2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen

3f3ad16ff74d694796d22501250a9a29997c0729Timo Sirainen<!DOCTYPE refentry PUBLIC "-//Davenport//DTD DocBook V3.0//EN" [

b4ddb5b3c3722620a8fef387dd8c47bb411a5643Timo Sirainen

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen<!ENTITY seealso SYSTEM "@builddir@/see_also.sgml">

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen]>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen<refentry>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen

db3b95d5a33ddce552d41136ae68d7331f8bf5feTimo Sirainen <docinfo><date>@LXC_GENERATE_DATE@</date></docinfo>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen

9dd8a75971a2d9e46fb0c80feddc0aaec1181defTimo Sirainen <refmeta>

9dd8a75971a2d9e46fb0c80feddc0aaec1181defTimo Sirainen <refentrytitle>lxc.conf</refentrytitle>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <manvolnum>5</manvolnum>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen </refmeta>

8cafec427a378daf68c253929232d498509d548cTimo Sirainen

ece0a20249ce26208db3415ba2e79423678856f8Timo Sirainen <refnamediv>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <refname>lxc.conf</refname>

ece0a20249ce26208db3415ba2e79423678856f8Timo Sirainen

b44033e45e9f48f8a6e1ac5905234fec5de6d6ccAki Tuomi <refpurpose>

b44033e45e9f48f8a6e1ac5905234fec5de6d6ccAki Tuomi linux container configuration file

b44033e45e9f48f8a6e1ac5905234fec5de6d6ccAki Tuomi </refpurpose>

b44033e45e9f48f8a6e1ac5905234fec5de6d6ccAki Tuomi </refnamediv>

b44033e45e9f48f8a6e1ac5905234fec5de6d6ccAki Tuomi

b44033e45e9f48f8a6e1ac5905234fec5de6d6ccAki Tuomi <refsect1>

b44033e45e9f48f8a6e1ac5905234fec5de6d6ccAki Tuomi <title>Description</title>

b44033e45e9f48f8a6e1ac5905234fec5de6d6ccAki Tuomi

b44033e45e9f48f8a6e1ac5905234fec5de6d6ccAki Tuomi <para>

b44033e45e9f48f8a6e1ac5905234fec5de6d6ccAki Tuomi The linux containers (<command>lxc</command>) are always created

ece0a20249ce26208db3415ba2e79423678856f8Timo Sirainen before being used. This creation defines a set of system

ece0a20249ce26208db3415ba2e79423678856f8Timo Sirainen resources to be virtualized / isolated when a process is using

ece0a20249ce26208db3415ba2e79423678856f8Timo Sirainen the container. By default, the pids, sysv ipc and mount points

dd19de9b6382c9a47b65df6b2396789df37a19fbTimo Sirainen are virtualized and isolated. The other system resources are

ece0a20249ce26208db3415ba2e79423678856f8Timo Sirainen shared across containers, until they are explicitly defined in

ece0a20249ce26208db3415ba2e79423678856f8Timo Sirainen the configuration file. For example, if there is no network

ece0a20249ce26208db3415ba2e79423678856f8Timo Sirainen configuration, the network will be shared between the creator of

b44033e45e9f48f8a6e1ac5905234fec5de6d6ccAki Tuomi the container and the container itself, but if the network is

4dc8d682c855ca78db8874e04302e885465c1d65Timo Sirainen specified, a new network stack is created for the container and

4dc8d682c855ca78db8874e04302e885465c1d65Timo Sirainen the container can no longer use the network of its ancestor.

d3bae1f9d2448e5c398145ea250849ec12583845Timo Sirainen </para>

d3bae1f9d2448e5c398145ea250849ec12583845Timo Sirainen

5754fa860405e9af20c38981942f6aa97ce3158dTimo Sirainen <para>

5754fa860405e9af20c38981942f6aa97ce3158dTimo Sirainen The configuration file defines the different system resources to

dd19de9b6382c9a47b65df6b2396789df37a19fbTimo Sirainen be assigned for the container. At present, the utsname, the

dd19de9b6382c9a47b65df6b2396789df37a19fbTimo Sirainen network, the mount points, the root file system and the control

dd19de9b6382c9a47b65df6b2396789df37a19fbTimo Sirainen groups are supported.

47a5a7e8296f3b8f2fac9a0659d4de3f2723ba4aMartti Rannanjärvi </para>

47a5a7e8296f3b8f2fac9a0659d4de3f2723ba4aMartti Rannanjärvi

47a5a7e8296f3b8f2fac9a0659d4de3f2723ba4aMartti Rannanjärvi <para>

ece0a20249ce26208db3415ba2e79423678856f8Timo Sirainen Each option in the configuration file has the form <command>key

ece0a20249ce26208db3415ba2e79423678856f8Timo Sirainen = value</command> fitting in one line. The '#' character means

ece0a20249ce26208db3415ba2e79423678856f8Timo Sirainen the line is a comment.

dd19de9b6382c9a47b65df6b2396789df37a19fbTimo Sirainen </para>

ece0a20249ce26208db3415ba2e79423678856f8Timo Sirainen

ece0a20249ce26208db3415ba2e79423678856f8Timo Sirainen <refsect2>

ece0a20249ce26208db3415ba2e79423678856f8Timo Sirainen <title>Architecture</title>

ece0a20249ce26208db3415ba2e79423678856f8Timo Sirainen <para>

ece0a20249ce26208db3415ba2e79423678856f8Timo Sirainen Allows to set the architecture for the container. For example,

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen set a 32bits architecture for a container running 32bits

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen binaries on a 64bits host. That fix the container scripts

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen which rely on the architecture to do some work like

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen downloading the packages.

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen </para>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <variablelist>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <varlistentry>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <term>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <option>lxc.arch</option>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen </term>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <listitem>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <para>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen Specify the architecture for the container.

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen </para>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <para>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen Valid options are

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <option>x86</option>,

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <option>i686</option>,

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <option>x86_64</option>,

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <option>amd64</option>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen </para>

db3b95d5a33ddce552d41136ae68d7331f8bf5feTimo Sirainen </listitem>

db3b95d5a33ddce552d41136ae68d7331f8bf5feTimo Sirainen </varlistentry>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen </variablelist>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen </refsect2>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <refsect2>

9dd8a75971a2d9e46fb0c80feddc0aaec1181defTimo Sirainen <title>Hostname</title>

9dd8a75971a2d9e46fb0c80feddc0aaec1181defTimo Sirainen <para>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen The utsname section defines the hostname to be set for the

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen container. That means the container can set its own hostname

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen without changing the one from the system. That makes the

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen hostname private for the container.

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen </para>

5545acdd3aa90a6e0cca2b665f909ec4c2fb2513Baofeng <variablelist>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <varlistentry>

009217abb57a24a4076092e8e4e165545747839eStephan Bosch <term>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <option>lxc.utsname</option>

973c8fc1d7e9f982f7caf6385adb78dfacd9fb80Timo Sirainen </term>

973c8fc1d7e9f982f7caf6385adb78dfacd9fb80Timo Sirainen <listitem>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <para>

5545acdd3aa90a6e0cca2b665f909ec4c2fb2513Baofeng specify the hostname for the container

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen </para>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen </listitem>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen </varlistentry>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen </variablelist>

c1d01419ffbeb0e00f86a653db70bfd47110e7fcTimo Sirainen </refsect2>

009217abb57a24a4076092e8e4e165545747839eStephan Bosch

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <refsect2>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <title>Network</title>

009217abb57a24a4076092e8e4e165545747839eStephan Bosch <para>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen The network section defines how the network is virtualized in

009217abb57a24a4076092e8e4e165545747839eStephan Bosch the container. The network virtualization acts at layer

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen two. In order to use the network virtualization, parameters

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen must be specified to define the network interfaces of the

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen container. Several virtual interfaces can be assigned and used

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen in a container even if the system has only one physical

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen network interface.

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen </para>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <variablelist>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <varlistentry>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <term>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <option>lxc.network.type</option>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen </term>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <listitem>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <para>

5545acdd3aa90a6e0cca2b665f909ec4c2fb2513Baofeng specify what kind of network virtualization to be used

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen for the container. Each time

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen a <option>lxc.network.type</option> field is found a new

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen round of network configuration begins. In this way,

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen several network virtualization types can be specified

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen for the same container, as well as assigning several

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen network interfaces for one container. The different

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen virtualization types can be:

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen </para>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <para>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen <option>empty:</option> will create only the loopback

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen interface.

e4194f4703eeec32b432371ae30fc8f25ab720d8Timo Sirainen </para>

e4194f4703eeec32b432371ae30fc8f25ab720d8Timo Sirainen

e4194f4703eeec32b432371ae30fc8f25ab720d8Timo Sirainen <para>

e4194f4703eeec32b432371ae30fc8f25ab720d8Timo Sirainen <option>veth:</option> a peer network device is created

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen with one side assigned to the container and the other

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen side is attached to a bridge specified by

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen the <option>lxc.network.link</option>. If the bridge is

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen not specified, then the veth pair device will be created

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen but not attached to any bridge. Otherwise, the bridge

e34d170f8f0e084bd94bfbc1a7085ece67e508dfTimo Sirainen has to be setup before on the

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen system, <command>lxc</command> won't handle any

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen configuration outside of the container. By

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen default <command>lxc</command> choose a name for the

db693bf6fcae96d834567f1782257517b7207655Timo Sirainen network device belonging to the outside of the

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen container, this name is handled

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen by <command>lxc</command>, but if you wish to handle

faec0abfd648c647030027e86de2ce8911df683bTimo Sirainen this name yourself, you can tell <command>lxc</command>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen to set a specific name with

b4ddb5b3c3722620a8fef387dd8c47bb411a5643Timo Sirainen the <option>lxc.network.veth.pair</option> option.

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen </para>

300e4e43ed1ca46d0614459161ca2fb460ef661aTimo Sirainen

db693bf6fcae96d834567f1782257517b7207655Timo Sirainen <para>

9dd8a75971a2d9e46fb0c80feddc0aaec1181defTimo Sirainen <option>vlan:</option> a vlan interface is linked with

300e4e43ed1ca46d0614459161ca2fb460ef661aTimo Sirainen the interface specified by

300e4e43ed1ca46d0614459161ca2fb460ef661aTimo Sirainen the <option>lxc.network.link</option> and assigned to

300e4e43ed1ca46d0614459161ca2fb460ef661aTimo Sirainen the container. The vlan identifier is specified with the

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen option <option>lxc.network.vlan.id</option>.

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen </para>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <para>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <option>macvlan:</option> a macvlan interface is linked

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen with the interface specified by

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen the <option>lxc.network.link</option> and assigned to

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen the container.

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <option>lxc.network.macvlan.mode</option> specifies the

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen mode the macvlan will use to communicate between

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen different macvlan on the same upper device. The accepted

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen modes are <option>private</option>, the device never

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen communicates with any other device on the same upper_dev (default),

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <option>vepa</option>, the new Virtual Ethernet Port

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen Aggregator (VEPA) mode, it assumes that the adjacent

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen bridge returns all frames where both source and

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen destination are local to the macvlan port, i.e. the

861f53be0cc2fa5665f3c107a7576e2a53bb2eb0Timo Sirainen bridge is set up as a reflective relay. Broadcast

b4ddb5b3c3722620a8fef387dd8c47bb411a5643Timo Sirainen frames coming in from the upper_dev get flooded to all

db3b95d5a33ddce552d41136ae68d7331f8bf5feTimo Sirainen macvlan interfaces in VEPA mode, local frames are not

db3b95d5a33ddce552d41136ae68d7331f8bf5feTimo Sirainen delivered locallay, or <option>bridge</option>, it

db3b95d5a33ddce552d41136ae68d7331f8bf5feTimo Sirainen provides the behavior of a simple bridge between

db3b95d5a33ddce552d41136ae68d7331f8bf5feTimo Sirainen different macvlan interfaces on the same port. Frames

db3b95d5a33ddce552d41136ae68d7331f8bf5feTimo Sirainen from one interface to another one get delivered directly

db3b95d5a33ddce552d41136ae68d7331f8bf5feTimo Sirainen and are not sent out externally. Broadcast frames get

db3b95d5a33ddce552d41136ae68d7331f8bf5feTimo Sirainen flooded to all other bridge ports and to the external

db3b95d5a33ddce552d41136ae68d7331f8bf5feTimo Sirainen interface, but when they come back from a reflective

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen relay, we don't deliver them again. Since we know all

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen the MAC addresses, the macvlan bridge mode does not

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen require learning or STP like the bridge module does.

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen </para>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <para>

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen <option>phys:</option> an already existing interface

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen specified by the <option>lxc.network.link</option> is

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen assigned to the container.

9dd8a75971a2d9e46fb0c80feddc0aaec1181defTimo Sirainen </para>

9dd8a75971a2d9e46fb0c80feddc0aaec1181defTimo Sirainen </listitem>

9dd8a75971a2d9e46fb0c80feddc0aaec1181defTimo Sirainen </varlistentry>

9dd8a75971a2d9e46fb0c80feddc0aaec1181defTimo Sirainen

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen <varlistentry>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen <term>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen <option>lxc.network.flags</option>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen </term>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen <listitem>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen <para>

4ee00532a265bdfb38539d811fcd12d51210ac35Timo Sirainen specify an action to do for the

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen network.

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen </para>

5a444fdfabcc0c75708c21e84dc8b87eddab7335Timo Sirainen

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen <para><option>up:</option> activates the interface.

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen </para>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen </listitem>

2efe19d9045768d985a3bd549cff12f65ba40cc8Timo Sirainen </varlistentry>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen <varlistentry>

2efe19d9045768d985a3bd549cff12f65ba40cc8Timo Sirainen <term>

b6b9c99fefbbc662bd9a0006566133c4480bf0e8Timo Sirainen <option>lxc.network.link</option>

b6b9c99fefbbc662bd9a0006566133c4480bf0e8Timo Sirainen </term>

2efe19d9045768d985a3bd549cff12f65ba40cc8Timo Sirainen <listitem>

2efe19d9045768d985a3bd549cff12f65ba40cc8Timo Sirainen <para>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen specify the interface to be used for real network

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen traffic.

2efe19d9045768d985a3bd549cff12f65ba40cc8Timo Sirainen </para>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen </listitem>

5b4d189a01d248458496068f838128f1bafdcf2eTimo Sirainen </varlistentry>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen

6ecc5475f7efd4dcdf4ce727191693de24c5cf51Timo Sirainen <varlistentry>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen <term>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen <option>lxc.network.name</option>

7ee226c2a66aa4dce7f13e8b17687db285c981bdTimo Sirainen </term>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen <listitem>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen <para>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen the interface name is dynamically allocated, but if

009217abb57a24a4076092e8e4e165545747839eStephan Bosch another name is needed because the configuration files

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen being used by the container use a generic name,

958e5ae51a755558b6d022a39b194614726b4225Timo Sirainen eg. eth0, this option will rename the interface in the

958e5ae51a755558b6d022a39b194614726b4225Timo Sirainen container.

958e5ae51a755558b6d022a39b194614726b4225Timo Sirainen </para>

958e5ae51a755558b6d022a39b194614726b4225Timo Sirainen </listitem>

958e5ae51a755558b6d022a39b194614726b4225Timo Sirainen </varlistentry>

ece0a20249ce26208db3415ba2e79423678856f8Timo Sirainen

ece0a20249ce26208db3415ba2e79423678856f8Timo Sirainen <varlistentry>

ece0a20249ce26208db3415ba2e79423678856f8Timo Sirainen <term>

677b75f90d81eafe742896d6570a2f63ce501d05Josef 'Jeff' Sipek <option>lxc.network.hwaddr</option>

ece0a20249ce26208db3415ba2e79423678856f8Timo Sirainen </term>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen <listitem>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen <para>

c1d01419ffbeb0e00f86a653db70bfd47110e7fcTimo Sirainen the interface mac address is dynamically allocated by

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen default to the virtual interface, but in some cases,

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen this is needed to resolve a mac address conflict or to

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen always have the same link-local ipv6 address

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen </para>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen </listitem>

c3a2a487e23a282e59254b82deb9344ed0306bb2Timo Sirainen </varlistentry>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen

16a5712c1a774b7bd3bbf22032b61ccc9398499eAki Tuomi <varlistentry>

16a5712c1a774b7bd3bbf22032b61ccc9398499eAki Tuomi <term>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen <option>lxc.network.ipv4</option>

c4900d31385344bfadaee53a897daeafdb3063d8Timo Sirainen </term>

cf9d67e4a9bfee31cf3be05244555d51a3d1b9feTimo Sirainen <listitem>

cf9d67e4a9bfee31cf3be05244555d51a3d1b9feTimo Sirainen <para>

cf9d67e4a9bfee31cf3be05244555d51a3d1b9feTimo Sirainen specify the ipv4 address to assign to the virtualized

edd318d5866ac3fbc6e8df28fb24a4dfef93c884Timo Sirainen interface. Several lines specify several ipv4 addresses.

69b22a0c0c84087e5bdeec71faae7ea77295240fTimo Sirainen The address is in format x.y.z.t/m,

69b22a0c0c84087e5bdeec71faae7ea77295240fTimo Sirainen eg. 192.168.1.123/24.

69b22a0c0c84087e5bdeec71faae7ea77295240fTimo Sirainen </para>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen </listitem>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen </varlistentry>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen <varlistentry>

0d1b8b6bec79746c5d89d57dd8c1688946bd9237Josef 'Jeff' Sipek <term>

57d65ae19a2339d1303a522e680c30ee1ef68d6dTimo Sirainen <option>lxc.network.ipv6</option>

faa01447c2f699b63ceccf129430a9ed46458083Timo Sirainen </term>

faa01447c2f699b63ceccf129430a9ed46458083Timo Sirainen <listitem>

faa01447c2f699b63ceccf129430a9ed46458083Timo Sirainen <para>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen specify the ipv6 address to assign to the virtualized

c3a2a487e23a282e59254b82deb9344ed0306bb2Timo Sirainen interface. Several lines specify several ipv6 addresses.

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen The address is in format x::y/m,

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen eg. 2003:db8:1:0:214:1234:fe0b:3596/64

6468191d64827a2d1481c091ec499874583c834eTimo Sirainen </para>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen </listitem>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen </varlistentry>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen </variablelist>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen </refsect2>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen <refsect2>

412b772c337428b72149605c1410524c2353e5d4Timo Sirainen <title>New pseudo tty instance (devpts)</title>

ece0a20249ce26208db3415ba2e79423678856f8Timo Sirainen <para>

009217abb57a24a4076092e8e4e165545747839eStephan Bosch For stricter isolation the container can have its own private

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen instance of the pseudo tty.

00e7c3010f7da4a49881a7feb05e413af353af0aTimo Sirainen </para>

00e7c3010f7da4a49881a7feb05e413af353af0aTimo Sirainen <variablelist>

00e7c3010f7da4a49881a7feb05e413af353af0aTimo Sirainen <varlistentry>

412b772c337428b72149605c1410524c2353e5d4Timo Sirainen <term>

f9f77e06a148fd0816004e0e1b0f585307148a7dTimo Sirainen <option>lxc.pts</option>

00e7c3010f7da4a49881a7feb05e413af353af0aTimo Sirainen </term>

00e7c3010f7da4a49881a7feb05e413af353af0aTimo Sirainen <listitem>

00e7c3010f7da4a49881a7feb05e413af353af0aTimo Sirainen <para>

00e7c3010f7da4a49881a7feb05e413af353af0aTimo Sirainen If set, the container will have a new pseudo tty

00e7c3010f7da4a49881a7feb05e413af353af0aTimo Sirainen instance, making this private to it. The value specifies

00e7c3010f7da4a49881a7feb05e413af353af0aTimo Sirainen the maximum number of pseudo ttys allowed for a pts

009217abb57a24a4076092e8e4e165545747839eStephan Bosch instance (this limitation is not implemented yet).

009217abb57a24a4076092e8e4e165545747839eStephan Bosch </para>

00e7c3010f7da4a49881a7feb05e413af353af0aTimo Sirainen </listitem>

00e7c3010f7da4a49881a7feb05e413af353af0aTimo Sirainen </varlistentry>

00e7c3010f7da4a49881a7feb05e413af353af0aTimo Sirainen </variablelist>

00e7c3010f7da4a49881a7feb05e413af353af0aTimo Sirainen </refsect2>

00e7c3010f7da4a49881a7feb05e413af353af0aTimo Sirainen

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen <refsect2>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen <title>Container system console</title>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen <para>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen If the container is configured with a root filesystem and the

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen inittab file is setup to use the console, you may want to specify

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen where goes the output of this console.

7ee226c2a66aa4dce7f13e8b17687db285c981bdTimo Sirainen </para>

00e7c3010f7da4a49881a7feb05e413af353af0aTimo Sirainen <variablelist>

1df39b899804fd1dbc560f75382364822935c857Timo Sirainen <varlistentry>

e2fdcdb4ee53ab769123e27997713aaea34910e1Timo Sirainen <term>

00e7c3010f7da4a49881a7feb05e413af353af0aTimo Sirainen <option>lxc.console</option>

00e7c3010f7da4a49881a7feb05e413af353af0aTimo Sirainen </term>

00e7c3010f7da4a49881a7feb05e413af353af0aTimo Sirainen <listitem>

00e7c3010f7da4a49881a7feb05e413af353af0aTimo Sirainen <para>

00e7c3010f7da4a49881a7feb05e413af353af0aTimo Sirainen Specify a path to a file where the console output will

00e7c3010f7da4a49881a7feb05e413af353af0aTimo Sirainen be written.

00e7c3010f7da4a49881a7feb05e413af353af0aTimo Sirainen </para>

00e7c3010f7da4a49881a7feb05e413af353af0aTimo Sirainen </listitem>

d6b3cfd855c0eebed68be50d3111de1b5a6afeb0Timo Sirainen </varlistentry>

00e7c3010f7da4a49881a7feb05e413af353af0aTimo Sirainen </variablelist>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen </refsect2>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen <refsect2>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen <title>Console through the ttys</title>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen <para>

2670cd577aa57eb9f915a4f4220ae48c9b4fc5fbTimo Sirainen If the container is configured with a root filesystem and the

inittab file is setup to launch a getty on the ttys. This

option will specify the number of ttys to be available for the

container. The number of getty in the inittab file of the

container should not be greater than the number of ttys

specified in this configuration file, otherwise the excess

getty sessions will die and respawn indefinitly giving

annoying messages on the console.

</para>

<variablelist>

<varlistentry>

<term>

<option>lxc.tty</option>

</term>

<listitem>

<para>

Specify the number of tty to make available to the

container.

</para>

</listitem>

</varlistentry>

</variablelist>

</refsect2>

<refsect2>

<title>Mount points</title>

<para>

The mount points section specifies the different places to be

mounted. These mount points will be private to the container

and won't be visible by the processes running outside of the

container. This is useful to mount /etc, /var or /home for

examples.

</para>

<variablelist>

<varlistentry>

<term>

<option>lxc.mount</option>

</term>

<listitem>

<para>

specify a file location in

the <filename>fstab</filename> format, containing the

mount informations.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>

<option>lxc.mount.entry</option>

</term>

<listitem>

<para>

specify a mount point corresponding to a line in the

fstab format.

</para>

</listitem>

</varlistentry>

</variablelist>

</refsect2>

<refsect2>

<title>Root file system</title>

<para>

The root file system of the container can be different than that

of the host system.

</para>

<variablelist>

<varlistentry>

<term>

<option>lxc.rootfs</option>

</term>

<listitem>

<para>

specify a directory to become the root of the container.

If not specified, the container shares its root file

system with the host.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>

<option>lxc.rootfs.mount</option>

</term>

<listitem>

<para>

where to recursively bind <option>lxc.rootfs</option>

before pivoting. This is to ensure success of the

<citerefentry>

<refentrytitle><command>pivot_root</command></refentrytitle>

<manvolnum>8</manvolnum>

</citerefentry>

syscall. Any directory suffices, the default should

generally work.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>

<option>lxc.pivotdir</option>

</term>

<listitem>

<para>

where to pivot the original root file system under

<option>lxc.rootfs</option>, specified relatively to

that. The default is <filename>mnt</filename>.

It is created if necessary, and also removed after

unmounting everything from it during container setup.

</para>

</listitem>

</varlistentry>

</variablelist>

</refsect2>

<refsect2>

<title>Control group</title>

<para>

The control group section contains the configuration for the

different subsystem. <command>lxc</command> does not check the

correctness of the subsystem name. This has the disadvantage

of not detecting configuration errors until the container is

started, but has the advantage of permitting any future

subsystem.

</para>

<variablelist>

<varlistentry>

<term>

<option>lxc.cgroup.[subsystem name]</option>

</term>

<listitem>

<para>

specify the control group value to be set. The

subsystem name is the literal name of the control group

subsystem. The permitted names and the syntax of their

values is not dictated by LXC, instead it depends on the

features of the Linux kernel running at the time the

container is started,

eg. <option>lxc.cgroup.cpuset.cpus</option>

</para>

</listitem>

</varlistentry>

</variablelist>

</refsect2>

<refsect2>

<title>Capabilities</title>

<para>

The capabilities can be dropped in the container if this one

is run as root.

</para>

<variablelist>

<varlistentry>

<term>

<option>lxc.cap.drop</option>

</term>

<listitem>

<para>

Specify the capability to be dropped in the container. A

single line defining several capabilities with a space

separation is allowed. The format is the lower case of

the capability definition without the "CAP_" prefix,

eg. CAP_SYS_MODULE should be specified as

sys_module. See

<citerefentry>

<refentrytitle><command>capabilities</command></refentrytitle>

<manvolnum>7</manvolnum>

</citerefentry>,

</para>

</listitem>

</varlistentry>

</variablelist>

</refsect2>

</refsect1>

<refsect1>

<title>Examples</title>

<para>

In addition to the few examples given below, you will find

some other examples of configuration file in @DOCDIR@/examples

</para>

<refsect2>

<title>Network</title>

<para>This configuration sets up a container to use a veth pair

device with one side plugged to a bridge br0 (which has been

configured before on the system by the administrator). The

virtual network device visible in the container is renamed to

eth0.</para>

<programlisting>

lxc.utsname = myhostname

lxc.network.type = veth

lxc.network.flags = up

lxc.network.link = br0

lxc.network.name = eth0

lxc.network.hwaddr = 4a:49:43:49:79:bf

lxc.network.ipv4 = 1.2.3.5/24

lxc.network.ipv6 = 2003:db8:1:0:214:1234:fe0b:3597

</programlisting>

</refsect2>

<refsect2>

<title>Control group</title>

<para>This configuration will setup several control groups for

the application, cpuset.cpus restricts usage of the defined cpu,

cpus.share prioritize the control group, devices.allow makes

usable the specified devices.</para>

<programlisting>

lxc.cgroup.cpuset.cpus = 0,1

lxc.cgroup.cpu.shares = 1234

lxc.cgroup.devices.deny = a

lxc.cgroup.devices.allow = c 1:3 rw

lxc.cgroup.devices.allow = b 8:0 rw

</programlisting>

</refsect2>

<refsect2>

<title>Complex configuration</title>

<para>This example show a complex configuration making a complex

network stack, using the control groups, setting a new hostname,

mounting some locations and a changing root file system.</para>

<programlisting>

lxc.utsname = complex

lxc.network.type = veth

lxc.network.flags = up

lxc.network.link = br0

lxc.network.hwaddr = 4a:49:43:49:79:bf

lxc.network.ipv4 = 1.2.3.5/24

lxc.network.ipv6 = 2003:db8:1:0:214:1234:fe0b:3597

lxc.network.ipv6 = 2003:db8:1:0:214:5432:feab:3588

lxc.network.type = macvlan

lxc.network.flags = up

lxc.network.link = eth0

lxc.network.hwaddr = 4a:49:43:49:79:bd

lxc.network.ipv4 = 1.2.3.4/24

lxc.network.ipv4 = 192.168.10.125/24

lxc.network.ipv6 = 2003:db8:1:0:214:1234:fe0b:3596

lxc.network.type = phys

lxc.network.flags = up

lxc.network.link = dummy0

lxc.network.hwaddr = 4a:49:43:49:79:ff

lxc.network.ipv4 = 1.2.3.6/24

lxc.network.ipv6 = 2003:db8:1:0:214:1234:fe0b:3297

lxc.cgroup.cpuset.cpus = 0,1

lxc.cgroup.cpu.shares = 1234

lxc.cgroup.devices.deny = a

lxc.cgroup.devices.allow = c 1:3 rw

lxc.cgroup.devices.allow = b 8:0 rw

lxc.mount = /etc/fstab.complex

lxc.mount.entry = /lib /root/myrootfs/lib none ro,bind 0 0

lxc.rootfs = /mnt/rootfs.complex

lxc.cap.drop = sys_module mknod setuid net_raw

lxc.cap.drop = mac_override

</programlisting>

</refsect2>

</refsect1>

<refsect1>

<title>See Also</title>

<simpara>

<citerefentry>

<refentrytitle><command>chroot</command></refentrytitle>

<manvolnum>1</manvolnum>

</citerefentry>,

<citerefentry>

<refentrytitle><command>pivot_root</command></refentrytitle>

<manvolnum>8</manvolnum>

</citerefentry>,

<citerefentry>

<refentrytitle><filename>fstab</filename></refentrytitle>

<manvolnum>5</manvolnum>

</citerefentry>

</simpara>

</refsect1>

&seealso;

<refsect1>

<title>Author</title>

<para>Daniel Lezcano <email>daniel.lezcano@free.fr</email></para>

</refsect1>

</refentry>