Host Setup


See network setup

Control group support

Add to /etc/fstab:

cgroup               /sys/fs/cgroup  cgroup  defaults  0  0

Then mount:

# mount cgroup

In order to enable memory and swap controller add the following kernel boot parameters:

cgroup_enable=memory swapaccount=1

LXC installation

# apt-get install lxc debootstrap

Debian's LXC expects that the base path is /var/lib/lxc. To store the containers anywhere else do

# rmdir /var/lib/lxc
# ln -s /srv/lxc /var/lib/lxc

Check the installation:

# lxc-checkconfig

Debian wheezy uses live-debconfig to configure the container. As live-debconfig is only available in Debian jessie it must be downloaded and put to /usr/share/lxc/packages.

Add to /etc/apt/sources.list:

deb http://ftp.de.debian.org/debian unstable main contrib non-free

Then download:

# cd /usr/share/lxc/packages
# apt-get update
# apt-get download live-debconfig

Container Security


Create an LXC container

Create a temporary lxc.conf (see /usr/share/doc/lxc/examples for examples):

lxc.utsname                             = lxc1
lxc.network.type                        = veth
lxc.network.flags                       = up
lxc.network.link                        = br0
lxc.network.name                        = eth0
lxc.network.ipv4                        =
lxc.network.veth.pair                   = veth0

Then create and debootstrap the container.

# lxc-create -n lxc1 -t debian -f lxc1.conf

Additional options:


Debconfig steps:

Live-debconfig steps:

Optional: review LXC config file /srv/lxc/lxc1/config:

Optional: review container network configuration /srv/lxc/lxc1/rootfs/etc/network/interfaces:

Optional: review container hosts file /srv/lxc/test/rootfs/etc/hosts:

Basic setup

Start the container

# lxc-start -n lxc1

Login as root.

Configure console

See Configure console.

Install basic tools

See Install basic tools.

Disable logging of kernel messages within the container. Edit /etc/rsyslog.conf and comment the line

#$ModLoad imklog

Then restart rsyslogd:

# /etc/init.d/rsyslog restart

SSH server

See SSH Server.

Stop the container

(lxc1)# halt

Autostart the container

Check /etc/default/lxc:


Create link in /etc/lxc/auto:

# ln -s /srv/lxc/lxc1/config /etc/lxc/auto/lxc1.conf

Then start using the init script:

# /etc/init.d/lxc start

Install security tools