X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=doc%2Fconfiguration.html;h=7e2f6051a4f964801035374d35b460ead77532bf;hb=b7785f953cf988346d0f36c5852af39db3d1b00c;hp=e82d9e8c9af6f7ad6bd80b5165845f8c2ade63fd;hpb=8cf13bb177d92c93eb73dc8939777150536c2d00;p=util-vserver.git diff --git a/doc/configuration.html b/doc/configuration.html index e82d9e8..7e2f605 100644 --- a/doc/configuration.html +++ b/doc/configuration.html @@ -4,11 +4,11 @@ The /etc/vservers directory - + - +

The content of the /etc/vservers directory

@@ -17,6 +17,44 @@ /etc/vservers/.defaults

+ cachebase +
+
+A link to the directory which will hold cached information about +vservers. +
+
+ context.dynamic +
+
+If this file exists, kernel-side dynamic contexts will be used by the "vserver +... build" command. Otherwise a context will be generated, based on the +contents of context.next. +
+
+ context.next +
+
+The context id to use for the next guest created by "vserver ... build". +
+
+ fstab +
+
+The default fstab file to put in newly built guests. +
+
+ namespace-cleanup-skip +
+
+List of paths to skip during namespace cleanup. +
+
nonamespace
@@ -27,6 +65,15 @@ there. In this mode the /vservers directory must have the 'barrier' attribute. Else, common chroot(2) exploits are possible. + +
+ nonamespace-cleanup +
+
+Disable namespace cleanup globally. It can be overridden for a single vserver +by setting the namespace-cleanup flag +there.
@@ -40,6 +87,15 @@ to VSERVER mapping; Under kernel 2.6 it is unused. NOTE: this link exists in 0.30.202+ only; in previous versions it was a vserver specific setting. + +
+ shell +
+
+Contains the pathname of the shell which will be used by the "vserver +... enter" command. Can be overridden by the +per-guest shell.
@@ -51,6 +107,19 @@ a vserver specific setting. /etc/vservers/.defaults/apps
- + /etc/vservers/.defaults/apps/build +
  +
  - + options +
    +
    +A list of default options to supply to vserver ... build, one option per line. +
    +
  +
- /etc/vservers/.defaults/apps/debootstrap
  @@ -76,6 +145,14 @@ from this uri and install it at a temporary place. /etc/vservers/.defaults/apps/init
  - + environment +
    +
    +The environment to set when starting guests. Contains one VAR=VAL +pair per line. +
    +
  - tty
    @@ -103,6 +180,65 @@ distribution specific configuration file.
- + /etc/vservers/.defaults/apps/vdevmap +
  +
  - + /etc/vservers/.defaults/apps/vdevmap/x +
    +
    'x' is an arbitrary name, replace it with e.g. device names
    +
    - + create +
      +
      When this file exists, the device can be created (if the guest has CAP_MKNOD)
      +
    - + device +
      +
      Contains the name of a device node
      +
    - + flags +
      +
      This file will let you specify unimplemented flags manually
      +
    - + open +
      +
      When this file exists, the device can be opened
      +
    - + remap +
      +
      +When this file exists, target will +have to exist as well and opening the device will in fact open the target device +
      +
    - + target +
      +
      Contains the device node of the target node to open instead of the device when remap is set
      +
    +
  +
- + /etc/vservers/.defaults/apps/vlogin +
  +
  - + disable +
    +
    +When this file exists, vlogin isn't used on vserver <guest> enter. +
    +
  +
- /etc/vservers/.defaults/apps/vprocunhide
  @@ -111,7 +247,7 @@ distribution specific configuration file. files
  
  -A list of files which will be made visibly by vprocunhide. Wildcards are +A list of files which will be made visible by vprocunhide. Wildcards are allowed and anything ending in '/' will be processed recursively. When this file exists, it overrides the defaults in SYSDEFAULTDIR/vprocunhide-files. The entries there must be absolute filenames inclusive the leading '/proc'. @@ -163,7 +299,7 @@ skipped. handler
  
  -See vshelper/action. +See vshelper/action.
@@ -225,6 +361,53 @@ filesystem.

+ /etc/vservers/.defaults/files +
+

This directory contains some files which will be copied to the guests during build.

+ hosts +
+
The default /etc/hosts file.
+
+ krb.conf +
+
The default /etc/krb.conf file.
+
+ krb.realms +
+
The default /etc/krb.realms file.
+
+ krb5.conf +
+
The default /etc/krb5.conf file.
+
+ ldap.conf +
+
The default /etc/ldap.conf file.
+
+ localtime +
+
The default /etc/localtime file.
+
+ nsswitch.conf +
+
The default /etc/nsswitch.conf file.
+
+ resolv.conf +
+
The default /etc/resolv.conf file.
+

/etc/vservers/.defaults/init
@@ -236,12 +419,33 @@ filesystem.

+ /etc/vservers/.defaults/interfaces +
+

+ vlandev +
+
+When this file exists, the steps which setup and destroy a VLAN +interface will be executed. +
+

/etc/vservers/.distributions

+ template +
+
+Symlink to the default template for this distribution. +
+
/etc/vservers/.distributions/dist
@@ -362,13 +566,27 @@ The master yum configuration file. It supports the @YUMETCDIR@, The configuration directory for the vserver vserver-name.
- + badness +
  +
  +Contains the bias to be applied to processes in this guest when the OOM-killer strikes. +
  +
- bcapabilities
  
  -[experimental; name is subject of possible change] Contains the system capabilities. See -lib/bcaps-v13.c +Contains the system capabilities. See +lib/bcaps-v13.c for possible values. +
  +
- + cache +
  +
  +Path of the storage area for cached information about this vserver.
- @@ -383,8 +601,7 @@ only; for 2.6 use bcapabilities. ccapabilities
  
  -[experimental; name is subject of possible change] Contains the -context capabilities. See lib/ccaps-v13.c +Contains the context capabilities. See lib/ccaps-v13.c for possible values.
- flags
  
  -Contains per line a flag. See lib/cflags-v13.c +Contains per line a flag. See lib/cflags-v13.c for possible values.
  -
  -
  -
  fakeinit
  -
  -
  -The new process will believe it is process number 1. Useful to run a -real /sbin/init in a vserver. Warning: this flag should not be used -unless you know what you are doing. Often, it is better to use the -'plain' initstyle. -
  -
  -
  lock
  -
  -
  -The new process is trapped and can't use chcontext anymore. -
  -
  -
  nproc
  -
  -
  -Limit the number of process in the vserver according to -ulimit setting. Normally, ulimit is a per user thing. -With this flag, it becomes a per vserver thing. -
  -
  -
  private
  -
  -
  -No one can join this security context once created. -
  -
  -
  sched
  -
  -
  -The new process and its children will share a common -
  -
  -
  ulimit
  -
  -
  -Apply the current ulimit to the whole context -
  -
  -
  -
- fstab @@ -464,7 +636,7 @@ the 'fstab' file should be used.
  
  The fstab file for the vserver. Entries in this file will be mounted -within the network context of the host; this means that mount will be +within the network context of the guest; this means that mount will be called as chbind <options> mount .... See fstab also.
  @@ -483,6 +655,46 @@ will be assumed as this name.
  Overrides the global nonamespace flag and enables namespace usage for the current vserver. +
  +
- + namespace-cleanup +
  +
  +Overrides the global nonamespace-cleanup flag and enables +namespace cleanup for the current vserver. +
  +
- + namespace-cleanup-skip +
  +
  +List of paths to skip during namespace cleanup. This overrides the global +namespace-cleanup-skip +file. +
  +
- + ncapabilities +
  +
  +Contains the network capabilities. See lib/ncaps-net.c +for possible values. +
  +
- + ncontext +
  +
  +Contains the network context id which shall be used for the vserver. Valid range is 2 through 49151. +
  +
- + nflags +
  +
  +Contains a network flag per line. See lib/nflags-net.c +for possible values.
- @@ -524,7 +736,7 @@ the vserver is stopped, this can be a dangling symlink. schedule
  
  -[experimental; name is subject of possible change] Contains the +[deprecated; use sched instead] Contains the scheduler parameters, one per line. The Hard CPU limit uses a mechanism called a Token Bucket. the @@ -535,21 +747,31 @@ a running process consumes one token from the bucket, unless the bucket is empty. If the bucket is empty the process is put in the hold queue. When the bucket has been refilled to at least M tokens, all on hold processes are rescheduled. + +See the Linux +VServer Wiki for more information about this file.
- +
- shell
  
  Contains the pathname of the shell which will be used by the "vserver ... enter" command. +
  +
- + tag +
  +
  +Contains the filesystem tag which shall be used for the vserver. Valid range is 2 through 49151.
- vdir
  
  -Path of the vserver root directory +Path of the vserver root directory.
- @@ -613,6 +835,14 @@ the current vserver can be started. At shutdown, the current vserver will be stopped before its dependencies. Content of this file are vserver ids (one name per line). +
- + environment +
  +
  +The environment to set when starting the guest. Contains one VAR=VAL +pair per line. +
- killseq @@ -677,10 +907,56 @@ from/to at startup via initscript.
- /etc/vservers/vserver-name/apps/vshelper + /etc/vservers/vserver-name/apps/vdevmap
- + /etc/vservers/vserver-name/apps/vdevmap/x +
  +
  'x' is an arbitrary name, replace it with e.g. device names
  +
  - + create +
    +
    When this file exists, the device can be created (if the guest has CAP_MKNOD)
    +
  - + device +
    +
    Contains the name of a device node
    +
  - + flags +
    +
    This file will let you specify unimplemented flags manually
    +
  - + open +
    +
    When this file exists, the device can be opened
    +
  - + remap +
    +
    +When this file exists, target will +have to exist as well and opening the device will in fact open the target device +
    +
  - + target +
    +
    Contains the device node of the target node to open instead of the device when remap is set
    +
  +
+
+ /etc/vservers/vserver-name/apps/vshelper +
+
- action
  
  @@ -721,7 +997,7 @@ the vs_reboot() function in the kernel for more details.
  
  The timeout in seconds which is used when synchronising vserver -startup/shutdown with the vshelper. When no set, 30 seconds will be +startup/shutdown with the vshelper. When not set, 30 seconds will be assumed.
@@ -825,6 +1101,81 @@ filesystem.

+ /etc/vservers/vserver-name/cpuset +
+

+Puts the guest in a cpuset. Required entries are name, cpus and mems. +

+ cpu_exclusive +
+
Is the CPU assignment exclusive?
+
+ cpus +
+
The list of CPUs in this cpuset
+
+ mems +
+
The list of Memory Nodes in this cpuset
+
+ mems_exclusive +
+
Is the memory node assignment exclusive?
+
+ name +
+
The name of the cpuset for this vserver
+
+ nocreate +
+
When this file exists, the cpuset will be assumed to exist already
+

+ /etc/vservers/vserver-name/dlimits +
+

+Note that all entries are required for the disk limit to be applied. +

+ /etc/vservers/vserver-name/dlimits/x +
+
'x' is an arbitrary name, replace it with e.g. integers
+
- + directory +
  +
  The directory to which the limit should be applied
  +
- + inodes_total +
  +
  The amount of inodes this vserver should be limited to
  +
- + reserved +
  +
  How much space (percentage-wise) should be reserved for the root user
  +
- + space_total +
  +
  The amount of space this vserver should be limited to (measured in blocks of 1024 bytes)
  +
+

/etc/vservers/vserver-name/interfaces
@@ -832,18 +1183,33 @@ filesystem.

bcast
-

The default broadcast address.

The guest's broadcast address.

dev
-

The default network device.

The default network device. See iface/dev for more information.

+ lback +
+

The guest's loopback address.

mask

The default network mask.

+ novlandev +
+

+When this file exists, the steps which setup and destroy a VLAN +interface will be skipped. This overrides the global +vlandev setting for +this vserver. +

prefix
@@ -854,6 +1220,14 @@ filesystem.

The default scope of the network interfaces.

+ vlandev +
+

+When this file exists, the steps which setup and destroy a VLAN +interface will be executed for all interfaces of this vserver. +

/etc/vservers/vserver-name/interfaces/iface
@@ -864,25 +1238,35 @@ usage with chbind. Both happens in alphabetical order numbers like '00' are good names for these directories.

- bcast -
-
The broadcast address.
-
+
dev
-
The network device.
+
The network device. When this is specified, the IP address will be assigned and removed when starting and stopping the guest.
disabled

When this file exists, this interface will be ignored.
+ gid +
+
+Sets the group ownership of tun/tap interfaces. Requires a group id, +not a group name. +
+
ip
-
The ip which will be assigned to this interface.
+
The IP address which will be assigned to this interface.
+
+ linktype +
+
+Sets the link type of tun/tap interfaces. +
mask @@ -898,6 +1282,14 @@ this file. Without such an entry, the IP will not be shown by ifconfig but by ip addr ls only. Such a labeled interface is known as an "alias" also (e.g. 'eth0:foo'). +
+ nocsum +
+
+If a tun or tap interface is created, the presence of this file will +disable checksumming on it. +
nodev @@ -906,6 +1298,16 @@ a labeled interface is known as an "alias" also (e.g. 'eth0:foo'). When this file exists, the interface will be assumed to exist already. This can be used to assign primary interfaces which are created by the host or another vserver. + +
+ novlandev +
+
+When this file exists, the steps which setup and destroy a VLAN +interface will be skipped. This will override the global +vlandev and the per-guest +vlandev.
@@ -918,6 +1320,46 @@ created by the host or another vserver.

The scope of the network interface.
+ shared +
+
+When this file exists, the tun/tap interface created will not be +owned by this particular guest. +
+
+ tap +
+
+When this file exists, a tap interface will be created when the guest +starts, and removed when the guest stops. +
+
+ tun +
+
+When this file exists, a tun interface will be created when the guest +starts, and removed when the guest stops. +
+
+ uid +
+
+Sets the ownership of tun/tap interfaces. Requires a user id, not a +username. +
+
+ vlandev +
+
+When this file exists, the steps which setup and destroy a VLAN +interface will be executed. +
+

@@ -927,7 +1369,8 @@ created by the host or another vserver.

A directory with resource limits. Possible resources are cpu, fsize, -data, stack, core, rss, nproc, nofile, memlock, as and locks. This +data, stack, core, rss, nproc, nofile, memlock, as, locks, msgqueue, +nsock, openfd, anon, shmem, semary, nsems and dentry. This configuration will be honored for kernel 2.6 only.

resource.hard

-A file which contains the hard- of the given resource in the first +A file which contains the hard-limit of the given resource in the first line. The special keyword 'inf' is recognized.

resource.min

-A file which contains the guaranted minimum of the given resource in +A file which contains the guaranteed minimum of the given resource in the first line. The special keyword 'inf' is recognized.

resource.soft

-A file which contains the soft- of the given resource in the first +A file which contains the soft-limit of the given resource in the first line. The special keyword 'inf' is recognized.

+ /etc/vservers/vserver-name/sched +
+

+ fill-rate +
+
Amount of tokens to add each interval
+
+ fill-rate2 +
+
Amount of tokens to add each interval2 when advancing idle time
+
+ idle-time +
+
When this file exists, advancing idle time is activated
+
+ interval +
+
The interval between refills of the bucket
+
+ interval2 +
+
The interval between refills of the bucket when advancing idle time
+
+ priority-bias +
+
Bias added to priorities calculated within the guest (result is clamped to -20/+19)
+
+ tokens +
+
The initial amount of tokens to put in the bucket
+
+ tokens-max +
+
The bucket's size
+
+ tokens-min +
+
The minimum amount of tokens required to unhold the context
+
+ /etc/vservers/vserver-name/sched/cpu-id +
+
This directory contains per-CPU and/or per-bucket specific settings. Remember to set the cpu-id file. All CPUs inherit the global settings.
+
- + bucket-id +
  +
  The bucket to apply these settings to
  +
- + cpu-id +
  +
  The CPU to apply these settings to
  +
- + fill-rate +
  +
  Amount of tokens to add each interval
  +
- + fill-rate2 +
  +
  Amount of tokens to add each interval2 when advancing idle time
  +
- + idle-time +
  +
  When this file exists, advancing idle time is activated
  +
- + interval +
  +
  The interval between refills of the bucket
  +
- + interval2 +
  +
  The interval between refills of the bucket when advancing idle time
  +
- + priority-bias +
  +
  Bias added to priorities calculated within the guest (result is clamped to -20/+19)
  +
- + tokens +
  +
  The initial amount of tokens to put in the bucket
  +
- + tokens-max +
  +
  The bucket's size
  +
- + tokens-min +
  +
  The minimum amount of tokens required to unhold the context
  +
+

/etc/vservers/vserver-name/scripts
@@ -976,6 +1532,15 @@ environment variable must be set by one of the in-shellcontext scripts (the non-executable ones).

+ initialize +
+
+The scriptlet which will be executed before the root filesystem is mounted and +the configuration has been loaded. Before executing the script, the +configuration directory will be made the working directory. +
+
post-start
@@ -1032,6 +1597,21 @@ enabled and the directories are mounted. Before executing the script, the configuration directory will be made the working directory.
+ /etc/vservers/vserver-name/scripts/initialize.d +
+
+Repository of initialize like scripts. Before executing the script, +the configuration directory will be made the working directory. +
+
- + script +
  +
  See initialize.
  +
+
/etc/vservers/vserver-name/scripts/post-start.d
@@ -1124,13 +1704,56 @@ the configuration directory will be made the working directory.

+ /etc/vservers/vserver-name/spaces +
+

+ mask +
+
Contains a mask of spaces to clone/enter
+
+ net +
+
Enable network virtualization for this guest
+
+ pid +
+
Enables pid virtualization for this guest
+

+ /etc/vservers/vserver-name/sysctl +
+

+ /etc/vservers/vserver-name/sysctl/x +
+
'x' is an arbitrary name, replace it with e.g. integers
+
- + setting +
  +
  The sysctl setting
  +
- + value +
  +
  The value
  +
+

/etc/vservers/vserver-name/ulimits

A directory with ulimits. Possible resources are cpu, data, fsize, -locks, memlock, nofile, nproc, rss and/or stack. This configuration -will be honored for kernel 2.4 only. +locks, memlock, nofile, nproc, rss and/or stack.

@@ -1145,7 +1768,7 @@ in the first line. The special keyword 'inf' is recognized. resource.hard

-A file which contains the hard- of the given resource in the first +A file which contains the hard-limit of the given resource in the first line. The special keyword 'inf' is recognized.

resource.soft

-A file which contains the soft- of the given resource in the first +A file which contains the soft-limit of the given resource in the first line. The special keyword 'inf' is recognized.