Sep 29
2015
2015
Using LXC with Debian
Using Debian unstable, currently, I found setting up linux containers not to be quite as pain-free as promised. Here are some of the more unusual aspects:
CGManager
Linux cgroups are the abstraction which enable custom containers by providing resource isolation. On Debian I did not, by default, have permission to create my own groups.
Apparently this is changing, so you may not need to worry about this portion.
# echo 1 >/proc/sys/kernel/unprivileged_userns_clone
$ sudo cgm create all me
$ sudo cgm chown all me $(id -u) $(id -g)
$ sudo cgm movepid all me $$
Network configuration
This, along with other lxc parameters, I configured by modifying the configuration file directly:
$ vim .local/share/lxc/your container name here/config
These lines create a NATed network for the container:
lxc.network.type = veth
lxc.network.flags = up
lxc.network.link = lxc-bridge-nat
lxc.network.ipv4 = 10.10.1.10/24
lxc.network.ipv4.gateway = 10.10.1.1
I then wanted to enable ssh access remotely (from externally accessible port 2000), which is the standard Linux business of:
$ sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 2000 -j DNAT --to 10.1.1.10:2000
$ sudo iptables -A FORWARD -m state -p tcp -d 10.1.1.10 --dport 2000 --state NEW,ESTABLISHED,RELATED -j ACCEPT