
+
<p style="margin-left:22%; margin-top: 1em">Note that this
state of a running container to a dump file, and stops the
+
parameter is ignored for <b>ploop</b> layout.</p>
container. If an option <b>--dumpfile</b> is not set,
 
default dump file name <b>/vz/dump/Dump.</b><i>CTID</i> is
 
used.</p>
 
  
<p style="margin-left:11%;"><b>restore</b> <i>CTID</i>
+
<p style="margin-left:11%;"><b>--quotatime</b>
[<b>--dumpfile</b> <i>name</i>]</p>
+
<i>seconds</i></p>
  
<p style="margin-left:17%;">This command restores a
+
<p style="margin-left:22%;">sets quota grace period.
container from the dump file created by the <b>chkpnt</b>
+
Container is permitted to exceed its soft limits for the
command.</p>
+
grace period, but once it has expired, the soft limit is
 +
enforced as a hard limit.</p>
  
=== Snapshotting ===
+
<p style="margin-left:22%; margin-top: 1em">Note that this
 +
parameter is ignored for <b>ploop</b> layout.</p>
  
<p style="margin-top: 1em">Snapshotting is a feature based
+
<p style="margin-left:11%;"><b>--quotaugidlimit</b>
on checkpointing and ploop shapshots. It allows to save a
+
<i>num</i></p>
complete state of container file system. Plus, if the
 
container is running, it&rsquo;s in-memory state (as in
 
checkpointing). Note that snapshot functionality is only
 
working for containers on ploop device.</p>
 
  
<p style="margin-left:11%;"><b>snapshot</b> |
+
<p style="margin-left:22%;">Enables or disables
<b>snapshot-create</b> <i>CTID</i> [<b>--id</b>
+
in-container per-user and per-group disk quotas. If the
<i>uuid</i>]</p>
+
value is set to <b>0</b> or not set, disk quotas inside the
 +
container is disabled and not accounted.</p>
  
<p style="margin-left:17%;">Creates a container snapshot.
+
<p style="margin-left:22%; margin-top: 1em">For
If <i>uuid</i> is not specified, it is auto-generated. If a
+
<b>simfs</b> layout containers, non-zero value sets maximum
container is running, it&rsquo;s checkpointed and then
+
number of user/group IDs for which disk quota is
restored. If a container is not running, only file system
+
accounted.</p>
state is saved.</p>
 
  
<p style="margin-left:11%;"><b>snapshot-switch</b>
+
<p style="margin-left:22%; margin-top: 1em">For
<i>CTID</i> <b>--id</b> <i>uuid</i></p>
+
<b>ploop</b> layout containers, any non-zero value enables
 +
disk quota inside the container; the number of user/group
 +
IDs used by disk quota is not limited by OpenVZ.</p>
  
<p style="margin-left:17%;">Switches the container to a
+
<p style="margin-left:22%; margin-top: 1em">Note that
snapshot identified by <i>uuid</i>. Note that the current
+
enabling or disabling in-container disk quotas requires
container state and its file system state is lost! If given
+
container restart, so consider using <b>--setmode</b>
snapshot contains CT memory dump, it is restored, otherwise
+
option.</p>
it is stopped.</p>
 
  
<p style="margin-left:11%;"><b>snapshot-delete</b>
+
==== Capability option ====
<i>CTID</i> <b>--id</b> <i>uuid</i></p>
 
  
<p style="margin-left:17%;">Removes a specified
+
<p style="margin-left:11%;"><b>--capability</b>
snapshot.</p>
+
<i>capname</i>:<b>on</b>|<b>off</b>[<b>,</b>...]</p>
  
<p style="margin-left:11%;"><b>snapshot-list</b>
+
<p style="margin-left:22%;">Sets a capability for a
<i>CTID</i></p>
+
container. Multiple comma-separated capabilities can be
 +
specified.</p>
  
<p style="margin-left:17%;">Lists all snapshots. Active
+
<p style="margin-left:22%; margin-top: 1em">Note that
snapshot is marked with <b>*</b> sign.</p>
+
setting a capability when the container is running does not
 +
take immediate effect; restart the container in order for
 +
the changes to take effect (consider using <b>--setmode</b>
 +
option).</p>
  
=== Performing container actions ===
+
<p style="margin-left:22%; margin-top: 1em">A container has
 +
the default set of capabilities, thus any operation on
 +
capabilities is &quot;logical AND&quot; with the default
 +
capability mask.</p>
  
<table width="100%" border="0" rules="none" frame="void"
+
<p style="margin-left:22%; margin-top: 1em">You can use the
      cellspacing="0" cellpadding="0">
+
following values for <i>capname</i>: <b>chown</b>,
<tr valign="top" align="left">
+
<b>dac_override</b>, <b>dac_read_search</b>, <b>fowner</b>,
<td width="11%"></td>
+
<b>fsetid</b>, <b>kill</b>, <b>setgid</b>, <b>setuid</b>,
<td width="9%">
+
<b>setpcap</b>, <b>linux_immutable</b>,
 +
<b>net_bind_service</b>, <b>net_broadcast</b>,
 +
<b>net_admin</b>, <b>net_raw</b>, <b>ipc_lock</b>,
 +
<b>ipc_owner</b>, <b>sys_module</b>, <b>sys_rawio</b>,
 +
<b>sys_chroot</b>, <b>sys_ptrace</b>, <b>sys_pacct</b>,
 +
<b>sys_admin</b>, <b>sys_boot</b>, <b>sys_nice</b>,
 +
<b>sys_resource</b>, <b>sys_time</b>, <b>sys_tty_config</b>,
 +
<b>mknod</b>, <b>lease</b>, <b>setveid</b>, <b>ve_admin</b>.
 +
For detailed description, see <b>capabilities</b>(7).</p>
  
<p style="margin-top: 1em"><b>create</b></p></td>
+
<p style="margin-left:22%; margin-top: 1em"><b>WARNING</b>:
<td width="2%"></td>
+
setting some of those capabilities may have far reaching
<td width="78%">
+
security implications, so do not do it unless you know what
 +
you are doing. Also note that setting <b>setpcap:on</b> for
 +
a container will most probably lead to inability to start
 +
it.</p>
  
<p style="margin-top: 1em"><i>CTID</i>
+
==== Device access management ====
[<b>--ostemplate&nbsp;</b><i>name</i>]
 
[<b>--config&nbsp;</b><i>name</i>]
 
[<b>--layout&nbsp;simfs</b>|<b>ploop</b>[<b>:</b>{<b>expanded</b>|<b>plain</b>|<b>raw</b>}]]
 
[<b>--diskspace&nbsp;</b><i>kbytes</i>]
 
[<b>--private&nbsp;</b><i>path</i>]
 
[<b>--root&nbsp;</b><i>path</i>]
 
[<b>--ipadd&nbsp;</b><i>addr</i>]
 
[<b>--hostname&nbsp;</b><i>name</i>]
 
[<b>--name&nbsp;</b><i>name</i>]</p> </td></tr>
 
</table>
 
  
<p style="margin-left:17%; margin-top: 1em">Creates a new
+
<p style="margin-left:11%;"><b>--devnodes</b>
container area. This operation should be done once, before
+
<i>device</i>:[<b>r</b>][<b>w</b>][<b>q</b>]|<b>none</b></p>
the first start of the container.</p>
 
  
<p style="margin-left:17%; margin-top: 1em">By default, an
+
<p style="margin-left:22%;">Give the container an access
OS template denoted by <b>DEF_OSTEMPLATE</b> parameter of
+
(<b>r</b> - read, <b>w</b> - write, <b>q</b> - disk quota
[[Man/vz.conf.5|<b>vz.conf</b>(5)]] is used to create a container. This can be
+
management, <b>none</b> - no access) to a device designated
overwritten by <b>--ostemplate</b> option.</p>
+
by the special file /dev/<i>device</i>. Device file is
 +
created in a container by <b>vzctl</b>. Example:</p>
  
<p style="margin-left:17%; margin-top: 1em">By default, a
+
<pre style="margin-left:22%;">  vzctl set 777 --devnodes sdb:rwq</pre>
new container configuration file is created from a sample
 
configuration denoted by value of <b>CONFIGFILE</b>
 
parameter of [[Man/vz.conf.5|<b>vz.conf</b>(5)]]. If the container
 
configuration file already exists, it will not be
 
modified.</p>
 
  
<p style="margin-left:17%; margin-top: 1em">The value of
+
<p style="margin-left:11%;"><b>--devices
<b>CONFIGFILE</b> can be overwritten by using the
+
b</b>|<b>c</b>:<i>major</i>:<i>minor</i>|<b>all</b>:[<b>r</b>][<b>w</b>][<b>q</b>]|<b>none</b></p>
<b>--config</b> <i>name</i> option. This option can not be
 
used if the container configuration file already exists.</p>
 
  
<p style="margin-left:17%; margin-top: 1em">A new container
+
<p style="margin-left:22%;">Give the container an access to
can either be created using <b>simfs</b> filesystem or on a
+
a <b>b</b>lock or <b>c</b>haracter device designated by its
<b>ploop</b> device. The default is set by value of
+
<i>major</i> and <i>minor</i> numbers. Device file have to
<b>VE_LAYOUT</b> parameter of [[Man/vz.conf.5|<b>vz.conf</b>(5)]] and can be
+
be created manually.</p>
overwritten by <b>--layout</b> option. In case <b>ploop</b>
 
is used, one can additionally specify ploop disk image
 
format after a colon. Possible ploop formats are
 
<b>expanded</b>, <b>plain</b> and <b>raw</b>. Default is
 
<b>expanded</b>. Using <b>raw</b> is not recommended and is
 
not supported.</p>
 
  
<p style="margin-left:17%; margin-top: 1em">You can use
+
==== PCI device management ====
<b>--diskspace</b> option to specify container file system
 
size. Suffixes <b>G</b>, <b>M</b>, <b>K</b> can also be
 
specified (see <b>Resource limits</b> section for more info
 
on suffixes).</p>
 
  
<p style="margin-left:17%; margin-top: 1em">You can use
+
<p style="margin-left:11%;"><b>--pci_add</b>
<b>--root</b> <i>path</i> option to sets the path to the
+
[<i>domain</i>:]<i>bus</i>:<i>slot</i>.<i>func</i></p>
mount point for the container root directory (default is
 
<b>VE_ROOT</b> specified in [[Man/vz.conf.5|<b>vz.conf</b>(5)]] file).
 
Argument can contain literal string <b>$VEID</b>, which will
 
be substituted with the numeric CT ID.</p>
 
  
<p style="margin-left:17%; margin-top: 1em">You can use
+
<p style="margin-left:22%;">Give the container an access to
<b>--private</b> <i>path</i> option to set the path to
+
a specified PCI device. All numbers are hexadecimal (as
directory in which all the files and directories specific to
+
printed by <b>lspci</b>(8) in the first column).</p>
this very container are stored (default is <b>VE_PRIVATE</b>
 
specified in [[Man/vz.conf.5|<b>vz.conf</b>(5)]] file). Argument can contain
 
literal string <b>$VEID</b>, which will be substituted with
 
the numeric CT ID.</p>
 
  
<p style="margin-left:17%; margin-top: 1em">You can use
+
<p style="margin-left:11%;"><b>--pci_del</b>
<b>--ipadd</b> <i>addr</i> option to assign an IP address to
+
[<i>domain</i>:]<i>bus</i>:<i>slot</i>.<i>func</i></p>
a container. Note that this option can be used multiple
 
times.</p>
 
  
<p style="margin-left:17%; margin-top: 1em">You can use
+
<p style="margin-left:22%;">Delete a PCI device from the
<b>--hostname</b> <i>name</i> option to set a host name for
+
container.</p>
a container.</p>
 
  
<p style="margin-left:11%;"><b>destroy</b> | <b>delete</b>
+
<p style="margin-left:22%; margin-top: 1em">Note that
<i>CTID</i></p>
+
<b>vps-pci</b> configuration script is executed by
 +
<b>vzctl</b> then configuring PCI devices. The script is
 +
usually located at <b>/usr/libexec/vzctl/scripts/</b>.</p>
  
<p style="margin-left:17%;">Removes a container private
+
==== Features management ====
area by deleting all files, directories and the
 
configuration file of this container.</p>
 
  
<p style="margin-left:11%;"><b>start</b> <i>CTID</i>
+
<p style="margin-left:11%;"><b>--features</b>
[<b>--wait</b>] [<b>--force</b>]</p>
+
<i>name</i>:<b>on</b>|<b>off</b>[<b>,</b>...]</p>
  
<p style="margin-left:17%;">Mounts (if necessary) and
+
<p style="margin-left:22%;">Enable or disable a specific
starts a container. Unless <b>--wait</b> option is
+
container feature. Known features are: <b>sysfs</b>,
specified, <b>vzctl</b> will return immediately; otherwise
+
<b>nfs</b>, <b>sit</b>, <b>ipip</b>, <b>ppp</b>,
an attempt to wait till the default runlevel is reached will
+
<b>ipgre</b>, <b>bridge</b>, <b>nfsd</b>. A few features can
be made by <b>vzctl</b>.</p>
+
be specified at once, comma-separated.</p>
  
<p style="margin-left:17%; margin-top: 1em">Specify
+
==== Apply config ====
<b>--force</b> if you want to start a container which is
 
disabled (see <b>--disabled</b>).</p>
 
  
<p style="margin-left:17%; margin-top: 1em">Note that this
+
<p style="margin-left:11%;"><b>--applyconfig</b>
command can lead to execution of <b>premount</b>,
+
<i>name</i></p>
<b>mount</b> and <b>start</b> action scripts (see <b>ACTION
 
SCRIPTS</b> below).</p>
 
  
<p style="margin-left:11%;"><b>stop</b> <i>CTID</i>
+
<p style="margin-left:22%;">Read container parameters from
[<b>--fast</b>]</p>
+
the container sample configuration file
 +
<tt>/etc/vz/conf/ve-</tt><i>name</i><tt>.conf-sample</tt>,
 +
and apply them, if <b>--save</b> option specified save to
 +
the container config file. The following parameters are not
 +
changed: <b>HOSTNAME</b>, <b>IP_ADDRESS</b>,
 +
<b>OSTEMPLATE</b>, <b>VE_ROOT</b>, and
 +
<b>VE_PRIVATE</b>.</p>
  
<p style="margin-left:17%;">Stops and unmounts a container.
+
<p style="margin-left:11%;"><b>--applyconfig_map</b>
Normally, <b>halt</b>(8) is executed inside a container;
+
<i>group</i></p>
option <b>--fast</b> makes <b>vzctl</b> use <b>reboot</b>(2)
 
syscall instead which is faster but can lead to unclean
 
container shutdown.</p>
 
  
<p style="margin-left:17%; margin-top: 1em">Note that this
+
<p style="margin-left:22%;">Apply container config
command can lead to execution of <b>stop</b>, <b>umount</b>
+
parameters selected by <i>group</i>. Now the only possible
and <b>postumount</b> action scripts (see <b>ACTION
+
value for <i>group</i> is <b>name</b>: to restore container
SCRIPTS</b> below).</p>
+
name based on <b>NAME</b> variable in container
 +
configuration file.</p>
  
<p style="margin-left:11%;"><b>restart</b> <i>CTID</i>
+
==== I/O scheduling ====
[<b>--wait</b>] [<b>--force</b>] [<b>--fast</b>]</p>
 
  
<p style="margin-left:17%;">Restarts a container, i.e.
+
<p style="margin-left:11%;"><b>--ioprio</b>
stops it if it is running, and starts again. Accepts all the
+
<i>priority</i></p>
<b>start</b> and <b>stop</b> options.</p>
 
  
<p style="margin-left:17%; margin-top: 1em">Note that this
+
<p style="margin-left:22%;">Assigns disk I/O priority to
command can lead to execution of some action scripts (see
+
container. <i>Priority</i> range is <b>0-7</b>. The greater
<b>ACTION SCRIPTS</b> below).</p>
+
<i>priority</i> is, the more time for I/O activity container
 +
has. By default each container has <i>priority</i> of
 +
<b>4</b>.</p>
  
<p style="margin-left:11%;"><b>status</b> <i>CTID</i></p>
+
<p style="margin-left:11%;"><b>--iolimit</b>
 +
<i>limit</i>[<b>B</b>|<b>K</b>|<b>M</b>|<b>G</b>]</p>
  
<p style="margin-left:17%;">Shows a container status. This
+
<p style="margin-left:22%;">Assigns disk I/O bandwidth
is a line with five or six words, separated by spaces.</p>
+
limit for a container. Value is either a number with an
 +
optional suffix, or a literal string <b>unlimited</b>. Value
 +
of <b>0</b> means &quot;unlimited&quot;. By default a
 +
container has no I/O limit. Maximum allowed limit is 2
 +
gigabytes per second; values exceeding the limit are
 +
truncated.</p>
  
<p style="margin-left:17%; margin-top: 1em">First word is
+
<p style="margin-left:22%; margin-top: 1em">If no suffix is
literally <b>CTID</b>.</p>
+
provided, the <i>limit</i> is assumed to be in megabytes per
 +
second. Available suffixes are: <br>
 +
&bull; <b>b</b>, <b>B</b> -- bytes per second; <br>
 +
&bull; <b>k</b>, <b>K</b> -- kilobytes per second; <br>
 +
&bull; <b>m</b>, <b>M</b> -- megabytes per second (default);
 +
<br>
 +
&bull; <b>g</b>, <b>G</b> -- gigabytes per second;</p>
  
<p style="margin-left:17%; margin-top: 1em">Second word is
+
<p style="margin-left:11%;"><b>--iopslimit</b>
the numeric <i>CT ID</i>.</p>
+
<i>iops</i></p>
  
<p style="margin-left:17%; margin-top: 1em">Third word is
+
<p style="margin-left:22%;">Assigns IOPS limit for a
showing whether this container exists or not, it can be
+
container, in number of input/output operations per second.
either <b>exist</b> or <b>deleted</b>.</p>
+
Value is a number or a literal string <b>unlimited</b>.
 +
Value of <b>0</b> means &quot;unlimited&quot;. By default a
 +
container has no IOPS limit.</p>
  
<p style="margin-left:17%; margin-top: 1em">Fourth word is
+
=== Suspending and resuming ===
showing the status of the container filesystem, it can be
 
either <b>mounted</b> or <b>unmounted</b>.</p>
 
  
<p style="margin-left:17%; margin-top: 1em">Fifth word
+
<p style="margin-top: 1em">Checkpointing is a feature of
shows if the container is running, it can be either
+
OpenVZ kernel which allows to save a complete in-kernel
<b>running</b> or <b>down</b>.</p>
+
state of a running container, and to restore it later.</p>
 +
 
 +
<p style="margin-left:11%;"><b>suspend</b>|<b>chkpnt</b>
 +
<i>CTID</i> [<b>--dumpfile</b> <i>name</i>]</p>
 +
 
 +
<p style="margin-left:17%;">This command suspends a
 +
container to a dump file If an option <b>--dumpfile</b> is
 +
not set, default dump file name
 +
<b>/vz/dump/Dump.</b><i>CTID</i> is used.</p>
  
<p style="margin-left:17%; margin-top: 1em">Sixth word, if
+
<p style="margin-left:11%;"><b>resume</b>|<b>restore</b>
exists, is <b>suspended</b>. It appears if both a container
+
<i>CTID</i> [<b>--dumpfile</b> <i>name</i>]</p>
and its dump file exist (see <b>chkpnt</b>).</p>
 
  
<p style="margin-left:17%; margin-top: 1em">This command
+
<p style="margin-left:17%;">This command restores a
can also be usable from scripts.</p>
+
container from the dump file created by the <b>suspend</b>
 +
command.</p>
  
<p style="margin-left:11%;"><b>mount</b> <i>CTID</i></p>
+
=== Snapshotting ===
  
<p style="margin-left:17%;">Mounts container private area.
+
<p style="margin-top: 1em">Snapshotting is a feature based
Note that this command can lead to execution of
+
on checkpointing and ploop shapshots. It allows to save a
<b>premount</b> and <b>mount</b> action scripts (see
+
complete state of container file system. Plus, if the
<b>ACTION SCRIPTS</b> below).</p>
+
container is running, it&rsquo;s in-memory state (as in
 +
checkpointing). Note that snapshot functionality is only
 +
working for containers on ploop device.</p>
  
<p style="margin-left:11%;"><b>umount</b> <i>CTID</i></p>
+
<p style="margin-left:11%;"><b>snapshot</b> <i>CTID</i>
 +
[<b>--id</b> <i>uuid</i>] [<b>--name</b> <i>name</i>]
 +
[<b>--description</b> <i>desc</i>] <br>
 +
[<b>--skip-suspend</b>] [<b>--skip-config</b>]</p>
  
<p style="margin-left:17%;">Unmounts container private
+
<p style="margin-left:17%;">Creates a container snapshot,
area. Note that this command can lead to execution of
+
i.e. saves the current container state, including its file
<b>umount</b> and <b>postumount</b> action scripts (see
+
system state, running processes state, and configuration
<b>ACTION SCRIPTS</b> below).</p>
+
file.</p>
  
<p style="margin-left:17%; margin-top: 1em">Note that
+
<p style="margin-left:17%; margin-top: 1em">If a container
<b>stop</b> does <b>umount</b> automatically.</p>
+
is running, and <b>--skip-suspend</b> option is not
 +
specified, a container is checkpointed and then restored,
 +
and CT memory dump becomes the part of snapshot.</p>
  
<p style="margin-left:11%;"><b>convert</b> <i>CTID</i>
+
<p style="margin-left:17%; margin-top: 1em">Unless
[<b>--layout
+
<b>--skip-config</b> option is given, container
ploop</b>[<b>:</b>{<b>expanded</b>|<b>plain</b>|<b>raw</b>}]]</p>
+
configuration file is saved to the snapshot.</p>
  
<p style="margin-left:17%;">Convert CT private area to
+
<p style="margin-left:17%; margin-top: 1em">If <i>uuid</i>
reside on a ploop device (available in kernel version
+
is not specified, it is auto-generated. Options
042stab052.8 and greater). Conversion should be performed
+
<b>--name</b> and <b>--description</b> can be used to
when a container is stopped, plus disk space quota should be
+
specify the snapshot name and description, respectively.
set.</p>
+
Name is displayed by <b>snapshot-list</b>.</p>
 +
 
 +
<p style="margin-left:11%;"><b>snapshot-switch</b>
 +
<i>CTID</i> [<b>--skip-resume</b> | <b>--must-resume</b>]
 +
[<b>--skip-config</b>] <b><br>
 +
--id</b> <i>uuid</i></p>
  
<p style="margin-left:11%;"><b>quotaon</b> <i>CTID</i></p>
+
<p style="margin-left:17%;">Switches the container to a
 +
snapshot identified by <i>uuid</i>, restoring its file
 +
system state, configuration (if available) and its running
 +
state (if available).</p>
  
<p style="margin-left:17%;">Turn disk quota on. Not that
+
<p style="margin-left:17%; margin-top: 1em"><b>Note that
<b>mount</b> and <b>start</b> does that automatically.</p>
+
the current state of a container (including its file system
 +
state and its configuration file) is lost!</b></p>
  
<p style="margin-left:11%;"><b>quotaoff</b> <i>CTID</i></p>
+
<p style="margin-left:17%; margin-top: 1em">Option
 +
<b>--skip-resume</b> is used to ignore a CT memory dump file
 +
in a snapshot, as a result the container will end up being
 +
in a stopped state (same as if a snapshot has been taken
 +
with <b>--skip-suspend</b>).</p>
  
<p style="margin-left:17%;">Turn disk quota off. Not that
+
<p style="margin-left:17%; margin-top: 1em">If option
<b>umount</b> and <b>stop</b> does that automatically.</p>
+
<b>--must-resume</b> is set, absense of a memory dump is
 +
treated as an error, and the inability to restore from the
 +
memory dump is treated as an error rather than warning.</p>
  
<p style="margin-left:11%;"><b>quotainit</b>
+
<p style="margin-left:17%; margin-top: 1em">Option option
<i>CTID</i></p>
+
<b>--skip-config</b> is used to ignore the CT configuration
 +
file in a snapshot, i.e. the current configuration file will
 +
be left as is.</p>
  
<p style="margin-left:17%;">Initialize disk quota (i.e. run
+
<p style="margin-left:11%;"><b>snapshot-delete</b>
<b>vzquota init</b>) with the parameters taken from the CT
+
<i>CTID</i> <b>--id</b> <i>uuid</i></p>
configuration file [[Man/ctid.conf.5|<b>ctid.conf</b>(5)]].</p>
 
  
<p style="margin-left:11%;"><b>exec</b> <i>CTID
+
<p style="margin-left:17%;">Removes a specified
command</i></p>
+
snapshot.</p>
  
<p style="margin-left:17%;">Executes <i>command</i> in a
+
<p style="margin-left:11%;"><b>snapshot-mount</b>
container. Environment variables are not set inside the
+
<i>CTID</i> <b>--id</b> <i>uuid</i> <b>--target</b>
container. Signal handlers may differ from default settings.
+
<i>directory</i></p>
If <i>command</i> is <b>-</b>, commands are read from
 
stdin.</p>
 
  
<p style="margin-left:11%;"><b>exec2</b> <i>CTID
+
<p style="margin-left:17%;">Mounts a snapshot specified by
command</i></p>
+
<i>uuid</i> to a <i>directory</i>. Note this mount is
 +
read-only.</p>
  
<p style="margin-left:17%;">The same as <b>exec</b>, but
+
<p style="margin-left:11%;"><b>snapshot-umount</b>
return code is that of <i>command</i>.</p>
+
<i>CTID</i> <b>--id</b> <i>uuid</i></p>
  
<p style="margin-left:11%;"><b>runscript</b> <i>CTID
+
<p style="margin-left:17%;">Unmounts a specified
script</i></p>
+
snapshot.</p>
  
<p style="margin-left:17%;">Run specified shell script in
+
<p style="margin-left:11%;"><b>snapshot-list</b>
the container. Argument <i>script</i> is a file on the host
+
<i>CTID</i> [<b>-H</b>] [<b>-o</b>
system which contents is read by vzctl and executed in the
+
<i>field</i>[,<i>field</i>...] [<b>--id</b> <i>uuid</i>]</p>
context of the container. For a running container, the
 
command jumps into the container and executes the script.
 
For a stopped container, it enters the container, mounts
 
container&rsquo;s root filesystem, executes the script, and
 
unmounts CT root. In the latter case, the container is not
 
really started, no file systems other than root (such as
 
<b>/proc</b>) are mounted, no startup scripts are executed
 
etc. Thus the environment in which the script is running is
 
far from normal and is only usable for very basic
 
operations.</p>
 
  
<p style="margin-left:11%;"><b>enter</b> <i>CTID</i>
+
<p style="margin-left:17%;">List container&rsquo;s
[<b>--exec</b> <i>command</i> [<i>arg</i> ...]]</p>
+
snapshots.</p>
  
<p style="margin-left:17%;">Enters into a container (giving
+
<p style="margin-left:17%; margin-top: 1em">You can
a container&rsquo;s root shell). This option is a back-door
+
suppress displaying header using <b>-H</b> option.</p>
for host root only. The proper way to have CT root shell is
 
to use <b>ssh</b>(1).</p>
 
  
<p style="margin-left:17%; margin-top: 1em">Option
+
<p style="margin-left:17%; margin-top: 1em">You can use the
<b>--exec</b> is used to run <i>command</i> with arguments
+
<b>-o</b> option to display only the specified
after entering into container. This is useful if command to
+
<i>field</i>(s). List of available fields can be obtained
be run requires a terminal (so <b>vzctl exec</b> can not be
+
using <b>-L</b> option.</p>
used) and for some reason you can not use <b>ssh</b>(1).</p>
 
  
<p style="margin-left:17%; margin-top: 1em">You need to log
+
=== Performing container actions ===
out manually from the shell to finish session (even if you
 
specified <b>--exec</b>).</p>
 
  
<p style="margin-left:11%;"><b>console</b> <i>CTID</i></p>
+
<table width="100%" border="0" rules="none" frame="void"
 +
      cellspacing="0" cellpadding="0">
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="9%">
  
<p style="margin-left:17%;">Attach to the container&rsquo;s
+
<p style="margin-top: 1em"><b>create</b></p></td>
console. Note that the console is persistent, meaning it can
+
<td width="2%"></td>
be attached to even if the container is not running, and
+
<td width="78%">
there is no automatic detachment when the container is
 
stopped.</p>
 
  
<p style="margin-left:17%; margin-top: 1em">Type <b>Esc</b>
+
<p style="margin-top: 1em"><i>CTID</i>
then <b>.</b> to detach from the console. Type <b>Esc</b>
+
[<b>--ostemplate&nbsp;</b><i>name</i>]
then <b>,</b> to detach without killing anything. Note that
+
[<b>--config&nbsp;</b><i>name</i>]
these sequences are only recognized after <b>Enter</b>.</p>
+
[<b>--layout&nbsp;simfs</b>|<b>ploop</b>[<b>:</b>{<b>expanded</b>|<b>plain</b>|<b>raw</b>}]]
 +
[<b>--diskspace&nbsp;</b><i>kbytes</i>]
 +
[<b>--diskinodes&nbsp;</b><i>num</i>]
 +
[<b>--private&nbsp;</b><i>path</i>]
 +
[<b>--root&nbsp;</b><i>path</i>]
 +
[<b>--ipadd&nbsp;</b><i>addr</i>]
 +
[<b>--hostname&nbsp;</b><i>name</i>]
 +
[<b>--name&nbsp;</b><i>name</i>]
 +
[<b>--local_uid&nbsp;</b><i>uid</i>]
 +
[<b>--local_gid&nbsp;</b><i>gid</i>]</p> </td></tr>
 +
</table>
  
=== Other options ===
+
<p style="margin-left:17%; margin-top: 1em">Creates a new
 +
container area. This operation should be done once, before
 +
the first start of the container.</p>
  
<p style="margin-left:11%;"><b>--help</b></p>
+
<p style="margin-left:17%; margin-top: 1em">By default, an
 
+
OS template denoted by <b>DEF_OSTEMPLATE</b> parameter of
<p style="margin-left:17%;">Prints help message with a
+
[[Man/vz.conf.5|<b>vz.conf</b>(5)]] is used to create a container. This can be
brief list of possible options.</p>
+
overwritten by <b>--ostemplate</b> option.</p>
 +
 
 +
<p style="margin-left:17%; margin-top: 1em">By default, a
 +
new container configuration file is created from a sample
 +
configuration denoted by value of <b>CONFIGFILE</b>
 +
parameter of [[Man/vz.conf.5|<b>vz.conf</b>(5)]]. If the container
 +
configuration file already exists, it will not be
 +
modified.</p>
 +
 
 +
<p style="margin-left:17%; margin-top: 1em">The value of
 +
<b>CONFIGFILE</b> can be overwritten by using the
 +
<b>--config</b> <i>name</i> option. This option can not be
 +
used if the container configuration file already exists.</p>
  
<p style="margin-left:11%;"><b>--version</b></p>
+
<p style="margin-left:17%; margin-top: 1em">A new container
 +
can either be created using <b>simfs</b> filesystem or on a
 +
<b>ploop</b> device. The default is set by value of
 +
<b>VE_LAYOUT</b> parameter of [[Man/vz.conf.5|<b>vz.conf</b>(5)]] and can be
 +
overwritten by <b>--layout</b> option. In case <b>ploop</b>
 +
is used, one can additionally specify ploop disk image
 +
format after a colon. Possible ploop formats are
 +
<b>expanded</b>, <b>plain</b> and <b>raw</b>. Default is
 +
<b>expanded</b>. Using value other than <b>expanded</b> is
 +
not recommended and is currently not supported.</p>
  
<p style="margin-left:17%;">Prints <b>vzctl</b>
+
<p style="margin-left:17%; margin-top: 1em">You can use
version.</p>
+
<b>--diskspace</b> and <b>--diskinodes</b> options to
 +
specify container file system size. Note that for
 +
<b>ploop</b> layout, you will not be able to change inodes
 +
value later.</p>
  
== ACTION SCRIPTS ==
+
<p style="margin-left:17%; margin-top: 1em">If
 +
<b>DISKSPACE</b> is not specified either in the sample
 +
configuration file used for creation or in global
 +
configuration file [[Man/vz.conf.5|<b>vz.conf</b>(5)]], <b>--diskspace</b>
 +
parameter is required for <b>ploop</b> layout.</p>
  
<p style="margin-left:11%; margin-top: 1em"><b>vzctl</b>
+
<p style="margin-left:17%; margin-top: 1em">Suffixes
has an ability to execute user-defined scripts when a
+
<b>G</b>, <b>M</b>, <b>K</b> can also be specified (see
specific <b>vzctl</b> command is run for a container. The
+
<b>Resource limits</b> section for more info on
following <b>vzctl</b> commands can trigger execution of
+
suffixes).</p>
action scripts: <b>start</b>, <b>stop</b>, <b>restart</b>,
 
<b>mount</b> and <b>umount</b>.</p>
 
  
<p style="margin-left:11%; margin-top: 1em">Action scripts
+
<p style="margin-left:17%; margin-top: 1em">You can use
are located in the <b>/etc/vz/conf/</b> directory. There are
+
<b>--root</b> <i>path</i> option to sets the path to the
global and per-CT scripts. Global scripts have a literal
+
mount point for the container root directory (default is
prefix of <b>vps.</b> and are executed for all containers.
+
<b>VE_ROOT</b> specified in [[Man/vz.conf.5|<b>vz.conf</b>(5)]] file).
Per-CT scripts have a <i>CTID</i> numeric prefix and are
+
Argument can contain literal string <b>$VEID</b>, which will
executed for the given container only.</p>
+
be substituted with the numeric CT ID.</p>
  
<p style="margin-left:11%; margin-top: 1em">Please note
+
<p style="margin-left:17%; margin-top: 1em">You can use
scripts are executed in a host system (CT0) context, with
+
<b>--private</b> <i>path</i> option to set the path to
the exception of <b>.start</b> and <b>.stop</b> scripts,
+
directory in which all the files and directories specific to
which are executed in a container context.</p>
+
this very container are stored (default is <b>VE_PRIVATE</b>
 +
specified in [[Man/vz.conf.5|<b>vz.conf</b>(5)]] file). Argument can contain
 +
literal string <b>$VEID</b>, which will be substituted with
 +
the numeric CT ID.</p>
  
<p style="margin-left:11%; margin-top: 1em">The following
+
<p style="margin-left:17%; margin-top: 1em">You can use
action scripts are currently defined: <b><br>
+
<b>--ipadd</b> <i>addr</i> option to assign an IP address to
vps.premount</b>, <i>CTID</i><b>.premount</b></p>
+
a container. Note that this option can be used multiple
 +
times.</p>
  
<p style="margin-left:22%;">Global and per-CT mount scripts
+
<p style="margin-left:17%; margin-top: 1em">You can use
which are executed for a container before it is mounted.
+
<b>--hostname</b> <i>name</i> option to set a host name for
Scripts are executed in the host system context, while a CT
+
a container.</p>
is not yet mounted or running. Global script, if exists, is
 
executed first.</p>
 
  
<p style="margin-left:11%;"><b>vps.mount</b>,
+
<p style="margin-left:17%; margin-top: 1em">When running
<i>CTID</i><b>.mount</b></p>
+
with an upstream Linux Kernel that supports user namespaces
 +
(&gt;= 3.8), the parameters <b>--local_uid</b> and
 +
<b>--local_gid</b> can be used to select which <i>uid</i>
 +
and <i>gid</i> respectively will be used as a base user in
 +
the host system. Note that user namespaces provide a 1:1
 +
mapping between container users and host users. If these
 +
options are not specified, the values <b>LOCAL_UID</b> and
 +
<b>LOCAL_GID</b> from global configuration file
 +
[[Man/vz.conf.5|<b>vz.conf</b>(5)]] are used. An explicit <b>--local_uid</b>
 +
value of 0 will disable user namespace support, and run the
 +
container as a privileged user. In this case,
 +
<b>--local_gid</b> is ignored.</p>
  
<p style="margin-left:22%;">Global and per-CT mount scripts
+
<p style="margin-left:17%; margin-top: 1em"><b>Warning:</b>
which are executed for a container right after it is
+
use <b>--local_uid</b> and <b>--local_gid</b> with care,
mounted. Otherwise they are the same as <b>.premount</b>
+
specially when migrating containers. In all situations, the
scripts.</p>
+
container&rsquo;s files in the filesystem needs to be
 +
correctly owned by the host-side users.</p>
  
<p style="margin-left:11%;"><i>CTID</i><b>.start</b></p>
+
<p style="margin-left:11%;"><b>destroy</b> | <b>delete</b>
 +
<i>CTID</i></p>
  
<p style="margin-left:22%;">Right after <b>vzctl</b> has
+
<p style="margin-left:17%;">Removes a container private
started a container, it executes this script in a container
+
area by deleting all files, directories and the
context.</p>
+
configuration file of this container.</p>
  
<p style="margin-left:11%;"><i>CTID</i><b>.stop</b></p>
+
<p style="margin-left:11%;"><b>start</b> <i>CTID</i>
 +
[<b>--wait</b>] [<b>--force</b>] [<b>--skip-fsck</b>]
 +
[<b>--skip-remount</b>]</p>
  
<p style="margin-left:22%;">Right before <b>vzctl</b> has
+
<p style="margin-left:17%;">Mounts (if necessary) and
stopped a container, it executes this script in a container
+
starts a container. Unless <b>--wait</b> option is
context.</p>
+
specified, <b>vzctl</b> will return immediately; otherwise
 +
an attempt to wait till the default runlevel is reached will
 +
be made by <b>vzctl</b>.</p>
 +
 
 +
<p style="margin-left:17%; margin-top: 1em">Specify
 +
<b>--force</b> if you want to start a container which is
 +
disabled (see <b>--disabled</b>).</p>
  
<p style="margin-left:11%;"><b>vps.umount</b>,
+
<p style="margin-left:17%; margin-top: 1em">Specify
<i>CTID</i><b>.umount</b></p>
+
<b>--skip-fsck</b> to skip fsck for ploop-based container
 +
filesystem (this option is used by vz initscript).</p>
  
<p style="margin-left:22%;">Global and per-CT umount
+
<p style="margin-left:17%; margin-top: 1em">By default, if
scripts which are executed for a container before it is
+
a container to be started happens to be already mounted, it
unmounted. Scripts are executed in the host system context,
+
is unmounted and mounted again. This behavior can be turned
while a CT is mounted. Global script, if exists, is executed
+
off by using <b>--skip-remount</b> flag.</p>
first.</p>
 
  
<p style="margin-left:11%;"><b>vps.postumount</b>,
+
<p style="margin-left:17%; margin-top: 1em">Note that this
<i>CTID</i><b>.postumount</b></p>
+
command can lead to execution of <b>premount</b>,
 +
<b>mount</b> and <b>start</b> action scripts (see <b>ACTION
 +
SCRIPTS</b> below).</p>
  
<p style="margin-left:22%;">Global and per-CT umount
+
<p style="margin-left:11%;"><b>stop</b> <i>CTID</i>
scripts which are executed for a container right after it is
+
[<b>--fast</b>] [<b>--skip-umount</b>]</p>
unmounted. Otherwise they are the same as <b>.umount</b>
 
scripts.</p>
 
  
<p style="margin-left:11%; margin-top: 1em">The environment
+
<p style="margin-left:17%;">Stops a container and unmounts
passed to all the <b>*mount</b> scripts is the standard
+
it (unless <b>--skip-umount</b> is given). Normally,
environment of the parent (i.e. <b>vzctl</b>) with two
+
<b>halt</b>(8) is executed inside a container; option
additional variables: <b>$VEID</b> and <b>$VE_CONFFILE</b>.
+
<b>--fast</b> makes <b>vzctl</b> use <b>reboot</b>(2)
The first one holds the ID of the container, and the second
+
syscall instead which is faster but can lead to unclean
one holds the full path to the container configuration file.
+
container shutdown.</p>
If the script needs to get other CT configuration
 
parameters, such as <b>$VE_ROOT</b>, it needs to get those
 
from global and per-CT configuration files.</p>
 
  
<p style="margin-left:11%; margin-top: 1em">Here is an
+
<p style="margin-left:17%; margin-top: 1em">Note that
example of a mount script, which makes host system&rsquo;s
+
<b>vzctl stop</b> is not asyncronous, in other words vzctl
/mnt/disk available to container(s). Script name can either
+
waits for container&rsquo;s init to exit (unless
be <b>/etc/vz/conf/vps.mount</b> or
+
<b>--fast</b> is given), which can take up to a few minutes.
<b>/etc/vz/conf/</b><i>CTID</i><b>.mount</b>.</p>
+
Default wait timeout is 120 seconds; it can be changed
 +
globally, by setting <b>STOP_TIMEOUT</b> in
 +
[[Man/vz.conf.5|<b>vz.conf</b>(5)]], or per container (<b>STOP_TIMEOUT</b> in
 +
[[Man/ctid.conf.5|<b>ctid.conf</b>(5)]], see <b>--stop-timeout</b>).</p>
  
<pre style="margin-left:11%; margin-top: 1em">   # If one of these files does not exist then something
+
<p style="margin-left:17%; margin-top: 1em">Note that this
  # is really broken
+
command can lead to execution of <b>stop</b>, <b>umount</b>
  [ -f /etc/sysconfig/vz ] || exit 1
+
and <b>postumount</b> action scripts (see <b>ACTION
  [ -f $VE_CONFFILE ] || exit 1
+
SCRIPTS</b> below).</p>
  # Source both files. Note the order is important.
 
  . /etc/vz/vz.conf
 
  . $VE_CONFFILE
 
  SRC=/mnt/disk
 
  DST=/mnt/disk
 
  mount -n -t simfs $SRC ${VE_ROOT}${DST} -o $SRC</pre>
 
  
== EXIT STATUS ==
+
<p style="margin-left:11%;"><b>restart</b> <i>CTID</i>
 +
[<b>--wait</b>] [<b>--force</b>] [<b>--fast</b>]
 +
[<b>--skip-fsck</b>]</p>
  
<p style="margin-left:11%; margin-top: 1em">Returns 0 upon
+
<p style="margin-left:17%;">Restarts a container, i.e.
success, or an appropriate error code in case of an
+
stops it if it is running, and starts again. Accepts all the
error:</p>
+
<b>start</b> and <b>stop</b> options.</p>
  
<table width="100%" border="0" rules="none" frame="void"
+
<p style="margin-left:17%; margin-top: 1em">Note that this
      cellspacing="0" cellpadding="0">
+
command can lead to execution of some action scripts (see
<tr valign="top" align="left">
+
<b>ACTION SCRIPTS</b> below).</p>
<td width="11%"></td>
 
<td width="4%">
 
  
<p>1</p></td>
+
<p style="margin-left:11%;"><b>status</b> <i>CTID</i></p>
<td width="7%"></td>
 
<td width="78%">
 
  
<p>Failed to set a UBC parameter</p></td></tr>
+
<p style="margin-left:17%;">Shows a container status. This
<tr valign="top" align="left">
+
is a line with five or six words, separated by spaces.</p>
<td width="11%"></td>
 
<td width="4%">
 
  
<p>2</p></td>
+
<p style="margin-left:17%; margin-top: 1em">First word is
<td width="7%"></td>
+
literally <b>CTID</b>.</p>
<td width="78%">
 
  
<p>Failed to set a fair scheduler parameter</p></td></tr>
+
<p style="margin-left:17%; margin-top: 1em">Second word is
<tr valign="top" align="left">
+
the numeric <i>CT ID</i>.</p>
<td width="11%"></td>
 
<td width="4%">
 
  
<p>3</p></td>
+
<p style="margin-left:17%; margin-top: 1em">Third word is
<td width="7%"></td>
+
showing whether this container exists or not, it can be
<td width="78%">
+
either <b>exist</b> or <b>deleted</b>.</p>
  
<p>Generic system error</p></td></tr>
+
<p style="margin-left:17%; margin-top: 1em">Fourth word is
<tr valign="top" align="left">
+
showing the status of the container filesystem, it can be
<td width="11%"></td>
+
either <b>mounted</b> or <b>unmounted</b>.</p>
<td width="4%">
 
  
<p>5</p></td>
+
<p style="margin-left:17%; margin-top: 1em">Fifth word
<td width="7%"></td>
+
shows if the container is running, it can be either
<td width="78%">
+
<b>running</b> or <b>down</b>.</p>
  
<p>The running kernel is not an OpenVZ kernel (or some
+
<p style="margin-left:17%; margin-top: 1em">Sixth word, if
OpenVZ modules are not loaded)</p></td></tr>
+
exists, is <b>suspended</b>. It appears if a dump file
<tr valign="top" align="left">
+
exists for a stopped container (see <b>suspend</b>).</p>
<td width="11%"></td>
 
<td width="4%">
 
  
<p>6</p></td>
+
<p style="margin-left:17%; margin-top: 1em">This command
<td width="7%"></td>
+
can also be usable from scripts.</p>
<td width="78%">
 
  
<p>Not enough system resources</p></td></tr>
+
<p style="margin-left:11%;"><b>mount</b> <i>CTID</i></p>
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="4%">
 
  
<p>7</p></td>
+
<p style="margin-left:17%;">Mounts container private area.
<td width="7%"></td>
+
Note that this command can lead to execution of
<td width="78%">
+
<b>premount</b> and <b>mount</b> action scripts (see
 +
<b>ACTION SCRIPTS</b> below).</p>
  
<p><b>ENV_CREATE</b> ioctl failed</p></td></tr>
+
<p style="margin-left:11%;"><b>umount</b> <i>CTID</i></p>
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="4%">
 
  
<p>8</p></td>
+
<p style="margin-left:17%;">Unmounts container private
<td width="7%"></td>
+
area. Note that this command can lead to execution of
<td width="78%">
+
<b>umount</b> and <b>postumount</b> action scripts (see
 +
<b>ACTION SCRIPTS</b> below).</p>
  
<p>Command executed by <b>vzctl exec</b> returned non-zero
+
<p style="margin-left:17%; margin-top: 1em">Note that
exit code</p></td></tr>
+
<b>stop</b> does <b>umount</b> automatically.</p>
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="4%">
 
  
<p>9</p></td>
+
<p style="margin-left:11%;"><b>convert</b> <i>CTID</i>
<td width="7%"></td>
+
[<b>--layout
<td width="78%">
+
ploop</b>[<b>:</b>{<b>expanded</b>|<b>plain</b>|<b>raw</b>}]]</p>
  
<p>Container is locked by another <b>vzctl</b>
+
<p style="margin-left:17%;">Convert CT private area to
invocation</p> </td></tr>
+
reside on a ploop device (available in kernel version
<tr valign="top" align="left">
+
042stab052.8 and greater). Conversion should be performed
<td width="11%"></td>
+
when a container is stopped, plus disk space quota should be
<td width="4%">
+
set.</p>
  
<p>10</p></td>
+
<p style="margin-left:11%;"><b>compact</b> <i>CTID</i></p>
<td width="7%"></td>
 
<td width="78%">
 
  
<p>Global OpenVZ configuration file [[Man/vz.conf.5|<b>vz.conf</b>(5)]] not
+
<p style="margin-left:17%;">Compact container image. This
found</p> </td></tr>
+
only makes sense for ploop layout.</p>
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="4%">
 
  
<p>11</p></td>
+
<p style="margin-left:11%;"><b>quotaon</b> <i>CTID</i></p>
<td width="7%"></td>
 
<td width="78%">
 
  
<p>A vzctl helper script file not found</p></td></tr>
+
<p style="margin-left:17%;">Turn disk quota on. Not that
<tr valign="top" align="left">
+
<b>mount</b> and <b>start</b> does that automatically.</p>
<td width="11%"></td>
 
<td width="4%">
 
  
<p>12</p></td>
+
<p style="margin-left:11%;"><b>quotaoff</b> <i>CTID</i></p>
<td width="7%"></td>
 
<td width="78%">
 
  
<p>Permission denied</p></td></tr>
+
<p style="margin-left:17%;">Turn disk quota off. Not that
<tr valign="top" align="left">
+
<b>umount</b> and <b>stop</b> does that automatically.</p>
<td width="11%"></td>
 
<td width="4%">
 
  
<p>13</p></td>
+
<p style="margin-left:11%;"><b>quotainit</b>
<td width="7%"></td>
+
<i>CTID</i></p>
<td width="78%">
 
  
<p>Capability setting failed</p></td></tr>
+
<p style="margin-left:17%;">Initialize disk quota (i.e. run
<tr valign="top" align="left">
+
<b>vzquota init</b>) with the parameters taken from the CT
<td width="11%"></td>
+
configuration file [[Man/ctid.conf.5|<b>ctid.conf</b>(5)]].</p>
<td width="4%">
 
  
<p>14</p></td>
+
<p style="margin-left:11%;"><b>exec</b> <i>CTID
<td width="7%"></td>
+
command</i></p>
<td width="78%">
 
  
<p>Container configuration file [[Man/ctid.conf.5|<b>ctid.conf</b>(5)]] not
+
<p style="margin-left:17%;">Executes <i>command</i> in a
found</p> </td></tr>
+
container. Environment variables are not set inside the
<tr valign="top" align="left">
+
container. Signal handlers may differ from default settings.
<td width="11%"></td>
+
If <i>command</i> is <b>-</b>, commands are read from
<td width="4%">
+
stdin.</p>
  
<p>15</p></td>
+
<p style="margin-left:11%;"><b>exec2</b> <i>CTID
<td width="7%"></td>
+
command</i></p>
<td width="78%">
 
  
<p>Timeout on <b>vzctl exec</b></p></td></tr>
+
<p style="margin-left:17%;">The same as <b>exec</b>, but
<tr valign="top" align="left">
+
return code is that of <i>command</i>.</p>
<td width="11%"></td>
 
<td width="4%">
 
  
<p>16</p></td>
+
<p style="margin-left:11%;"><b>runscript</b> <i>CTID
<td width="7%"></td>
+
script</i></p>
<td width="78%">
 
  
<p>Error during <b>vzctl chkpnt</b></p></td></tr>
+
<p style="margin-left:17%;">Run specified shell script in
<tr valign="top" align="left">
+
the container. Argument <i>script</i> is a file on the host
<td width="11%"></td>
+
system which contents is read by vzctl and executed in the
<td width="4%">
+
context of the container. For a running container, the
 
+
command jumps into the container and executes the script.
<p>17</p></td>
+
For a stopped container, it enters the container, mounts
<td width="7%"></td>
+
container&rsquo;s root filesystem, executes the script, and
<td width="78%">
+
unmounts CT root. In the latter case, the container is not
 +
really started, no file systems other than root (such as
 +
<b>/proc</b>) are mounted, no startup scripts are executed
 +
etc. Thus the environment in which the script is running is
 +
far from normal and is only usable for very basic
 +
operations.</p>
  
<p>Error during <b>vzctl restore</b></p></td></tr>
+
<p style="margin-left:11%;"><b>enter</b> <i>CTID</i>
<tr valign="top" align="left">
+
[<b>--exec</b> <i>command</i> [<i>arg</i> ...]]</p>
<td width="11%"></td>
 
<td width="4%">
 
  
<p>18</p></td>
+
<p style="margin-left:17%;">Enters into a container (giving
<td width="7%"></td>
+
a container&rsquo;s root shell). This option is a back-door
<td width="78%">
+
for host root only. The proper way to have CT root shell is
 +
to use <b>ssh</b>(1).</p>
  
<p>Error from <b>setluid()</b> syscall</p></td></tr>
+
<p style="margin-left:17%; margin-top: 1em">Option
<tr valign="top" align="left">
+
<b>--exec</b> is used to run <i>command</i> with arguments
<td width="11%"></td>
+
after entering into container. This is useful if command to
<td width="4%">
+
be run requires a terminal (so <b>vzctl exec</b> can not be
 +
used) and for some reason you can not use <b>ssh</b>(1).</p>
  
<p>20</p></td>
+
<p style="margin-left:17%; margin-top: 1em">You need to log
<td width="7%"></td>
+
out manually from the shell to finish session (even if you
<td width="78%">
+
specified <b>--exec</b>).</p>
  
<p>Invalid command line parameter</p></td></tr>
+
<p style="margin-left:11%;"><b>console</b> <i>CTID</i>
<tr valign="top" align="left">
+
[<i>ttynum</i>]</p>
<td width="11%"></td>
 
<td width="4%">
 
  
<p>21</p></td>
+
<p style="margin-left:17%;">Attach to a container console.
<td width="7%"></td>
+
Optional <i>ttynum</i> argument is tty number (such as
<td width="78%">
+
<b>4</b> for <b>tty4</b>), default is <b>1</b> which is used
 +
for container&rsquo;s <b>/dev/console</b>.</p>
  
<p>Invalid value for command line parameter</p></td></tr>
+
<p style="margin-left:17%; margin-top: 1em">Note the
<tr valign="top" align="left">
+
consoles are persistent, meaning that: <br>
<td width="11%"></td>
+
&bull; it can be attached to even if the container is not
<td width="4%">
+
running; <br>
 +
&bull; there is no automatic detachment upon the container
 +
stop; <br>
 +
&bull; detaching from the console leaves anything running in
 +
this console as is.</p>
  
<p>22</p></td>
+
<p style="margin-left:17%; margin-top: 1em">The following
<td width="7%"></td>
+
escape sequences are recognized by <b>vzctl console</b>.
<td width="78%">
+
Note that these sequences are only recognized at the
 +
beginning of a line.</p>
  
<p>Container root directory (<b>VE_ROOT</b>) not set</p></td></tr>
+
<p style="margin-left:17%; margin-top: 1em">&bull;
<tr valign="top" align="left">
+
<b>Esc</b> then <b>.</b> to detach from the console.</p>
<td width="11%"></td>
 
<td width="4%">
 
  
<p>23</p></td>
+
<p style="margin-left:17%; margin-top: 1em">&bull;
<td width="7%"></td>
+
<b>Esc</b> then <b>!</b> to kill anything running on the
<td width="78%">
+
console (SAK). This is helpful when one expects a login
 +
prompt but there isn&rsquo;t one.</p>
  
<p>Container private directory (<b>VE_PRIVATE</b>) not
+
=== Other options ===
set</p> </td></tr>
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="4%">
 
  
<p>24</p></td>
+
<p style="margin-left:11%;"><b>--help</b></p>
<td width="7%"></td>
 
<td width="78%">
 
  
<p>Container template directory (<b>TEMPLATE</b>) not
+
<p style="margin-left:17%;">Prints help message with a
set</p> </td></tr>
+
brief list of possible options.</p>
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="4%">
 
  
<p>28</p></td>
+
<p style="margin-left:11%;"><b>--version</b></p>
<td width="7%"></td>
 
<td width="78%">
 
  
<p>Not all required UBC parameters are set, unable to start
+
<p style="margin-left:17%;">Prints <b>vzctl</b>
container</p> </td></tr>
+
version.</p>
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="4%">
 
  
<p>29</p></td>
+
== ACTION SCRIPTS ==
<td width="7%"></td>
 
<td width="78%">
 
  
<p>OS template is not specified, unable to create
+
<p style="margin-left:11%; margin-top: 1em"><b>vzctl</b>
container</p> </td></tr>
+
has an ability to execute user-defined scripts when a
<tr valign="top" align="left">
+
specific <b>vzctl</b> command is run for a container. The
<td width="11%"></td>
+
following <b>vzctl</b> commands can trigger execution of
<td width="4%">
+
action scripts: <b>start</b>, <b>stop</b>, <b>restart</b>,
 +
<b>mount</b> and <b>umount</b>.</p>
  
<p>31</p></td>
+
<p style="margin-left:11%; margin-top: 1em">Action scripts
<td width="7%"></td>
+
are located in the <b>/etc/vz/conf/</b> directory. There are
<td width="78%">
+
global and per-CT scripts. Global scripts have a literal
 +
prefix of <b>vps.</b> and are executed for all containers.
 +
Per-CT scripts have a <i>CTID</i><b>.</b> numeric prefix and
 +
are executed for the given container only.</p>
  
<p>Container not running</p></td></tr>
+
<p style="margin-left:11%; margin-top: 1em">Please note
<tr valign="top" align="left">
+
scripts are executed in a host system (CT0) context, with
<td width="11%"></td>
+
the exception of <b>.start</b> and <b>.stop</b> scripts,
<td width="4%">
+
which are executed in a container context.</p>
  
<p>32</p></td>
+
<p style="margin-left:11%; margin-top: 1em">The following
<td width="7%"></td>
+
action scripts are currently defined: <b><br>
<td width="78%">
+
vps.premount</b>, <i>CTID</i><b>.premount</b></p>
  
<p>Container already running</p></td></tr>
+
<p style="margin-left:22%;">Global and per-CT mount scripts
<tr valign="top" align="left">
+
which are executed for a container before it is mounted.
<td width="11%"></td>
+
Scripts are executed in the host system context, while a CT
<td width="4%">
+
is not yet mounted or running. Global script, if exists, is
 +
executed first.</p>
  
<p>33</p></td>
+
<p style="margin-left:11%;"><b>vps.mount</b>,
<td width="7%"></td>
+
<i>CTID</i><b>.mount</b></p>
<td width="78%">
 
  
<p>Unable to stop container</p></td></tr>
+
<p style="margin-left:22%;">Global and per-CT mount scripts
<tr valign="top" align="left">
+
which are executed for a container right after it is
<td width="11%"></td>
+
mounted. Otherwise they are the same as <b>.premount</b>
<td width="4%">
+
scripts.</p>
  
<p>34</p></td>
+
<p style="margin-left:11%;"><i>CTID</i><b>.start</b></p>
<td width="7%"></td>
 
<td width="78%">
 
  
<p>Unable to add IP address to container</p></td></tr>
+
<p style="margin-left:22%;">Right after <b>vzctl</b> has
<tr valign="top" align="left">
+
started a container, it executes this script in a container
<td width="11%"></td>
+
context.</p>
<td width="4%">
 
  
<p>40</p></td>
+
<p style="margin-left:11%;"><i>CTID</i><b>.stop</b></p>
<td width="7%"></td>
 
<td width="78%">
 
  
<p>Container not mounted</p></td></tr>
+
<p style="margin-left:22%;">Right before <b>vzctl</b> has
<tr valign="top" align="left">
+
stopped a container, it executes this script in a container
<td width="11%"></td>
+
context.</p>
<td width="4%">
 
  
<p>41</p></td>
+
<p style="margin-left:11%;"><b>vps.umount</b>,
<td width="7%"></td>
+
<i>CTID</i><b>.umount</b></p>
<td width="78%">
 
  
<p>Container already mounted</p></td></tr>
+
<p style="margin-left:22%;">Global and per-CT umount
<tr valign="top" align="left">
+
scripts which are executed for a container before it is
<td width="11%"></td>
+
unmounted. Scripts are executed in the host system context,
<td width="4%">
+
while a CT is mounted. Global script, if exists, is executed
 +
first.</p>
  
<p>43</p></td>
+
<p style="margin-left:11%;"><b>vps.postumount</b>,
<td width="7%"></td>
+
<i>CTID</i><b>.postumount</b></p>
<td width="78%">
 
  
<p>Container private area not found</p></td></tr>
+
<p style="margin-left:22%;">Global and per-CT umount
<tr valign="top" align="left">
+
scripts which are executed for a container right after it is
<td width="11%"></td>
+
unmounted. Otherwise they are the same as <b>.umount</b>
<td width="4%">
+
scripts.</p>
  
<p>44</p></td>
+
<p style="margin-left:11%; margin-top: 1em">The environment
<td width="7%"></td>
+
passed to all the <b>*mount</b> scripts is the standard
<td width="78%">
+
environment of the parent (i.e. <b>vzctl</b>) with two
 +
additional variables: <b>$VEID</b> and <b>$VE_CONFFILE</b>.
 +
The first one holds the ID of the container, and the second
 +
one holds the full path to the container configuration file.
 +
If the script needs to get other CT configuration
 +
parameters, such as <b>$VE_ROOT</b>, it needs to get those
 +
from global and per-CT configuration files.</p>
  
<p>Container private area already exists</p></td></tr>
+
<p style="margin-left:11%; margin-top: 1em">Here is an
<tr valign="top" align="left">
+
example of a mount script, which makes host system&rsquo;s
<td width="11%"></td>
+
/mnt/disk available to container(s). Script name can either
<td width="4%">
+
be <b>/etc/vz/conf/vps.mount</b> or
 +
<b>/etc/vz/conf/</b><i>CTID</i><b>.mount</b>.</p>
  
<p>46</p></td>
+
<pre style="margin-left:11%; margin-top: 1em">   # If one of these files does not exist then something
<td width="7%"></td>
+
  # is really broken
<td width="78%">
+
  [ -f /etc/vz/vz.conf ] || exit 1
 +
  [ -f $VE_CONFFILE ] || exit 1
 +
  # Source both files. Note the order is important.
 +
  . /etc/vz/vz.conf
 +
  . $VE_CONFFILE
 +
  SRC=/mnt/disk
 +
  DST=/mnt/disk
 +
  mount -n -t simfs $SRC ${VE_ROOT}${DST} -o $SRC</pre>
  
<p>Not enough disk space</p></td></tr>
+
== EXIT STATUS ==
 +
 
 +
<p style="margin-left:11%; margin-top: 1em">Returns 0 upon
 +
success, or an appropriate error code in case of an
 +
error:</p>
 +
 
 +
<table width="100%" border="0" rules="none" frame="void"
 +
      cellspacing="0" cellpadding="0">
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>47</p></td>
+
<p>1</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Bad/broken container (<b>/sbin/init</b> or
+
<p>Failed to set a UBC parameter</p></td></tr>
<b>/bin/sh</b> not found)</p></td></tr>
 
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>48</p></td>
+
<p>2</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Unable to create a new container private area</p></td></tr>
+
<p>Failed to set a fair scheduler parameter</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>49</p></td>
+
<p>3</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Unable to create a new container root area</p></td></tr>
+
<p>Generic system error</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>50</p></td>
+
<p>5</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Unable to mount container</p></td></tr>
+
<p>The running kernel is not an OpenVZ kernel (or some
 +
OpenVZ modules are not loaded)</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>51</p></td>
+
<p>6</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Unable to unmount container</p></td></tr>
+
<p>Not enough system resources</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>52</p></td>
+
<p>7</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Unable to delete a container</p></td></tr>
+
<p><b>ENV_CREATE</b> ioctl failed</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>53</p></td>
+
<p>8</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Container private area not exist</p></td></tr>
+
<p>Command executed by <b>vzctl exec</b> returned non-zero
 +
exit code</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>60</p></td>
+
<p>9</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p><b>vzquota on</b> failed</p></td></tr>
+
<p>Container is locked by another <b>vzctl</b>
 +
invocation</p> </td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>61</p></td>
+
<p>10</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p><b>vzquota init</b> failed</p></td></tr>
+
<p>Global OpenVZ configuration file [[Man/vz.conf.5|<b>vz.conf</b>(5)]] not
 +
found</p> </td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>62</p></td>
+
<p>11</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p><b>vzquota setlimit</b> failed</p></td></tr>
+
<p>A vzctl helper script file not found</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>63</p></td>
+
<p>12</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Parameter <b>DISKSPACE</b> not set</p></td></tr>
+
<p>Permission denied</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>64</p></td>
+
<p>13</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Parameter <b>DISKINODES</b> not set</p></td></tr>
+
<p>Capability setting failed</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>65</p></td>
+
<p>14</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Error setting second-level (ugid) quota</p></td></tr>
+
<p>Container configuration file [[Man/ctid.conf.5|<b>ctid.conf</b>(5)]] not
 +
found</p> </td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>66</p></td>
+
<p>15</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p><b>vzquota off</b> failed</p></td></tr>
+
<p>Timeout on <b>vzctl exec</b></p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>67</p></td>
+
<p>16</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>ugid quota not initialized</p></td></tr>
+
<p>Error during <b>vzctl suspend</b></p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>71</p></td>
+
<p>17</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Incorrect IP address format</p></td></tr>
+
<p>Error during <b>vzctl resume</b></p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>74</p></td>
+
<p>18</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Error changing password</p></td></tr>
+
<p>Error from <b>setluid()</b> syscall</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>78</p></td>
+
<p>20</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>IP address already in use</p></td></tr>
+
<p>Invalid command line parameter</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>79</p></td>
+
<p>21</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Container action script returned an error</p></td></tr>
+
<p>Invalid value for command line parameter</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>82</p></td>
+
<p>22</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Config file copying error</p></td></tr>
+
<p>Container root directory (<b>VE_ROOT</b>) not set</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>86</p></td>
+
<p>23</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Error setting devices (<b>--devices</b> or
+
<p>Container private directory (<b>VE_PRIVATE</b>) not
<b>--devnodes</b>)</p> </td></tr>
+
set</p> </td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>89</p></td>
+
<p>24</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>IP address not available</p></td></tr>
+
<p>Container template directory (<b>TEMPLATE</b>) not
 +
set</p> </td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>91</p></td>
+
<p>28</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>OS template not found</p></td></tr>
+
<p>Not all required UBC parameters are set, unable to start
 +
container</p> </td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>100</p></td>
+
<p>29</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Unable to find container IP address</p></td></tr>
+
<p>OS template is not specified, unable to create
 +
container</p> </td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>104</p></td>
+
<p>31</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p><b>VE_NETDEV</b> ioctl error</p></td></tr>
+
<p>Container not running</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>105</p></td>
+
<p>32</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Container start disabled</p></td></tr>
+
<p>Container already running</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>106</p></td>
+
<p>33</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Unable to set iptables on a running container</p></td></tr>
+
<p>Unable to stop container</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>107</p></td>
+
<p>34</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Distribution-specific configuration file not found</p></td></tr>
+
<p>Unable to add IP address to container</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>109</p></td>
+
<p>40</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Unable to apply a config</p></td></tr>
+
<p>Container not mounted</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>129</p></td>
+
<p>41</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Unable to set meminfo parameter</p></td></tr>
+
<p>Container already mounted</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>130</p></td>
+
<p>43</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Error setting veth interface</p></td></tr>
+
<p>Container private area not found</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>131</p></td>
+
<p>44</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Error setting container name</p></td></tr>
+
<p>Container private area already exists</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>133</p></td>
+
<p>46</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Waiting for container start failed</p></td></tr>
+
<p>Not enough disk space</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>139</p></td>
+
<p>47</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Error saving container configuration file</p></td></tr>
+
<p>Bad/broken container (<b>/sbin/init</b> or
 +
<b>/bin/sh</b> not found)</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>148</p></td>
+
<p>48</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Error setting container IO parameters (ioprio)</p></td></tr>
+
<p>Unable to create a new container private area</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>150</p></td>
+
<p>49</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Ploop image file not found</p></td></tr>
+
<p>Unable to create a new container root area</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>151</p></td>
+
<p>50</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Unable to mount container</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>51</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Unable to unmount container</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>52</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Error creating ploop image</p></td></tr>
+
<p>Unable to delete a container</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>152</p></td>
+
<p>53</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Error mounting ploop image</p></td></tr>
+
<p>Container private area not exist</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>153</p></td>
+
<p>60</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Error unmounting ploop image</p></td></tr>
+
<p><b>vzquota on</b> failed</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>154</p></td>
+
<p>61</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Error resizing ploop image</p></td></tr>
+
<p><b>vzquota init</b> failed</p></td></tr>
<tr valign="top" align="left">
+
<tr valign="top" align="left">
<td width="11%"></td>
+
<td width="11%"></td>
<td width="4%">
+
<td width="4%">
 
+
 
<p>155</p></td>
+
<p>62</p></td>
<td width="7%"></td>
+
<td width="7%"></td>
<td width="78%">
+
<td width="78%">
 
+
 
<p>Error converting container to ploop layout</p></td></tr>
+
<p><b>vzquota setlimit</b> failed</p></td></tr>
<tr valign="top" align="left">
+
<tr valign="top" align="left">
<td width="11%"></td>
+
<td width="11%"></td>
<td width="4%">
+
<td width="4%">
 
+
 
<p>156</p></td>
+
<p>63</p></td>
<td width="7%"></td>
+
<td width="7%"></td>
<td width="78%">
+
<td width="78%">
 
+
 
<p>Error creating ploop snapshot</p></td></tr>
+
<p>Parameter <b>DISKSPACE</b> not set</p></td></tr>
<tr valign="top" align="left">
+
<tr valign="top" align="left">
<td width="11%"></td>
+
<td width="11%"></td>
<td width="4%">
+
<td width="4%">
 
+
 
<p>157</p></td>
+
<p>64</p></td>
<td width="7%"></td>
+
<td width="7%"></td>
<td width="78%">
+
<td width="78%">
 
+
 
<p>Error merging ploop snapshot</p></td></tr>
+
<p>Parameter <b>DISKINODES</b> not set</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>65</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Error setting in-container disk quotas</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>66</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p><b>vzquota off</b> failed</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>67</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>ugid quota not initialized</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>71</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Incorrect IP address format</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>74</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Error changing password</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>78</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>IP address already in use</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>79</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Container action script returned an error</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>82</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Config file copying error</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>86</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Error setting devices (<b>--devices</b> or
 +
<b>--devnodes</b>)</p> </td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>89</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>IP address not available</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>91</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>OS template not found</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>99</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Ploop is not supported by either the running kernel or
 +
vzctl.</p> </td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>100</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Unable to find container IP address</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>104</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p><b>VE_NETDEV</b> ioctl error</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>105</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Container start disabled</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>106</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Unable to set iptables on a running container</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>107</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Distribution-specific configuration file not found</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>109</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Unable to apply a config</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>129</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Unable to set meminfo parameter</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>130</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Error setting veth interface</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>131</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Error setting container name</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>133</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Waiting for container start failed</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>139</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Error saving container configuration file</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>148</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Error setting container IO parameters (ioprio)</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>150</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Ploop image file not found</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>151</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Error creating ploop image</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>152</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Error mounting ploop image</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>153</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Error unmounting ploop image</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>154</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Error resizing ploop image</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>155</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Error converting container to ploop layout</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>156</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Error creating ploop snapshot</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>157</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Error merging ploop snapshot</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>158</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Error deleting ploop snapshot</p></td></tr>
 +
<tr valign="top" align="left">
 +
<td width="11%"></td>
 +
<td width="4%">
 +
 
 +
<p>159</p></td>
 +
<td width="7%"></td>
 +
<td width="78%">
 +
 
 +
<p>Error switching ploop snapshot</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>158</p></td>
+
<p>166</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Error deleting ploop snapshot</p></td></tr>
+
<p>Error compacting ploop image</p></td></tr>
 
<tr valign="top" align="left">
 
<tr valign="top" align="left">
 
<td width="11%"></td>
 
<td width="11%"></td>
 
<td width="4%">
 
<td width="4%">
  
<p>159</p></td>
+
<p>167</p></td>
 
<td width="7%"></td>
 
<td width="7%"></td>
 
<td width="78%">
 
<td width="78%">
  
<p>Error switching ploop snapshot</p></td></tr>
+
<p>Error listing ploop snapsots</p></td></tr>
 
</table>
 
</table>
  
Line 2,352: Line 2,802:
  
 
<p style="margin-left:11%; margin-top: 1em">Copyright (C)
 
<p style="margin-left:11%; margin-top: 1em">Copyright (C)
2000-2011, Parallels, Inc. Licensed under GNU GPL.</p>
+
2000-2013, Parallels, Inc. Licensed under GNU GPL.</p>

Latest revision as of 18:21, 23 April 2015

NAME

vzctl − perform various operations on an OpenVZ container

SYNOPSIS

vzctl

[flags] create CTID --parameter value [...]

vzctl

[flags] start CTID [--wait] [--force] [--skip-fsck] [--skip-remount]

vzctl

[flags] stop CTID [--fast] [--skip-umount]

vzctl

[flags] restart CTID [--wait] [--force] [--fast] [--skip-fsck] [--skip-remount]

vzctl

[flags] suspend | resume CTID [--dumpfile name]

vzctl

[flags] snapshot CTID [--id uuid] [--name name] [--description desc] [--skip-suspend] [--skip-config]

vzctl

[flags] snapshot-switch CTID [--skip-resume | --must-resume] [--skip-config] --id uuid

vzctl

[flags] snapshot-delete CTID --id uuid

vzctl

[flags] snapshot-mount CTID --id uuid --target dir

vzctl

[flags] snapshot-umount CTID --id uuid

vzctl

[flags] snapshot-list CTID [-H] [-o field[,field...] [--id uuid]

vzctl

[flags] set CTID --parameter value [...] [--save] [--force] [--setmode restart|ignore]

vzctl

[flags] set CTID --reset_ub

vzctl

[flags] destroy | delete | mount | umount | status | quotaon | quotaoff | quotainit CTID

vzctl

[flags] console CTID [ttynum]

vzctl

[flags] convert CTID [--layout ploop[:{expanded|plain|raw}]]

vzctl

[flags] compact CTID

vzctl

[flags] exec | exec2 CTID command [arg ...]

vzctl

[flags] enter CTID [--exec command [arg ...]]

vzctl

[flags] runscript CTID script

vzctl

--help | --version

DESCRIPTION

Utility vzctl runs on the host system (otherwise known as Hardware Node, or HN) and performs direct manipulations with containers (CTs).

Containers can be referred to by either numeric CTID or by name (see --name option). Note that CT ID <= 100 are reserved for OpenVZ internal purposes. A numeric ID should not be more than 2147483644.

OPTIONS

Flags

These flags come before a command, and can be used with any command. They affect logging to console (terminal) only, and do not affect logging to a log file.

--quiet

Disables output. Note that scripts run by vzctl are still able to produce some output.

--verbose

Increments logging level up from the default. Can be used multiple times. Default value is set to the value of VERBOSE parameter in the global configuration file vz.conf(5), or to 0 if not set by VERBOSE parameter.

Setting container parameters

set

CTID [--onboot yes|no] [--bootorder number] [--root path] [--private path] [--mount_opts options] [--userpasswd user:pass] [--disabled yes|no] [--name name] [--description string] [--ostemplate string] [--stop-timeout seconds] [--ipadd addr] [--ipdel addr|all] [--hostname name] [--nameserver addr] [--searchdomain name] [--netif_add dev[,params...]] [--netif_del dev|all] [--ifname dev [--mac hwaddr] [--host_ifname dev] [--host_mac hwaddr] [--bridge name] [--mac_filter on|off]] [--numproc items] [--numtcpsock items] [--numothersock items] [--vmguarpages pages] [--kmemsize bytes] [--tcpsndbuf bytes] [--tcprcvbuf bytes] [--othersockbuf bytes] [--dgramrcvbuf bytes] [--oomguarpages pages] [--lockedpages pages] [--privvmpages pages] [--shmpages pages] [--numfile items] [--numflock items] [--numpty items] [--numsiginfo items] [--dcachesize bytes] [--numiptent num] [--physpages pages] [--swappages pages] [--ram bytes] [--swap bytes] [--vm_overcommit float] [--cpuunits num] [--cpulimit num] [--cpus num] [--cpumask cpus|auto|all] [--nodemask nodes|all] [--meminfo none|mode:value] [--iptables name[,...]] [--netfilter disabled|stateless|stateful|full] [--netdev_add ifname] [--netdev_del ifname] [--diskquota yes|no] [--diskspace num] [--diskinodes num] [--quotatime seconds] [--quotaugidlimit num] [--capability capname:on|off[,...]] [--devnodes param] [--devices param] [--pci_add dev] [--pci_del dev] [--features name:on|off[,...]] [--applyconfig name] [--applyconfig_map group] [--ioprio num] [--iolimit mbps] [--iopslimit iops] [--save] [--force] [--reset_ub] [--setmode restart|ignore]

This command sets various container parameters. If the container is currently running, vzctl applies these parameters to the container. The following options can be used with set command.

Flags

--save

If this flag is given, parameters are saved in container configuration file ctid.conf(5).

--force

If this flag is given together with --save, parameters are saved even if the current kernel doesn’t support OpenVZ. Note this flag does not make sense without --save, so --save is required.

--reset_ub

If this flag is given, vzctl applies all User Beancounter parameters from the configuration file to a running container. This is helpful in case configuration file is modified manually. Please note this flag is exclusive, i.e. it can not be combined with any other options or flags.

--setmode restart | ignore

A few parameters can only be applied by restarting the container. By default, vzctl prints a warning if such parameters are supplied and a container is running. Use --setmode restart together with --save flag to restart a container in such a case, or --setmode ignore to suppress the warning.

Miscellaneous

--onboot yes | no

Sets whether the container will be started during system boot. The container will be started on boot by vz initscript if either this parameter is set to yes, or the container was running just before last reboot, and this parameter is not set to no. Default value is unset, meaning the container will be started if it was running before the last reboot.

--bootorder number

Sets the boot order priority for this CT. The higher the number is, the earlier in the boot process this container starts. By default this parameter is unset, which is considered to be the lowest priority, so containers with unset bootorder will start last.

--root path

Sets the path to root directory (VE_ROOT) for this container. This is essentially a mount point for container’s root directory. Argument can contain literal string $VEID, which will be substituted with the numeric CT ID.

--private path

Sets the path to private directory (VE_PRIVATE) for this container. This is a directory in which all the container’s files are stored. Argument can contain literal string $VEID, which will be substituted with the numeric CT ID.

--mount_opts option[,option...]

Sets additional mount options for container file system. Only applicable for ploop layout, ignored otherwise.

--userpasswd user:password

Sets password for the given user in a container, creating the user if it does not exists. Note that this option is not saved in configuration file at all (so --save flag is useless), it is applied directly to the container, by running distribution-specific programs inside the container. It is not recommended to combine this option with any other options.

In case container was not running, it is automatically started then all the appropriate changes are applied, then it is stopped.

Note that container should be created before using this option.

--disabled yes | no

Disable container start. To force the start of a disabled container, use vzctl start --force.

--name name

Add a name for a container. The name can later be used in subsequent calls to vzctl in place of CTID. Note this option can not be used without --save.

--description string

Add a textual description for a container.

--ostemplate string

Sets a new value of OSTEMPLATE parameter in container configuration file ctid.conf(5). Requires --save flag. Useful after a change/upgrade of a distribution running inside container, as vzctl uses the value of OSTEMPLATE to run distribution-specific scripts.

--stop-timeout seconds

Sets a time to wait for container to stop on vzctl stop before forcibly killing it, in seconds. Note this option can not be used without --save flag.

Special value of 0 means to use compiled-in default.

Networking

--ipadd addr

Adds an IP address addr to a given container. Address can optionally have a netmask specified in the CIDR notation (e.g. 10.1.2.3/25). Note that this option is incremental, so addr are added to already existing ones.

--ipdel addr | all

Removes IP address addr from a container. If you want to remove all the addresses, use --ipdel all.

--hostname name

Sets container hostname. vzctl writes it to the appropriate file inside a container (distribution-dependent).

--nameserver addr

Sets DNS server IP address for a container. If you want to set several nameservers, you should do it at once, so use --nameserver option multiple times in one call to vzctl, as all the name server values set in previous calls to vzctl are overwritten.

A special value of inherit can be used to auto-propagate nameserver value(s) from the host system’s /etc/resolv.conf file.

--searchdomain name

Sets DNS search domains for a container. If you want to set several search domains, you should do it at once, so use --searchdomain option multiple times in one call to vzctl, as all the search domain values set in previous calls to vzctl are overwritten.

A special value of inherit can be used to auto-propagate search domain value(s) from the host system’s /etc/resolv.conf file.

--netif_add ifname[,mac,host_ifname,host_mac,bridge]

Adds a virtual Ethernet device (veth) to a given container. Here ifname is the Ethernet device name in the container, mac is its MAC address, host_ifname is the Ethernet device name on the host, and host_mac is its MAC address. MAC addresses should be in the format like XX:XX:XX:XX:XX:XX. bridge is an optional parameter which can be used in custom network start scripts to automatically add the interface to a bridge. All parameters except ifname are optional and are automatically generated if not specified.

--netif_del dev_name | all

Removes virtual Ethernet device from a container. If you want to remove all devices, use all.

veth interface configuration

The following options can be used to reconfigure the already-created virtual Ethernet interface. To select the interface to configure, use --ifname name option.
--mac
XX:XX:XX:XX:XX:XX

MAC address of interface inside a container.

--host_ifname name

interface name for virtual interface in the host system.

--host_mac XX:XX:XX:XX:XX:XX

MAC address of interface in the host system.

If you want an independent communication with the Container through the bridge, you should specify a multicast MAC address here (FE:FF:FF:FF:FF:FF).

--bridge name

Bridge name. Custom network start scripts can use this value to automatically add the interface to a bridge.

--mac_filter on | off

Enables/disables MAC address filtering for the Container veth device and the possibility of configuring the MAC address of this device from inside the Container. If the filtering is turned on:
• the veth device accepts only those packets that have a MAC address in their headers corresponding to that of this device (excluding all broadcast and multicast packets);
• it is impossible to modify the veth MAC address from inside the Container.

By default, this functionality is enabled for all veth devices existing inside the Container.

VSwap limits

The following options sets memory and swap limits for VSwap-enabled kernels (kernel version 042stab042 or greater).

Argument is in bytes, unless otherwise specified by an optional suffix. Available suffixes are:

T, t - terabytes;
G, g - gigabytes;
M, m - megabytes;
K, k - kilobytes;
P, p - memory pages (arch-specific, usually 4KB);
B, b - bytes (this is the default).
--ram
bytes

Sets physical memory (RAM) available to a container. Actually, the option is a shortcut for setting --physpages limit (the barrier is set to 0).

--swap bytes

Set swap space available to a container. Actually, the option is a shortcut for setting --swappages limit (the barrier is set to 0).

--vm_overcommit float

Set VM overcommitment value to float. If set, it is used to calculate privmmpages parameter in case it is not set explicitly (see below). Default value is 0, meaning unlimited privvmpages.

vzctl checks if running kernel is VSwap capable, and refuses to use these parameters otherwise. This behavior can be overriden by using --force flag before parameters.

In VSwap mode, all beancounters other than RAM and swap become optional. Note though that if some optional beancounters are not set, they are calculated and set by vzctl implicitly, using the following formulae:

• lockedpages.barrier = oomguarpages.barrier = ram

• lockedpages.limit = oomguarpages.limit = unlimited

• vmguarpages.barrier = vmguarpages.limit = ram + swap

• privvmpages.barrier = privvmpages.limit = (ram + swap) * vm_overcommit

(if vm_overcommit is 0 or not set, privvmpages is set to "unlimited")

Here is an example of setting container 777 to have 512 megabytes of RAM and 1 gigabyte of swap:

   vzctl set 777 --ram 512M --swap 1G --save

User Beancounter limits

The following options sets barrier and limit for various user beancounters.

Note that for VSwap-enabled kernels (version 042stab042 or greater) these limits are optional, you must only set --ram and --swap (see above). For older kernels, these limits are obligatory.

Each option requires one or two arguments. In case of one argument, vzctl sets barrier and limit to the same value. In case of two colon-separated arguments, the first is a barrier, and the second is a limit. Each argument is either a number, a number with a suffix, or a special value unlimited.

Arguments are in items, pages or bytes. Note that page size is architecture-specific, it is 4096 bytes on x86 and x86_64 platforms.

You can also specify different suffixes for User Beancounter parameters (except for those which names start with num). For example, vzctl set CTID --privvmpages 5M:6M should set privvmpages’ barrier to 5 megabytes and its limit to 6 megabytes.

Available suffixes are:

T, t - terabytes;
G, g - gigabytes;
M, m - megabytes;
K, k - kilobytes;
P, p - memory pages (arch-specific, usually 4KB);
B, b - bytes.

You can also specify the literal word unlimited in place of a number. In that case the corresponding value will be set to LONG_MAX, i. e. the maximum possible value.
--numproc
items[:items]

Maximum number of processes and kernel-level threads. Setting the barrier and the limit to different values does not make practical sense.

--numtcpsock items[:items]

Maximum number of TCP sockets. This parameter limits the number of TCP connections and, thus, the number of clients the server application can handle in parallel. Setting the barrier and the limit to different values does not make practical sense.

--numothersock items[:items]

Maximum number of non-TCP sockets (local sockets, UDP and other types of sockets). Setting the barrier and the limit to different values does not make practical sense.

--vmguarpages pages[:pages]

Memory allocation guarantee. This parameter controls how much memory is available to a container. The barrier is the amount of memory that container’s applications are guaranteed to be able to allocate. The meaning of the limit is currently unspecified; it should be set to unlimited.

--kmemsize bytes[:bytes]

Maximum amount of kernel memory used. This parameter is related to --numproc. Each process consumes certain amount of kernel memory - 16 KB at least, 30-50 KB typically. Very large processes may consume a bit more. It is important to have a certain safety gap between the barrier and the limit of this parameter: equal barrier and limit may lead to the situation where the kernel will need to kill container’s applications to keep the kmemsize usage under the limit.

--tcpsndbuf bytes[:bytes]

Maximum size of TCP send buffers. Barrier should be not less than 64 KB, and difference between barrier and limit should be equal to or more than value of numtcpsock multiplied by 2.5 KB.

--tcprcvbuf bytes[:bytes]

Maximum size of TCP receive buffers. Barrier should be not less than 64 KB, and difference between barrier and limit should be equal to or more than value of numtcpsock multiplied by 2.5 KB.

--othersockbuf bytes[:bytes]

Maximum size of other (non-TCP) socket send buffers. If container’s processes needs to send very large datagrams, the barrier should be set accordingly. Increased limit is necessary for high performance of communications through local (UNIX-domain) sockets.

--dgramrcvbuf bytes[:bytes]

Maximum size of other (non-TCP) socket receive buffers. If container’s processes needs to receive very large datagrams, the barrier should be set accordingly. The difference between the barrier and the limit is not needed.

--oomguarpages pages[:pages]

Guarantees against OOM kill. Under this beancounter the kernel accounts the total amount of memory and swap space used by the container’s processes. The barrier of this parameter is the out-of-memory guarantee. If the oomguarpages usage is below the barrier, processes of this container are guaranteed not to be killed in out-of-memory situations. The meaning of limit is currently unspecified; it should be set to unlimited.

--lockedpages pages[:pages]

Maximum number of pages acquired by mlock(2).

--privvmpages pages[:pages]

Allows controlling the amount of memory allocated by the applications. For shared (mapped as MAP_SHARED) pages, each container really using a memory page is charged for the fraction of the page (depending on the number of others using it). For "potentially private" pages (mapped as MAP_PRIVATE), container is charged either for a fraction of the size or for the full size if the allocated address space. In the latter case, the physical pages associated with the allocated address space may be in memory, in swap or not physically allocated yet.

The barrier and the limit of this parameter control the upper boundary of the total size of allocated memory. Note that this upper boundary does not guarantee that container will be able to allocate that much memory. The primary mechanism to control memory allocation is the --vmguarpages guarantee.

--shmpages pages[:pages]

Maximum IPC SHM segment size. Setting the barrier and the limit to different values does not make practical sense.

--numfile items[:items]

Maximum number of open files. In most cases the barrier and the limit should be set to the same value. Setting the barrier to 0 effectively disables pre-charging optimization for this beancounter in the kernel, which leads to the held value being precise but could slightly degrade file open performance.

--numflock items[:items]

Maximum number of file locks. Safety gap should be between barrier and limit.

--numpty items[:items]

Number of pseudo-terminals (PTY). Note that in OpenVZ each container can have not more than 255 PTYs. Setting the barrier and the limit to different values does not make practical sense.

--numsiginfo items[:items]

Number of siginfo structures. Setting the barrier and the limit to different values does not make practical sense.

--dcachesize bytes[:bytes]

Maximum size of filesystem-related caches, such as directory entry and inode caches. Exists as a separate parameter to impose a limit causing file operations to sense memory shortage and return an errno to applications, protecting from memory shortages during critical operations that should not fail. Safety gap should be between barrier and limit.

--numiptent num[:num]

Number of iptables (netfilter) entries. Setting the barrier and the limit to different values does not make practical sense.

--physpages pages[:pages]

On VSwap-enabled kernels, this limits the amount of physical memory (RAM) available to a container. The barrier should be set to 0, and the limit to a total size of RAM that can be used used by a container.

For older kernels, this is an accounting-only parameter, showing the usage of RAM by this container. Barrier should be set to 0, and limit should be set to unlimited.

--swappages pages[:pages]

For VSwap-enabled kernels (042stab042 or greater), this parameter limits the amount of swap space available to a container. The barrier should be set to 0, and the limit to a total size of swap that can be used by a container.

For older (pre-VSwap) kernels, the limit is used to show a total amount of swap space available inside the container. The barrier of this parameter is ignored. The default value is unlimited, meaning total swap will be reported as 0.

CPU fair scheduler parameters

These parameters control CPU usage by container.
--cpuunits
num

CPU weight for a container. Argument is positive non-zero number, passed to and used in the kernel fair scheduler. The larger the number is, the more CPU time this container gets. Maximum value is 500000, minimal is 8. Number is relative to weights of all the other running containers. If cpuunits are not specified, default value of 1000 is used.

You can set CPU weight for CT0 (host system itself) as well (use vzctl set 0 --cpuunits num). Usually, OpenVZ initscript (/etc/init.d/vz) takes care of setting this.

--cpulimit num[%]

Limit of CPU usage for the container, in per cent. Note if the computer has 2 CPUs, it has total of 200% CPU time. Default CPU limit is 0 (no CPU limit).

--cpus num

sets number of CPUs available in the container.

--cpumask cpus | auto | all

Sets list of allowed CPUs for the container. Input format is a comma-separated list of decimal numbers and/or ranges. Consecutively set bits are shown as two hyphen-separated decimal numbers, the smallest and largest bit numbers set in the range. For example, if you want the container to execute on CPUs 0, 1, 2, 7, you should pass 0-2,7. Default value is all (the container can execute on any CPU). If used with the --nodemask option, value of auto assigns all CPUs from the specified NUMA node to a container.

--nodemask nodes | all

Sets list of allowed NUMA nodes for the container. Input format is the same as for --cpumask. Note that --nodemask must be used with the --cpumask option.

Memory output parameters

For VSwap-enabled kernels (042stab042 or greater), this parameter is ignored. For older kernels, it controls the output of /proc/meminfo inside a container.
--meminfo none

No /proc/meminfo virtualization (the same as on host system).

--meminfo mode:value

Configure total memory output in a container. Reported free memory is evaluated accordingly to the mode being set. Reported swap is evaluated according to the settings of --swappages parameter.

You can use the following modes for mode:
pages:value - sets total memory in pages;
privvmpages:value - sets total memory as privvmpages * value.

Default is privvmpages:1.

Netfilter (iptables) control parameters

--netfilter disabled|stateless|stateful|full

Restrict access to netfilter/iptables modules for a container. This option replaces obsoleted --iptables.

Note that changing this parameter requires container restart, so consider using --setmode option.

The following arguments can be used:
• disabled

no modules are allowed

• stateless

all modules except NAT and conntracks are allowed (i.e. filter and mangle); this is the default

• stateful

all modules except NAT are allowed

• full

all modules are allowed

--iptables name[,...]

Note this option is obsoleted, --netfilter should be used instead.

Allow to use the functionality of name iptables module inside the container. Multiple comma-separated names can be specified.

The default list of enabled iptables modules is defined by the IPTABLES variable in vz.conf(5).

You can use the following values for name: iptable_filter, iptable_mangle, ipt_limit, ipt_multiport, ipt_tos, ipt_TOS, ipt_REJECT, ipt_TCPMSS, ipt_tcpmss, ipt_ttl, ipt_LOG, ipt_length, ip_conntrack, ip_conntrack_ftp, ip_conntrack_irc, ipt_conntrack, ipt_state, ipt_helper, iptable_nat, ip_nat_ftp, ip_nat_irc, ipt_REDIRECT, xt_mac, ipt_recent, ipt_owner.

Network devices control parameters

--netdev_add name

move network device from the host system to a specified container

--netdev_del name

delete network device from a specified container

Disk quota parameters

--diskquota yes | no

allows to enable or disable disk quota for a container. By default, a global value (DISK_QUOTA) from vz.conf(5) is used.

Note that this parameter is ignored for ploop layout.

--diskspace num[:num]

For simfs layout, sets soft and hard disk quota limits. First parameter is soft limit, second is hard limit.

For ploop layout, initiates the procedure of resizing the ploop image file to the new size. Since there is no soft/hard limit concept in ploop, second num, if specified, is ignored.

By default, ploop resize is done online, i.e. on a mounted ploop. This is a preferred way of doing resize. Although, in a rare case a container was using lots of disk space and should now be resized to a much smaller size, an offline resize might be more appropriate. In this case, make sure the container is stopped and unmounted and use additional --offline-resize option

Note that ploop resize is NOT performed on container start, so for consistency --diskspace must be used together with --save flag.

Suffixes G, M, K can also be specified (see Resource limits section for more info on suffixes). If suffix is not specified, value is in kilobytes.

--diskinodes num[:num]

sets soft and hard disk quota limits, in i-nodes. First parameter is soft limit, second is hard limit.

Note that this parameter is ignored for ploop layout.

--quotatime seconds

sets quota grace period. Container is permitted to exceed its soft limits for the grace period, but once it has expired, the soft limit is enforced as a hard limit.

Note that this parameter is ignored for ploop layout.

--quotaugidlimit num

Enables or disables in-container per-user and per-group disk quotas. If the value is set to 0 or not set, disk quotas inside the container is disabled and not accounted.

For simfs layout containers, non-zero value sets maximum number of user/group IDs for which disk quota is accounted.

For ploop layout containers, any non-zero value enables disk quota inside the container; the number of user/group IDs used by disk quota is not limited by OpenVZ.

Note that enabling or disabling in-container disk quotas requires container restart, so consider using --setmode option.

Capability option

--capability capname:on|off[,...]

Sets a capability for a container. Multiple comma-separated capabilities can be specified.

Note that setting a capability when the container is running does not take immediate effect; restart the container in order for the changes to take effect (consider using --setmode option).

A container has the default set of capabilities, thus any operation on capabilities is "logical AND" with the default capability mask.

You can use the following values for capname: chown, dac_override, dac_read_search, fowner, fsetid, kill, setgid, setuid, setpcap, linux_immutable, net_bind_service, net_broadcast, net_admin, net_raw, ipc_lock, ipc_owner, sys_module, sys_rawio, sys_chroot, sys_ptrace, sys_pacct, sys_admin, sys_boot, sys_nice, sys_resource, sys_time, sys_tty_config, mknod, lease, setveid, ve_admin. For detailed description, see capabilities(7).

WARNING: setting some of those capabilities may have far reaching security implications, so do not do it unless you know what you are doing. Also note that setting setpcap:on for a container will most probably lead to inability to start it.

Device access management

--devnodes device:[r][w][q]|none

Give the container an access (r - read, w - write, q - disk quota management, none - no access) to a device designated by the special file /dev/device. Device file is created in a container by vzctl. Example:

   vzctl set 777 --devnodes sdb:rwq

--devices b|c:major:minor|all:[r][w][q]|none

Give the container an access to a block or character device designated by its major and minor numbers. Device file have to be created manually.

PCI device management

--pci_add [domain:]bus:slot.func

Give the container an access to a specified PCI device. All numbers are hexadecimal (as printed by lspci(8) in the first column).

--pci_del [domain:]bus:slot.func

Delete a PCI device from the container.

Note that vps-pci configuration script is executed by vzctl then configuring PCI devices. The script is usually located at /usr/libexec/vzctl/scripts/.

Features management

--features name:on|off[,...]

Enable or disable a specific container feature. Known features are: sysfs, nfs, sit, ipip, ppp, ipgre, bridge, nfsd. A few features can be specified at once, comma-separated.

Apply config

--applyconfig name

Read container parameters from the container sample configuration file /etc/vz/conf/ve-name.conf-sample, and apply them, if --save option specified save to the container config file. The following parameters are not changed: HOSTNAME, IP_ADDRESS, OSTEMPLATE, VE_ROOT, and VE_PRIVATE.

--applyconfig_map group

Apply container config parameters selected by group. Now the only possible value for group is name: to restore container name based on NAME variable in container configuration file.

I/O scheduling

--ioprio priority

Assigns disk I/O priority to container. Priority range is 0-7. The greater priority is, the more time for I/O activity container has. By default each container has priority of 4.

--iolimit limit[B|K|M|G]

Assigns disk I/O bandwidth limit for a container. Value is either a number with an optional suffix, or a literal string unlimited. Value of 0 means "unlimited". By default a container has no I/O limit. Maximum allowed limit is 2 gigabytes per second; values exceeding the limit are truncated.

If no suffix is provided, the limit is assumed to be in megabytes per second. Available suffixes are:
b, B -- bytes per second;
k, K -- kilobytes per second;
m, M -- megabytes per second (default);
g, G -- gigabytes per second;

--iopslimit iops

Assigns IOPS limit for a container, in number of input/output operations per second. Value is a number or a literal string unlimited. Value of 0 means "unlimited". By default a container has no IOPS limit.

Suspending and resuming

Checkpointing is a feature of OpenVZ kernel which allows to save a complete in-kernel state of a running container, and to restore it later.

suspend|chkpnt CTID [--dumpfile name]

This command suspends a container to a dump file If an option --dumpfile is not set, default dump file name /vz/dump/Dump.CTID is used.

resume|restore CTID [--dumpfile name]

This command restores a container from the dump file created by the suspend command.

Snapshotting

Snapshotting is a feature based on checkpointing and ploop shapshots. It allows to save a complete state of container file system. Plus, if the container is running, it’s in-memory state (as in checkpointing). Note that snapshot functionality is only working for containers on ploop device.

snapshot CTID [--id uuid] [--name name] [--description desc]
[--skip-suspend] [--skip-config]

Creates a container snapshot, i.e. saves the current container state, including its file system state, running processes state, and configuration file.

If a container is running, and --skip-suspend option is not specified, a container is checkpointed and then restored, and CT memory dump becomes the part of snapshot.

Unless --skip-config option is given, container configuration file is saved to the snapshot.

If uuid is not specified, it is auto-generated. Options --name and --description can be used to specify the snapshot name and description, respectively. Name is displayed by snapshot-list.

snapshot-switch CTID [--skip-resume | --must-resume] [--skip-config]
--id
uuid

Switches the container to a snapshot identified by uuid, restoring its file system state, configuration (if available) and its running state (if available).

Note that the current state of a container (including its file system state and its configuration file) is lost!

Option --skip-resume is used to ignore a CT memory dump file in a snapshot, as a result the container will end up being in a stopped state (same as if a snapshot has been taken with --skip-suspend).

If option --must-resume is set, absense of a memory dump is treated as an error, and the inability to restore from the memory dump is treated as an error rather than warning.

Option option --skip-config is used to ignore the CT configuration file in a snapshot, i.e. the current configuration file will be left as is.

snapshot-delete CTID --id uuid

Removes a specified snapshot.

snapshot-mount CTID --id uuid --target directory

Mounts a snapshot specified by uuid to a directory. Note this mount is read-only.

snapshot-umount CTID --id uuid

Unmounts a specified snapshot.

snapshot-list CTID [-H] [-o field[,field...] [--id uuid]

List container’s snapshots.

You can suppress displaying header using -H option.

You can use the -o option to display only the specified field(s). List of available fields can be obtained using -L option.

Performing container actions

create

CTID [--ostemplate name] [--config name] [--layout simfs|ploop[:{expanded|plain|raw}]] [--diskspace kbytes] [--diskinodes num] [--private path] [--root path] [--ipadd addr] [--hostname name] [--name name] [--local_uid uid] [--local_gid gid]

Creates a new container area. This operation should be done once, before the first start of the container.

By default, an OS template denoted by DEF_OSTEMPLATE parameter of vz.conf(5) is used to create a container. This can be overwritten by --ostemplate option.

By default, a new container configuration file is created from a sample configuration denoted by value of CONFIGFILE parameter of vz.conf(5). If the container configuration file already exists, it will not be modified.

The value of CONFIGFILE can be overwritten by using the --config name option. This option can not be used if the container configuration file already exists.

A new container can either be created using simfs filesystem or on a ploop device. The default is set by value of VE_LAYOUT parameter of vz.conf(5) and can be overwritten by --layout option. In case ploop is used, one can additionally specify ploop disk image format after a colon. Possible ploop formats are expanded, plain and raw. Default is expanded. Using value other than expanded is not recommended and is currently not supported.

You can use --diskspace and --diskinodes options to specify container file system size. Note that for ploop layout, you will not be able to change inodes value later.

If DISKSPACE is not specified either in the sample configuration file used for creation or in global configuration file vz.conf(5), --diskspace parameter is required for ploop layout.

Suffixes G, M, K can also be specified (see Resource limits section for more info on suffixes).

You can use --root path option to sets the path to the mount point for the container root directory (default is VE_ROOT specified in vz.conf(5) file). Argument can contain literal string $VEID, which will be substituted with the numeric CT ID.

You can use --private path option to set the path to directory in which all the files and directories specific to this very container are stored (default is VE_PRIVATE specified in vz.conf(5) file). Argument can contain literal string $VEID, which will be substituted with the numeric CT ID.

You can use --ipadd addr option to assign an IP address to a container. Note that this option can be used multiple times.

You can use --hostname name option to set a host name for a container.

When running with an upstream Linux Kernel that supports user namespaces (>= 3.8), the parameters --local_uid and --local_gid can be used to select which uid and gid respectively will be used as a base user in the host system. Note that user namespaces provide a 1:1 mapping between container users and host users. If these options are not specified, the values LOCAL_UID and LOCAL_GID from global configuration file vz.conf(5) are used. An explicit --local_uid value of 0 will disable user namespace support, and run the container as a privileged user. In this case, --local_gid is ignored.

Warning: use --local_uid and --local_gid with care, specially when migrating containers. In all situations, the container’s files in the filesystem needs to be correctly owned by the host-side users.

destroy | delete CTID

Removes a container private area by deleting all files, directories and the configuration file of this container.

start CTID [--wait] [--force] [--skip-fsck] [--skip-remount]

Mounts (if necessary) and starts a container. Unless --wait option is specified, vzctl will return immediately; otherwise an attempt to wait till the default runlevel is reached will be made by vzctl.

Specify --force if you want to start a container which is disabled (see --disabled).

Specify --skip-fsck to skip fsck for ploop-based container filesystem (this option is used by vz initscript).

By default, if a container to be started happens to be already mounted, it is unmounted and mounted again. This behavior can be turned off by using --skip-remount flag.

Note that this command can lead to execution of premount, mount and start action scripts (see ACTION SCRIPTS below).

stop CTID [--fast] [--skip-umount]

Stops a container and unmounts it (unless --skip-umount is given). Normally, halt(8) is executed inside a container; option --fast makes vzctl use reboot(2) syscall instead which is faster but can lead to unclean container shutdown.

Note that vzctl stop is not asyncronous, in other words vzctl waits for container’s init to exit (unless --fast is given), which can take up to a few minutes. Default wait timeout is 120 seconds; it can be changed globally, by setting STOP_TIMEOUT in vz.conf(5), or per container (STOP_TIMEOUT in ctid.conf(5), see --stop-timeout).

Note that this command can lead to execution of stop, umount and postumount action scripts (see ACTION SCRIPTS below).

restart CTID [--wait] [--force] [--fast] [--skip-fsck]

Restarts a container, i.e. stops it if it is running, and starts again. Accepts all the start and stop options.

Note that this command can lead to execution of some action scripts (see ACTION SCRIPTS below).

status CTID

Shows a container status. This is a line with five or six words, separated by spaces.

First word is literally CTID.

Second word is the numeric CT ID.

Third word is showing whether this container exists or not, it can be either exist or deleted.

Fourth word is showing the status of the container filesystem, it can be either mounted or unmounted.

Fifth word shows if the container is running, it can be either running or down.

Sixth word, if exists, is suspended. It appears if a dump file exists for a stopped container (see suspend).

This command can also be usable from scripts.

mount CTID

Mounts container private area. Note that this command can lead to execution of premount and mount action scripts (see ACTION SCRIPTS below).

umount CTID

Unmounts container private area. Note that this command can lead to execution of umount and postumount action scripts (see ACTION SCRIPTS below).

Note that stop does umount automatically.

convert CTID [--layout ploop[:{expanded|plain|raw}]]

Convert CT private area to reside on a ploop device (available in kernel version 042stab052.8 and greater). Conversion should be performed when a container is stopped, plus disk space quota should be set.

compact CTID

Compact container image. This only makes sense for ploop layout.

quotaon CTID

Turn disk quota on. Not that mount and start does that automatically.

quotaoff CTID

Turn disk quota off. Not that umount and stop does that automatically.

quotainit CTID

Initialize disk quota (i.e. run vzquota init) with the parameters taken from the CT configuration file ctid.conf(5).

exec CTID command

Executes command in a container. Environment variables are not set inside the container. Signal handlers may differ from default settings. If command is -, commands are read from stdin.

exec2 CTID command

The same as exec, but return code is that of command.

runscript CTID script

Run specified shell script in the container. Argument script is a file on the host system which contents is read by vzctl and executed in the context of the container. For a running container, the command jumps into the container and executes the script. For a stopped container, it enters the container, mounts container’s root filesystem, executes the script, and unmounts CT root. In the latter case, the container is not really started, no file systems other than root (such as /proc) are mounted, no startup scripts are executed etc. Thus the environment in which the script is running is far from normal and is only usable for very basic operations.

enter CTID [--exec command [arg ...]]

Enters into a container (giving a container’s root shell). This option is a back-door for host root only. The proper way to have CT root shell is to use ssh(1).

Option --exec is used to run command with arguments after entering into container. This is useful if command to be run requires a terminal (so vzctl exec can not be used) and for some reason you can not use ssh(1).

You need to log out manually from the shell to finish session (even if you specified --exec).

console CTID [ttynum]

Attach to a container console. Optional ttynum argument is tty number (such as 4 for tty4), default is 1 which is used for container’s /dev/console.

Note the consoles are persistent, meaning that:
• it can be attached to even if the container is not running;
• there is no automatic detachment upon the container stop;
• detaching from the console leaves anything running in this console as is.

The following escape sequences are recognized by vzctl console. Note that these sequences are only recognized at the beginning of a line.

Esc then . to detach from the console.

Esc then ! to kill anything running on the console (SAK). This is helpful when one expects a login prompt but there isn’t one.

Other options

--help

Prints help message with a brief list of possible options.

--version

Prints vzctl version.

ACTION SCRIPTS

vzctl has an ability to execute user-defined scripts when a specific vzctl command is run for a container. The following vzctl commands can trigger execution of action scripts: start, stop, restart, mount and umount.

Action scripts are located in the /etc/vz/conf/ directory. There are global and per-CT scripts. Global scripts have a literal prefix of vps. and are executed for all containers. Per-CT scripts have a CTID. numeric prefix and are executed for the given container only.

Please note scripts are executed in a host system (CT0) context, with the exception of .start and .stop scripts, which are executed in a container context.

The following action scripts are currently defined:
vps.premount
, CTID.premount

Global and per-CT mount scripts which are executed for a container before it is mounted. Scripts are executed in the host system context, while a CT is not yet mounted or running. Global script, if exists, is executed first.

vps.mount, CTID.mount

Global and per-CT mount scripts which are executed for a container right after it is mounted. Otherwise they are the same as .premount scripts.

CTID.start

Right after vzctl has started a container, it executes this script in a container context.

CTID.stop

Right before vzctl has stopped a container, it executes this script in a container context.

vps.umount, CTID.umount

Global and per-CT umount scripts which are executed for a container before it is unmounted. Scripts are executed in the host system context, while a CT is mounted. Global script, if exists, is executed first.

vps.postumount, CTID.postumount

Global and per-CT umount scripts which are executed for a container right after it is unmounted. Otherwise they are the same as .umount scripts.

The environment passed to all the *mount scripts is the standard environment of the parent (i.e. vzctl) with two additional variables: $VEID and $VE_CONFFILE. The first one holds the ID of the container, and the second one holds the full path to the container configuration file. If the script needs to get other CT configuration parameters, such as $VE_ROOT, it needs to get those from global and per-CT configuration files.

Here is an example of a mount script, which makes host system’s /mnt/disk available to container(s). Script name can either be /etc/vz/conf/vps.mount or /etc/vz/conf/CTID.mount.

   # If one of these files does not exist then something
   # is really broken
   [ -f /etc/vz/vz.conf ] || exit 1
   [ -f $VE_CONFFILE ] || exit 1
   # Source both files. Note the order is important.
   . /etc/vz/vz.conf
   . $VE_CONFFILE
   SRC=/mnt/disk
   DST=/mnt/disk
   mount -n -t simfs $SRC ${VE_ROOT}${DST} -o $SRC

EXIT STATUS

Returns 0 upon success, or an appropriate error code in case of an error:

1

Failed to set a UBC parameter

2

Failed to set a fair scheduler parameter

3

Generic system error

5

The running kernel is not an OpenVZ kernel (or some OpenVZ modules are not loaded)

6

Not enough system resources

7

ENV_CREATE ioctl failed

8

Command executed by vzctl exec returned non-zero exit code

9

Container is locked by another vzctl invocation

10

Global OpenVZ configuration file vz.conf(5) not found

11

A vzctl helper script file not found

12

Permission denied

13

Capability setting failed

14

Container configuration file ctid.conf(5) not found

15

Timeout on vzctl exec

16

Error during vzctl suspend

17

Error during vzctl resume

18

Error from setluid() syscall

20

Invalid command line parameter

21

Invalid value for command line parameter

22

Container root directory (VE_ROOT) not set

23

Container private directory (VE_PRIVATE) not set

24

Container template directory (TEMPLATE) not set

28

Not all required UBC parameters are set, unable to start container

29

OS template is not specified, unable to create container

31

Container not running

32

Container already running

33

Unable to stop container

34

Unable to add IP address to container

40

Container not mounted

41

Container already mounted

43

Container private area not found

44

Container private area already exists

46

Not enough disk space

47

Bad/broken container (/sbin/init or /bin/sh not found)

48

Unable to create a new container private area

49

Unable to create a new container root area

50

Unable to mount container

51

Unable to unmount container

52

Unable to delete a container

53

Container private area not exist

60

vzquota on failed

61

vzquota init failed

62

vzquota setlimit failed

63

Parameter DISKSPACE not set

64

Parameter DISKINODES not set

65

Error setting in-container disk quotas

66

vzquota off failed

67

ugid quota not initialized

71

Incorrect IP address format

74

Error changing password

78

IP address already in use

79

Container action script returned an error

82

Config file copying error

86

Error setting devices (--devices or --devnodes)

89

IP address not available

91

OS template not found

99

Ploop is not supported by either the running kernel or vzctl.

100

Unable to find container IP address

104

VE_NETDEV ioctl error

105

Container start disabled

106

Unable to set iptables on a running container

107

Distribution-specific configuration file not found

109

Unable to apply a config

129

Unable to set meminfo parameter

130

Error setting veth interface

131

Error setting container name

133

Waiting for container start failed

139

Error saving container configuration file

148

Error setting container IO parameters (ioprio)

150

Ploop image file not found

151

Error creating ploop image

152

Error mounting ploop image

153

Error unmounting ploop image

154

Error resizing ploop image

155

Error converting container to ploop layout

156

Error creating ploop snapshot

157

Error merging ploop snapshot

158

Error deleting ploop snapshot

159

Error switching ploop snapshot

166

Error compacting ploop image

167

Error listing ploop snapsots

EXAMPLES

To create and start "basic" container with ID of 1000 using centos-5 OS template and IP address of 192.168.10.200:

   vzctl create 1000 --ostemplate centos-5 --config basic
   vzctl set 1000 --ipadd 192.168.10.200 --save
   vzctl start 1000

To set number of processes barrier/limit to 80/100, and PTY barrier/limit to 16/20 PTYs:

   vzctl set 1000 --numproc 80:100 -t 16:20 --save

To execute command ls -la in this container:

   vzctl exec 1000 /bin/ls -la

To execute command pipe ls -l / | sort in this container:

   vzctl exec 1000 ’ls -l / | sort’

To enter this container and execute command apt-get install vim:

   vzctl enter 1000 --exec apt-get install vim

Note that in the above example you will need to log out from the container’s shell after apt-get finishes.

To enter this container, execute command apt-get install vim and logout after successful installation (or stay inside the container if installation process failed) use &&:

   vzctl enter 1000 --exec "apt-get install vim && logout"

To enter this container, execute command apt-get install vim and logout independently of exit code of installation process use ;:

   vzctl enter 1000 --exec "apt-get install vim ; logout"

Note that you need to quote the command if you use && or ;.

To stop this container:

   vzctl stop 1000

To permanently remove this container:

   vzctl destroy 1000

FILES

/etc/vz/vz.conf
/etc/vz/conf/<i>CTID</i>.conf
/etc/vz/conf/vps.{premount,mount,umount,postumount}
/etc/vz/conf/<i>CTID</i>.{premount,mount,start,stop,umount,postumount}
/proc/vz/veinfo
/proc/vz/vzquota
/proc/user_beancounters
/proc/bc/*
/proc/fairsched

SEE ALSO

vz.conf(5), ctid.conf(5), arpsend(8), vzcalc(8), vzcfgvalidate(8), vzcpucheck(8), vzifup-post(8), vzlist(8), vzmemcheck(8), vzmigrate(8), vzpid(8), vzquota(8), vzsplit(8), vzubc(8), UBC.

LICENSE

Copyright (C) 2000-2013, Parallels, Inc. Licensed under GNU GPL.