docs:migrate-vserver-to-lxc
Differences
This shows you the differences between two versions of the page.
Next revision | Previous revision | ||
docs:migrate-vserver-to-lxc [2017/07/25 15:36] – created 95.208.70.15 | docs:migrate-vserver-to-lxc [2017/07/25 16:03] (current) – 95.208.70.15 | ||
---|---|---|---|
Line 4: | Line 4: | ||
host system: debian jessie 8.9 | host system: debian jessie 8.9 | ||
+ | |||
+ | the host uses lvm2, one lv per vserver | ||
you need: LXC > Version 2.0, install it from jessie-backports | you need: LXC > Version 2.0, install it from jessie-backports | ||
Line 9: | Line 11: | ||
do not install dnsmasq! | do not install dnsmasq! | ||
- | I use [[http:// | + | I use [[http:// |
===== prereq. ===== | ===== prereq. ===== | ||
< | < | ||
+ | if ! grep -q "[^#]* jessie-backports" | ||
+ | vo -o / | ||
+ | echo "deb http:// | ||
+ | vo -i / | ||
+ | fi | ||
+ | apt-get update | ||
+ | apt-get install --no-install-recommends lxc/ | ||
+ | # new kernel | ||
+ | apt-get install linux-image-4.9.0-0.bpo.3-amd64 linux-base=4.3~bpo8+1 | ||
+ | apt-get install linux-image-amd64 | ||
+ | apt-get clean | ||
+ | </ | ||
+ | |||
+ | ===== start migration ===== | ||
+ | |||
+ | < | ||
+ | # stop vservers: | ||
+ | VSERVERS=$( | ||
+ | vserver-stat | awk 'NR > 1 { print $NF }' | ||
+ | ) | ||
+ | echo " | ||
+ | xargs -r -i% vserver % stop < / | ||
+ | |||
+ | reboot | ||
+ | </ | ||
+ | |||
+ | System should boot with Linux 4.9.0-0.bpo.3-amd64 . | ||
+ | |||
+ | The subuid mechanism needs the uid/gid values inside the container | ||
+ | to be recalculated and changed. | ||
+ | [[http:// | ||
+ | smoothly. | ||
+ | |||
+ | < | ||
+ | if [ ! -f / | ||
+ | wget http:// | ||
+ | chmod 755 / | ||
+ | fi | ||
+ | </ | ||
+ | |||
+ | Create a default container configuration: | ||
+ | |||
+ | < | ||
+ | if [ ! -f / | ||
+ | touch / | ||
+ | vo -o / | ||
+ | |||
+ | cat << EOF > / | ||
+ | lxc.autodev = 1 | ||
+ | lxc.kmsg = 0 | ||
+ | |||
+ | lxc.network.type = veth | ||
+ | lxc.network.flags = up | ||
+ | lxc.network.name = eth0 | ||
+ | |||
+ | lxc.mount.auto = sys:ro proc:mixed cgroup-full: | ||
+ | |||
+ | lxc.cap.keep = chown net_raw dac_override dac_read_search fowner fsetid kill setgid setuid linux_immutable net_bind_service net_broadcast ipc_lock ipc_owner sys_chroot sys_ptrace sys_pacct sys_boot sys_nice sys_resource sys_tty_config lease audit_write audit_control syslog wake_alarm | ||
+ | |||
+ | lxc.pts = 1024 | ||
+ | |||
+ | lxc.cgroup.devices.deny = a | ||
+ | |||
+ | lxc.aa_profile = unconfined | ||
+ | |||
+ | # --- devices --- # | ||
+ | # /dev/null and zero | ||
+ | lxc.cgroup.devices.allow = c 1:3 rwm | ||
+ | lxc.cgroup.devices.allow = c 1:5 rwm | ||
+ | |||
+ | # consoles | ||
+ | lxc.cgroup.devices.allow = c 5:1 rwm | ||
+ | lxc.cgroup.devices.allow = c 5:0 rwm | ||
+ | lxc.cgroup.devices.allow = c 4:0 rwm | ||
+ | lxc.cgroup.devices.allow = c 4:1 rwm | ||
+ | |||
+ | # / | ||
+ | lxc.cgroup.devices.allow = c 1:9 rwm | ||
+ | lxc.cgroup.devices.allow = c 1:8 rwm | ||
+ | lxc.cgroup.devices.allow = c 136:* rwm | ||
+ | lxc.cgroup.devices.allow = c 5:2 rwm | ||
+ | |||
+ | # rtc | ||
+ | lxc.cgroup.devices.allow = c 254:0 rwm | ||
+ | |||
+ | lxc.mount.entry=run run tmpfs rw, | ||
+ | EOF | ||
+ | |||
+ | vo -i / | ||
+ | fi | ||
+ | </ | ||
+ | |||
+ | ===== migrate a single vserver ===== | ||
+ | |||
+ | < | ||
+ | # name of the volume group | ||
+ | VGNAME=' | ||
+ | CONTAINER_NAME=' | ||
+ | CONTAINER_IP=$( cat / | ||
+ | CONTAINER_BRIDGE=$( cat / | ||
+ | CONTAINER_NETMASK=$( cat / | ||
+ | if [ -z " | ||
+ | # netzmaske der ersten IPv4-adresse | ||
+ | CONTAINER_NETMASK=$( ip a l dev $CONTAINER_BRIDGE | awk -F"[ /]+" '$2 == " | ||
+ | fi | ||
+ | CONTAINER_GATEWAY=$( ip r l | awk '$1 == " | ||
+ | # https:// | ||
+ | CONTAINER_MACADDR_PFX=' | ||
+ | CONTAINER_SUBUID_STEP=' | ||
+ | CONTAINER_SUBUID=$( | ||
+ | awk -F: '{ print $2}' /etc/subuid | sort -n | tail -1 | awk -v s=$CONTAINER_SUBUID_STEP '{ print int (( $1 + 2 * s - 1 ) / s) * s }' | ||
+ | ) | ||
+ | VOLUME=$( df -k / | ||
+ | # 22 + 0 + hex(ip) | ||
+ | CONTAINER_MACADDR=" | ||
+ | |||
+ | # check things | ||
+ | cat << EOF | ||
+ | CONTAINER_NAME | ||
+ | CONTAINER_IP | ||
+ | GW $CONTAINER_GATEWAY | ||
+ | CONTAINER_MACADDR $CONTAINER_MACADDR | ||
+ | CONTAINER_BRIDGE | ||
+ | CONTAINER_SUBUID | ||
+ | VGNAME | ||
+ | VOLUME | ||
+ | EOF | ||
+ | |||
+ | ## | ||
+ | ## remount the lv | ||
+ | ## | ||
+ | |||
+ | NEWMNTPT=/ | ||
+ | |||
+ | mkdir -p /etc/RCS | ||
+ | vo -o /etc/fstab | ||
+ | MOUNTPT=$( awk -v v=$VOLUME '$1 == v { print $2 }' /etc/fstab ) | ||
+ | umount $MOUNTPT | ||
+ | sed -i " | ||
+ | rcsdiff /etc/fstab | ||
+ | vo -i /etc/fstab | ||
+ | |||
+ | if [ -e / | ||
+ | echo "base directory already exists, exiting" | ||
+ | exit 1; | ||
+ | fi | ||
+ | mkdir / | ||
+ | mount / | ||
+ | |||
+ | ## | ||
+ | ## calculate and enter sub(u|g)id | ||
+ | ## | ||
+ | |||
+ | touch /etc/subuid /etc/subgid | ||
+ | vo -o /etc/subuid /etc/subgid | ||
+ | cat << EOF >> /etc/subuid | ||
+ | root: | ||
+ | EOF | ||
+ | rcsdiff /etc/subuid | ||
+ | |||
+ | cat << EOF >> /etc/subgid | ||
+ | root: | ||
+ | EOF | ||
+ | rcsdiff /etc/subgid | ||
+ | |||
+ | vo -i /etc/subuid /etc/subgid | ||
+ | |||
+ | ## | ||
+ | ## bootstrap container | ||
+ | ## | ||
+ | mkdir / | ||
+ | mv / | ||
+ | ls -la / | ||
+ | # if there are .dot files, move them manually | ||
+ | lxc-create -n $CONTAINER_NAME -t none | ||
+ | |||
+ | # create individual container config | ||
+ | touch / | ||
+ | mkdir -p / | ||
+ | vo -o / | ||
+ | cat << EOF > / | ||
+ | lxc.include = / | ||
+ | |||
+ | lxc.rootfs = / | ||
+ | lxc.utsname = $CONTAINER_NAME | ||
+ | |||
+ | lxc.network.link = $CONTAINER_BRIDGE | ||
+ | lxc.network.hwaddr = $CONTAINER_MACADDR | ||
+ | lxc.network.ipv4 = $CONTAINER_IP/ | ||
+ | lxc.network.ipv4.gateway = $CONTAINER_GATEWAY | ||
+ | lxc.network.veth.pair = $CONTAINER_NAME | ||
+ | |||
+ | lxc.id_map = u 0 $CONTAINER_SUBUID 65536 | ||
+ | lxc.id_map = g 0 $CONTAINER_SUBUID 65536 | ||
+ | |||
+ | lxc.start.auto = 1 | ||
+ | EOF | ||
+ | vo -i / | ||
+ | |||
+ | # fix /run inside the container | ||
+ | if [ -L / | ||
+ | rm / | ||
+ | fi | ||
+ | if [ ! -e / | ||
+ | mkdir / | ||
+ | fi | ||
+ | |||
+ | # adjust uid/gid for the container | ||
+ | ownrecalc -U " | ||
+ | # check, should be empty: | ||
+ | find / | ||
+ | find / | ||
+ | |||
+ | # start the new container | ||
+ | |||
+ | lxc-start -d -n $CONTAINER_NAME | ||
+ | # check: | ||
+ | lxc-attach -n $CONTAINER_NAME -- uname -a | ||
+ | lxc-attach -n $CONTAINER_NAME -- ps xa | ||
+ | |||
+ | ## | ||
+ | ## delete the obsolete vserver config | ||
+ | ## | ||
+ | |||
+ | vserver $CONTAINER_NAME delete | ||
+ | |||
+ | </ | ||
+ | |||
+ | Repeat the above for all vservers. | ||
+ | |||
+ | ===== Remove obsolete vserver setup ===== | ||
+ | |||
+ | < | ||
+ | apt-get purge util-vserver-sysv util-vserver-core util-vserver-build linux-image-4.1-vserver-amd64 libvserver0 | ||
+ | apt-get --purge autoremove | ||
+ | rm -rf / | ||
+ | </ | ||
docs/migrate-vserver-to-lxc.1500989788.txt.gz · Last modified: 2017/07/25 15:36 by 95.208.70.15