Linux Containers (lvc.sourceforge.net)

bit

Looking for advise, tips etc.

Has anyone used Linux Containers or is using it on their LEB's. Mainly looking at those using it on OpenVZ (if it is possible) maybe on XEN PV.

How secure is it as compared to say OpenVZ or in comparison to FreeBSD jails.

Damian

lvc.sf.net = "Linux Video Central"

(edit) Found it: http://lxc.sourceforge.net/

Damian

Wasn't this what the 'mainstream' kernel developers were working on, before OVZ matured and mainstream kernel started looking at including OVZ in the standard kernel?

I don't think this has been updated in a couple of years.

bit

Most of the how to's I've found for Debian, were written in 2011 one in 2009

http://www.jotschi.de/?p=554

http://jim.studt.net/depository/index.php/using-linux-containers-with-debian-lenny

http://www.wallix.org/2011/09/20/how-to-use-linux-containers-lxc-under-debian-squeeze/

http://nigel.mcnie.name/blog/a-five-minute-guide-to-linux-containers-for-debian

It looks like the http://lxc.sourceforge.net/ site is a ghost town, no updates this year.

Oh well.

jarland

Why in the world would you want to setup containers on an openvz LEB....

Damian

@jarland said: Why in the world would you want to setup containers on an openvz LEB....

Low, low end box?

bit

@jarland - For the same reason one set's up Jails on Freebsd.

ihatetonyy

@jarland said: Why in the world would you want to setup containers on an openvz LEB....

LEBception.

ShardHost

@jarland said: Why in the world would you want to setup containers on an openvz LEB....

...when you could wrap this all up in a KVM too!

bit

@ShardHost - if only.

I have a bunch of OpenVZ based LEB's. I'm looking to try to setup something similar to Jails on them. I've read that OpenVZ on OpenVZ is not a good idea. From what I read of Linux Containers, it looks to be similar to the Jails way.

corehosting

@Damian said: Wasn't this what the 'mainstream' kernel developers were working on, before OVZ matured and mainstream kernel started looking at including OVZ in the standard kernel?

I don't think this has been updated in a couple of years.

LXC project is very active. Debian stopped supporting OpenVZ in favor of LXC in its next release. Even newer OpenVZ userlands are starting to support it in mainstream kernels...

Let's say it's the future of container technology on Linux. Thing is right now it's still lacking features and security. First it's very insecure by default. A root user inside a container is root on the host... Second, while features are added quickly, it's still lacking a lot to replace OVZ: Not as good userlands, no good memory/CPU limitations, no live migration, can't exec inside a container, can't enter a container without setting up console and such, etc....

It's growing fast and new features almost comes with each new kernels.

joepie91

@corehosting said: LXC project is very active. Debian stopped supporting OpenVZ in favor of LXC in its next release. Even newer OpenVZ userlands are starting to support it in mainstream kernels...

Let's say it's the future of container technology on Linux. Thing is right now it's still lacking features and security. First it's very insecure by default. A root user inside a container is root on the host... Second, while features are added quickly, it's still lacking a lot to replace OVZ: Not as good userlands, no good memory/CPU limitations, no live migration, can't exec inside a container, can't enter a container without setting up console and such, etc....

It's growing fast and new features almost comes with each new kernels.

So... what would be the reason to use LXC instead of OpenVZ? To me, it looks like it's not better in any respect.

corehosting

Well depends on what you're doing... If you don't need security and not change your kernel, LXC is a good way. Other than that, there isn't in my point of view...

Zen

So there's no advantage..

corehosting

Not yet. When they'll have the same functionalities and/or ovz userlands fully support mainstream kernel, there'll be no more need to apply ovz patch.

lbft

@joepie91 said: So... what would be the reason to use LXC instead of OpenVZ? To me, it looks like it's not better in any respect.

The only advantages that I can see are that it seems to have upstream kernel support and that it isn't a hacky mess. Debian likes purity so it makes sense they'd pick a currently-useless pure solution over an ugly working one, especially since almost nobody actually uses the Debian OpenVZ kernels.

Corey

@lbft probably becauase nobody knows how to administer openvz without a panel...lol

Taz

@Corey vzctl and other goodies are fun. I miss subigo when it comes to ovz related discussions.

jarland

@Taz said: vzctl and other goodies are fun. I miss subigo when it comes to ovz related discussions.

Lol you just google openvz to find a random term like "vzctl" so you could look like you know something? How were you even a provider, what are you like 15? I'm so sick of this new round of kid providers backed by this kindergarten community.

There's my subigo impression, minus the F bombs.

Taz

Lol. I am talking about his ovz related knowledge. His Fbomb, cursing nd other fun things started after he sold zensix (wasn't it?) and got tired of bottom feeders requests. He was and is a talented individual.

Zen

@jarland said: Lol you just google openvz to find a random term like "vzctl" so you could look like you know something? How were you even a provider, what are you like 15? I'm so sick of this new round of kid providers backed by this kindergarten community.

Read this first and thought Subigo was back, awesome impression :D

Raymii

@joepie91 said: First it's very insecure by default. A root user inside a container is root on the host... Second, while features are added quickly, it's still lacking a lot to replace OVZ: Not as good userlands, no good memory/CPU limitations, no live migration, can't exec inside a container, can't enter a container without setting up console and such, etc....

This is why I prefer openVZ over LXC. And, LXC misses all the templates that OpenVZ has...

@lbft said: The only advantages that I can see are that it seems to have upstream kernel support and that it isn't a hacky mess.

Recent releases of OpenVZ kernels for CentOS/Debian (proxmox) have proven to be very stable for me. Last year I got a kernel panic on a debian/openvz kernel when I tried an IP change, but that turned out to be a faulty network card. For the rest, OpenVZ kernels run very good, at least for me.

And, how is it a hacky mess?