71 lines
No EOL
4.9 KiB
Text
71 lines
No EOL
4.9 KiB
Text
#summary CORE HOWTO and references for Linux network namespaces
|
|
|
|
= Introduction =
|
|
|
|
Linux network namespaces (netns) is a lightweight container-based virtualization that is part of the mainline 2.6.27+ Linux kernel. A virtual network stack can be associated with a process group. This is similar to the FreeBSD jail mechanism.
|
|
|
|
Each namespace has its own loopback device and process space. Virtual or real devices can be added to each network namespace, and you can assign IP addresses to these devices and use them as a network node. By default these network namespaces share the same filesystem, just like CORE nodes in FreeBSD. Netns does not have the same security and resource restrictions as OpenVZ containers, and do not require a separate OS template.
|
|
|
|
You do not need to patch your kernel in order to use network namespaces. Modern distros such as Fedora 12 and Ubuntu 9.10 have netns support turned on in their default kernels.
|
|
|
|
= CORE Namespaces HOWTO =
|
|
|
|
The development snapshot of CORE supports network namespaces for virtualization and does not require OpenVZ. The next 4.0 release of CORE will feature this support. Until that release is completed you can try the development snapshot:
|
|
|
|
# install Fedora 12 or Ubuntu 9.10 (namespace support is built-in!)<br>note that for simplicity, the Fedora 12 instructions (package names, etc.) are shown below
|
|
# freshen your kernel version using {{{ yum update }}}
|
|
# install the packages required to compile CORE:
|
|
{{{ yum install autoconf automake bash bridge-utils ebtables gcc libev-devel libtool make pkgconfig python-devel readline-devel sudo tcl tk urw-fonts xauth xorg-x11-server-utils xterm }}}
|
|
# turn off SELINUX by setting `SELINUX=disabled` in `/etc/sysconfig/selinux`; turn off iptables and ip6tables firewalls (`chkconfig iptables off`) or you will need to configure permissive rules for CORE; turn on IP forwarding in `/etc/sysctl.conf`
|
|
# install Quagga; if you are building it from source, you should configure it to use state directories with CORE:
|
|
{{{
|
|
./configure --enable-user=root --enable-group=root --with-cflags=-ggdb \
|
|
--sysconfdir=/usr/local/etc/quagga --enable-vtysh \
|
|
--localstatedir=/var/run/quagga
|
|
}}}
|
|
# grab the development snapshot from [http://downloads.pf.itd.nrl.navy.mil/core/source/nightly_snapshots/core-svnsnap.tgz core-svnsnap.tgz]
|
|
# unpack and build:
|
|
{{{
|
|
tar xzf core-svnsnap.tgz
|
|
cd core
|
|
./bootstrap.sh
|
|
./configure ;# this command should report "Linux Namespaces emulation: yes"
|
|
make
|
|
sudo make install
|
|
}}}
|
|
# after installing, start the CORE services: `sudo /etc/init.d/core start`
|
|
# run the CORE GUI: `sudo core`
|
|
|
|
The containers created will access the common host filesystem, except that some directories are private on a per-container basis; these typically contain per-node configuration files, pids, etc. Notice in the quagga configuration above that the directories /usr/local/etc/quagga and /var/run/quagga hold the private state information for quagga. Other applications may need their own private directories, so you will need to manually edit some configuration scripts to enable this. The below tips were suggested on the mailing list:
|
|
|
|
For the Linux netns version you can use the privatedir() method of LxcNode (see vnode.py). The default per-node private directories are self.confdir (/usr/local/etc/quagga) and /var/run, and also /tmp.
|
|
|
|
There is not a simple way to add other directories from the CORE GUI or with API messages. One approach is to create a subclass of LxcNode that CoreNode inherits from that calls privatedir() during startup() or boot(). See CtrlIfLxcNode in pycore_nodes.py for a similar example that adds a control network interface to nodes and runs sshd (useful for X11 forwarding).
|
|
|
|
Another option is to specify a custom startup script that runs a daemon using a conf, log, pid files that are specified via command-line parameters (e.g. 'sshd -f /tmp/n3_sshd_config')
|
|
|
|
Note that all features may not be available in this network namespaces version of CORE. We are working to make the system more modular and preserve functionality across versions.
|
|
|
|
= References =
|
|
|
|
Linux Containers SourceForge project page:
|
|
|
|
* http://lxc.sourceforge.net
|
|
|
|
IBM Linux container tools tutorial:
|
|
|
|
* http://www.ibm.com/developerworks/linux/library/l-lxc-containers/
|
|
|
|
|
|
Other helpful sites:
|
|
|
|
* http://en.opensuse.org/LXC
|
|
* http://wiki.archlinux.org/index.php/Linux_Containers
|
|
* http://nigel.mcnie.name/blog/a-five-minute-guide-to-linux-containers-for-debian
|
|
* http://sunoano.name/ws/public_xhtml/linux_containers.html
|
|
* http://sysadmin-cookbook.rot13.org/#lxc
|
|
|
|
Mailing lists:
|
|
* Introduction Jan 2007: http://lwn.net/Articles/219597/
|
|
* this message discusses frustrations OpenVZ users might have with non-Redhat host distros: http://openvz.org/pipermail/users/2010-January/003190.html
|
|
* discussion of LXC differences vs OpenVZ and Linux-VServer: http://openvz.org/pipermail/users/2010-January/003192.html |