.. -*- coding: utf-8; -*-

=====
 LXC
=====
.. contents::
   :local:

LXC docs
========

https://linuxcontainers.org/lxc/getting-started/
  Upstream "Getting Started".
https://help.ubuntu.com/lts/serverguide/lxc.html
  Ubuntu Server Guide » Virtualization » LXC

LXC releases
============

https://discuss.linuxcontainers.org/tags/release
  Announces of LXC & LXD releases.
https://discuss.linuxcontainers.org/t/lxc-3-0-0-has-been-released/1449
  LXC 3.0.0 has been released.

Supported templates
===================

https://github.com/lxc/lxc-templates
  Old style template scripts for LXC (prefer distrobuilder).
https://github.com/lxc/distrobuilder
  System container image builder for LXC and LXD.
https://brauner.github.io/2018/02/27/lxc-removes-legacy-template-build-system.html
  Details about replacing template stripts.

Install LXC under Debian
========================

Installation::

  $ sudo apt install lxc

Verify that your host/kernel satisfies LXC requirements::

  $ sudo lxc-checkconfig

To make network bridge install supplement packages::

  $ sudo apt-get install bridge-utils dnsmasq

To bootstrap Debian dostro into container install::

  $ sudo apt-get install debootstrap

To bring up network bridge create or edit ``/etc/default/lxc-net``::

  USE_LXC_BRIDGE="true"

  LXC_ADDR="10.0.0.1"
  LXC_NETMASK="255.255.255.0"
  LXC_NETWORK="10.0.0.0/24"
  LXC_DHCP_RANGE="10.0.0.2,10.0.0.254"
  LXC_DHCP_MAX="253"
  LXC_DHCP_CONFILE=""
  LXC_DOMAIN=""

and start service::

  $ sudo service lxc-net start
  $ sudo systemctl restart lxc-net.service

Project file layout
===================

* ``/usr/share/lxc/templates`` is list of templates.
* ``/var/cache/lxc`` is cache for downloaded images.

* ``~/.local/share/lxc`` container storage.
* ``~/.config/lxc`` container configs.
* ``~/.cache/lxc`` is cache for unprivileged downloded images.
* ``~/.local/share/lxcsnaps`` is storage for unprivileged snapshots.

Create new container in LXC
===========================

Create container from template::

  $ sudo lxc-create -t $TMPL -n $NAME -- $EXTRA_ARGS

.. note::
   * ``-t`` defines distro name
   * ``-n`` gives name for container for further referencing
   * everything after ``--`` is passed to template script

Template name is based on file name from ``/usr/share/lxc/templates`` directory without ``lxc-``
prefix.

List available templates with::

  $ ls -alh /usr/share/lxc/templates/

Examples of container creation command::

  $ sudo lxc-create -t debian -n deb-sid --  -r sid --enable-non-free
  $ sudo lxc-create -t debian -n deb-testing --  -r testing
  $ sudo lxc-create -t debian -n deb-stable --  -r stable -a amd64

  $ sudo lxc-create -t alpine -n alpine-3.7 --  -r 3.7

Examples of destroying container::

  $ sudo lxc-destroy --name $NAME

Each template has own options, which can be passed after ``--``. To get help on template specific
options run::

  $ /usr/share/lxc/templates/lxc-ubuntu -h
  $ /usr/share/lxc/templates/lxc-debian -h
  $ /usr/share/lxc/templates/lxc-alpine -h
  $ /usr/share/lxc/templates/lxc-download -h
  ...

For Debian in order to use another miror::

  $ MIRROR=http://httpredir.debian.org/debian sudo lxc-create -t debian -n debtest -- -r sid

List of prebuild containers:

* Visit http://images.linuxcontainers.org/ (default storage of LXC project).
* Run ``/usr/share/lxc/templates/lxc-download --list``

Creating container by downloading pre-built image::

   sudo lxc-create -t download -n alpine-edge -- -d alpine -r edge -a amd64
   sudo lxc-create -t download -n debian-sid -- -d debian -r sid -a amd64
   sudo lxc-create -t download -n ubuntu-bio -- --dist ubuntu --release bionic --arch amd64

Since LXC v3.0 sh-templates moved to separate project and only 4 are left supported::

  $ lxc-create my-busybox -t busybox
  $ lxc-create my-x -t download
  $ lxc-create c1 -t local -- --metadata /path/to/meta.tar.xz --fstree /path/to/rootfs.tar.xz
  $ lxc-create c2 -t oci -- --url docker://alpine

Put ``veth`` network configuration into container config ``/var/lib/lxc/$NAME/config``::

  lxc.network.type = veth
  lxc.network.flags = up
  lxc.network.link = lxcbr0
  lxc.network.veth.pair = veth-stretch
  lxc.network.name = veth-stretch
  lxc.network.ipv4 = 192.168.99.12/24
  lxc.network.ipv4.gateway = 192.168.99.1

Fix DNS resolution in container::

  $ echo nameserver 8.8.8.8 | sudo tee /var/lib/lxc/$NAME/rootfs/etc/resolv.conf

Creating unpriviliged containers
================================

Check if user has assigned ids for namespaces::

  $ cat /etc/subuid
  vagrant:100000:65536
  $ cat /etc/subgid
  vagrant:100000:65536

If not assign ranges with::

  sudo usermod -v 100000-165536 -w 100000-165536  vagrant

or::

  sudo usermod -add-subuids 100000-165536  vagrant
  sudo usermod -add-subgids 100000-165536  vagrant

Create local config::

  mkdir -p ~/.config/lxc
  cat <<EOF >~/.config/lxc/default.conf
  lxc.idmap = u 0 100000 65536
  lxc.idmap = g 0 100000 65536
  lxc.network.type = veth
  lxc.network.link = lxcbr0
  EOF
  echo "$USER veth lxcbr0 2" | sudo tee -a /etc/lxc/lxc-usernet

LXC Container management
========================

List available containers::

  $ sudo lxc-ls
  $ sudo lxc-ls -f
  $ sudo lxc-ls --fancy

Show details about container::

  $ sudo lxc-info --name $NAME

Start container::

  $ sudo lxc-start -n $NAME

Show boot process output during container start with ``-F``::

  $ sudo lxc-start -n $NAME -F
  $ sudo lxc-start -n $NAME --foreground

Safely stop container (by default sends ``SIGPWR`` signal to container ``init`` process and waits 60
sec and then send ``SIGKILL``)::

  $ sudo lxc-stop -n $NAME

To signal reboot (by default sends ``SIGINT`` signal to container ``init`` process)::

  $ sudo lxc-stop -n $NAME -r
  $ sudo lxc-stop -n $NAME --reboot

Urgently stop container (kills all processes)::

  $ sudo lxc-stop -n $NAME -k
  $ sudo lxc-stop -n $NAME --kill

Mark container to start on boot in ``/var/lib/lxc/$NAME/config``::

  lxc.start.auto = 1

Other autostart params::

  lxc.start.delay = 15 # delay in seconds
  lxc.start.order = 50 # higher value means starts earlier

Limit memory usage::

  lxc.cgroup.memory.limit_in_bytes = 256M

Apply memory limit on fly::

  sudo lxc-cgroup -n $NAME memory.limit_in_bytes 100M

Link containers in non standard location to take them in account::

  $ ln -s /opt/lxc/$NAME /var/lib/lxc/$NAME

Show container status/into::

  $ sudo lxc-info -n $NAME

Print just state::

  $ sudo lxc-info -n $NAME -s
  $ sudo lxc-info -n $NAME --state

Print just pid::

  $ sudo lxc-info -n $NAME -p
  $ sudo lxc-info -n $NAME --pid

Print just IP addresses::

  $ sudo lxc-info -n $NAME -i
  $ sudo lxc-info -n $NAME --ips

Run command in running container::

  $ sudo lxc-attach -n $NAME
  $ sudo lxc-attach -n $NAME bash
  $ sudo lxc-attach -n $NAME -- ls -a
  $ sudo lxc-attach -n $NAME -- apk list

Open session in console (attaches container tty process to current terminal, prompt for
user/password)::

  $ sudo lxc-console -n $NAME

Freeze/unfreeze::

  $ sudo lxc-freeze -n $NAME
  $ sudo lxc-unfreeze -n $NAME

Making snapshot
===============

See ``lxc-snapshot(1)``.

List of snapshots::

  $ sudo lxc-snapshot --list
  $ sudo lxc-snapshot -n $NAME --list

Make a snapshot::

  $ sudo lxc-halt -n $NAME
  $ sudo lxc-snapshot -n $NAME

Restore from snapshot::

  $ sudo lxc-halt -n $NAME
  $ sudo lxc-snapshot -n $NAME -r $SNAPNAME