容器技术之LXC
Linux-1874 人气:4什么是容器？在生活中我们常见的容器有各种瓶瓶罐罐、各种能够容纳其它物料的东西叫容器；容器的特点就是有着很好的隔离作用，使得不同的物料互相隔离；除此之外容器还方便运输、方便储存；这是生活中所说的容器，以及它的特点；在计算机领域中，所谓容器不外乎也有同生活中的容器的特点，隔离，方便“运输”（计算机中的运输我们叫移植，从系统A到系统B），方便“存储”（这里指程序以及运行所依赖的库文件打包，即程序及运行时环境打包）；LXC是Linux containers的缩写，意思就是Linux 容器；Linux容器技术其实就是整合内核的功能，让其支持多个容器运行时资源相互隔离；我们知道内核的功能用户是无法直接操作的，必须得有一用户空间的软件，通过系统调用去操作内核功能；所以lxc就是用来操作Linux内核容器化的工具；这种逻辑有点类似iptables，iptables本身不对用户的报文做任何检查，真正生效的是内核netfilter;
LXC关键技术点：
1、chroot：根切换，一个改变当前运行进程以及其子进程的根目录的操作。一个运行在这种环境的程序无法访问根目录外的文件和命令。
2、namespaces：名称空间，LXC在隔离控制方面依赖于Linux内核的namespace特性，具体而言就是在clone时加入相应的flag；
3、CGroups：控制组，LXC在资源管理方面依赖于Linux内核的cgroups子系统，cgroups子系统是Linux内核提供的一个基于进程组的资源管理的框架，可以为特定的进程组限定可以使用的资源；
LXC简单使用：
1、安装LXC工具
[root@lxc ~]# yum install lxc-* libcgroup* bridge-utils Loaded plugins: fastestmirror base | 3.6 kB 00:00:00 epel | 4.7 kB 00:00:00 extras | 2.9 kB 00:00:00 updates | 2.9 kB 00:00:00 (1/7): base/7/x86_64/group_gz | 153 kB 00:00:00 (2/7): epel/x86_64/group_gz | 95 kB 00:00:00 (3/7): epel/x86_64/updateinfo | 1.0 MB 00:00:00 (4/7): updates/7/x86_64/primary_db | 1.3 MB 00:00:00 (5/7): extras/7/x86_64/primary_db | 190 kB 00:00:00 (6/7): base/7/x86_64/primary_db | 6.1 MB 00:00:01 (7/7): epel/x86_64/primary_db | 6.8 MB 00:00:02 Determining fastest mirrors * base: mirrors.aliyun.com * extras: mirrors.aliyun.com * updates: mirrors.aliyun.com Resolving Dependencies --> Running transaction check ---> Package bridge-utils.x86_64 0:1.5-9.el7 will be installed ---> Package libcgroup.x86_64 0:0.41-21.el7 will be installed ---> Package libcgroup-devel.x86_64 0:0.41-21.el7 will be installed ---> Package libcgroup-pam.x86_64 0:0.41-21.el7 will be installed ……省略部分信息 Installed: bridge-utils.x86_64 0:1.5-9.el7 libcgroup.x86_64 0:0.41-21.el7 libcgroup-devel.x86_64 0:0.41-21.el7 libcgroup-pam.x86_64 0:0.41-21.el7 libcgroup-tools.x86_64 0:0.41-21.el7 lxc.x86_64 0:1.0.11-2.el7 lxc-devel.x86_64 0:1.0.11-2.el7 lxc-doc.noarch 0:1.0.11-2.el7 lxc-extra.x86_64 0:1.0.11-2.el7 lxc-libs.x86_64 0:1.0.11-2.el7 lxc-templates.x86_64 0:1.0.11-2.el7 Dependency Installed: libtirpc.x86_64 0:0.2.4-0.16.el7 lua-alt-getopt.noarch 0:0.7.0-4.el7 lua-filesystem.x86_64 0:1.6.2-2.el7 lua-lxc.x86_64 0:1.0.11-2.el7 python3.x86_64 0:3.6.8-13.el7 python3-libs.x86_64 0:3.6.8-13.el7 python3-pip.noarch 0:9.0.3-7.el7_7 python3-setuptools.noarch 0:39.2.0-10.el7 python36-lxc.x86_64 0:1.0.11-2.el7 Complete! [root@lxc ~]#
提示：安装前请配置好epel源，以及base源；
2、添加网桥
3、检查当前系统是否满足创建容器的条件
[root@lxc ~]# lxc-checkconfig Kernel configuration not found at /proc/config.gz; searching... Kernel configuration found at /boot/config-3.10.0-693.el7.x86_64 --- Namespaces --- Namespaces: enabled Utsname namespace: enabled Ipc namespace: enabled Pid namespace: enabled User namespace: enabled newuidmap is not installed newgidmap is not installed Network namespace: enabled Multiple https://img.qb5200.com/download-x/dev/pts instances: enabled --- Control groups --- Cgroup: enabled Cgroup clone_children flag: enabled Cgroup device: enabled Cgroup sched: enabled Cgroup cpu account: enabled Cgroup memory controller: enabled Cgroup cpuset: enabled --- Misc --- Veth pair device: enabled Macvlan: enabled Vlan: enabled Bridges: enabled Advanced netfilter: enabled CONFIG_NF_NAT_IPV4: enabled CONFIG_NF_NAT_IPV6: enabled CONFIG_IP_NF_TARGET_MASQUERADE: enabled CONFIG_IP6_NF_TARGET_MASQUERADE: enabled CONFIG_NETFILTER_XT_TARGET_CHECKSUM: enabled --- Checkpoint/Restore --- checkpoint restore: enabled CONFIG_FHANDLE: enabled CONFIG_EVENTFD: enabled CONFIG_EPOLL: enabled CONFIG_UNIX_DIAG: enabled CONFIG_INET_DIAG: enabled CONFIG_PACKET_DIAG: enabled CONFIG_NETLINK_DIAG: enabled File capabilities: enabled Note : Before booting a new kernel, you can check its configuration usage : CONFIG=/path/to/config /usr/bin/lxc-checkconfig [root@lxc ~]#
提示：如果没有报error之类的就表示当前环境满足创建容器的条件
4、指定模板创建容器
[root@lxc ~]# lxc-create -n test -t /usr/share/lxc/templates/lxc-centos
Host CPE ID from /etc/os-release: cpe:/o:centos:centos:7
Checking cache download in /var/cache/lxc/centos/x86_64/7/rootfs ...
Downloading CentOS minimal ...
Loaded plugins: fastestmirror
base | 3.6 kB 00:00:00
updates | 2.9 kB 00:00:00
Determining fastest mirrors
* base: mirrors.aliyun.com
* updates: mirrors.aliyun.com
Resolving Dependencies
--> Running transaction check
---> Package chkconfig.x86_64 0:1.7.4-1.el7 will be installed
--> Processing Dependency: rtld(GNU_HASH) for package: chkconfig-1.7.4-1.el7.x86_64
--> Processing Dependency: libpopt.so.0(LIBPOPT_0)(64bit) for package: chkconfig-1.7.4-1.el7.x86_64
--> Processing Dependency: libc.so.6(GLIBC_2.14)(64bit) for package: chkconfig-1.7.4-1.el7.x86_64
……省略部分内容
Container rootfs and config have been created.
Edit the config file to check/enable networking setup.
The temporary root password is stored in:
'/var/lib/lxc/test/tmp_root_pass'
The root password is set up as expired and will require it to be changed
at first login, which you should do as soon as possible. If you lose the
root password or wish to change it without starting the container, you
can change it from the host by running the following command (which will
also reset the expired flag):
chroot /var/lib/lxc/test/rootfs passwd
[root@lxc ~]#
提示：-t表示指定模板，该模板其实就是一shell脚本，在安装lxc-templates这个包后，默认/usr/share/lxc/templates/下面有几个模板；如果能看到以上提示表示容器已经成功创建，我们可以使用lxc-ls查看当前系统创建的所有容器；
[root@lxc ~]# lxc-ls test [root@lxc ~]#
提示：可以看到当前系统只有名为test的容器
5、修改当前test容器的root密码
[root@lxc ~]# chroot /var/lib/lxc/test/rootfs passwd Changing password for user root. New password: BAD PASSWORD: The password is shorter than 8 characters Retype new password: passwd: all authentication tokens updated successfully. [root@lxc ~]#
提示：其实不用修改也行，默认的密码存放在/var/lib/lxc/test/tmp_root_passwd这个文件中；不修改密码登录容器后，它会提示我们修改密码
6、启动容器，并登录容器
[root@lxc ~]# lxc-start -n test
systemd 219 running in system mode. (+PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 -SECCOMP +BLKID +ELFUTILS +KMOD +IDN)
Detected virtualization lxc.
Detected architecture x86-64.
Welcome to CentOS Linux 7 (Core)!
Running in a container, ignoring fstab device entry for https://img.qb5200.com/download-x/dev/root.
Cannot add dependency job for unit display-manager.service, ignoring: Unit not found.
[ OK ] Reached target Local Encrypted Volumes.
[ OK ] Reached target Swap.
[ OK ] Started Dispatch Password Requests to Console Directory Watch.
[ OK ] Started Forward Password Requests to Wall Directory Watch.
[ OK ] Reached target Paths.
[ OK ] Reached target Remote File Systems.
[ OK ] Created slice Root Slice.
[ OK ] Listening on Journal Socket.
[ OK ] Created slice User and Session Slice.
[ OK ] Listening on https://img.qb5200.com/download-x/dev/initctl Compatibility Named Pipe.
[ OK ] Listening on Delayed Shutdown Socket.
[ OK ] Created slice System Slice.
Mounting Huge Pages File System...
Starting Read and set NIS domainname from /etc/sysconfig/network...
Starting Journal Service...
Starting Remount Root and Kernel File Systems...
[ OK ] Reached target Slices.
[ OK ] Created slice system-getty.slice.
Mounting POSIX Message Queue File System...
[ OK ] Mounted Huge Pages File System.
[ OK ] Started Journal Service.
[ OK ] Started Read and set NIS domainname from /etc/sysconfig/network.
[ OK ] Mounted POSIX Message Queue File System.
[ OK ] Started Remount Root and Kernel File Systems.
Starting Configure read-only root support...
Starting Flush Journal to Persistent Storage...
Starting Rebuild Hardware Database...
[ OK ] Reached target Local File Systems (Pre).
<46>systemd-journald[16]: Received request to flush runtime journal from PID 1
[ OK ] Started Flush Journal to Persistent Storage.
[ OK ] Started Configure read-only root support.
Starting Load/Save Random Seed...
[ OK ] Reached target Local File Systems.
Starting Rebuild Journal Catalog...
Starting Create Volatile Files and Directories...
Starting Mark the need to relabel after reboot...
[ OK ] Started Load/Save Random Seed.
[ OK ] Started Rebuild Journal Catalog.
[ OK ] Started Create Volatile Files and Directories.
[ OK ] Started Mark the need to relabel after reboot.
Starting Update UTMP about System Boot/Shutdown...
[ OK ] Started Update UTMP about System Boot/Shutdown.
[ OK ] Started Rebuild Hardware Database.
Starting Update is Completed...
[ OK ] Started Update is Completed.
[ OK ] Reached target System Initialization.
[ OK ] Listening on D-Bus System Message Bus Socket.
[ OK ] Reached target Sockets.
[ OK ] Reached target Basic System.
Starting Permit User Sessions...
Starting OpenSSH Server Key Generation...
Starting LSB: Bring uphttps://img.qb5200.com/download-x/down networking...
[ OK ] Started D-Bus System Message Bus.
Starting Login Service...
[ OK ] Started Daily Cleanup of Temporary Directories.
[ OK ] Reached target Timers.
[ OK ] Started Permit User Sessions.
Starting Cleanup of Temporary Directories...
[ OK ] Started Console Getty.
[ OK ] Reached target Login Prompts.
[ OK ] Started Command Scheduler.
[ OK ] Started Cleanup of Temporary Directories.
[ OK ] Started Login Service.
[ OK ] Started OpenSSH Server Key Generation.
CentOS Linux 7 (Core)
Kernel 3.10.0-693.el7.x86_64 on an x86_64
test login: root
Password:
You are required to change your password immediately (root enforced)
Changing password for root.
(current) UNIX password:
New password:
Retype new password:
[root@test ~]# hostname
test
[root@test ~]#
提示：以上是启动容器后，用默认密码登录容器，它会提示我们修改密码；如果想要让该容器后台运行（不占据当前shell终端），可以使用-d选项指定即可；
查看test容器的信息
[root@lxc ~]# lxc-info -n test Name: test State: RUNNING PID: 5896 IP: 192.168.0.216 CPU use: 0.16 seconds BlkIO use: 0 bytes Memory use: 1.34 MiB KMem use: 0 bytes Link: veth6WQY6V TX bytes: 1.67 KiB RX bytes: 17.50 KiB Total bytes: 19.17 KiB [root@lxc ~]#
停止test容器
[root@lxc ~]# lxc-stop -n test [root@lxc ~]# lxc-info -n test Name: test State: STOPPED [root@lxc ~]#
销毁容器
[root@lxc ~]# lxc-destroy -n test [root@lxc ~]# lxc-ls [root@lxc ~]#
提示：销毁容器，容器的状态必须是停止状态，否则销毁不了
以上就lxc容器的简单管理；
加载全部内容