Linux container technology-lxc-related technical knowledge

1. lxcbr0

When use_lxc_bridge = "true" in/etc/default/lxc, lxcbr0 is automatically created at lxc startup and assigned the IP address 10.0.3.1, the lxc instance of this bridge can assign IP addresses from 10.0.3.0/24. A dnsmasq instance runs in the background to listen to lxcbr0 and implement DNS and DHCP functions.

2. Use an isolated file system as the storage of lxc instances

The configuration information and root file system of the lxc instance are stored in the/var/lib/lxc directory. In addition, if an instance is not created, it will be cached in the/var/lib/lxc directory. If you want to use a file system other than/var, you can use either of the following methods:

1. Sudo mkdir/srv/lxclib/srv/lxccache
2. Sudo Rm-RF/var/lib/lxc/var/Cache/lxc
3. Sudo ln-S/srv/lxclib/var/lib/lxc
4. Sudo ln-S/srv/lxccache/var/Cache/lxc

Or:

1. Sudo mkdir/srv/lxclib/srv/lxccache
2. Sudo sed-I '$ \
3. /Srv/lxclib/var/lib/lxc none defaults, bind 0 0 \
4. /Srv/lxccache/var/Cache/lxc none defaults, bind 0 0'/etc/fstab
5. Sudo Mount-

3. lxc security-apparmor (Application Access Control System)

 
Apparmor is a plug-in similar to SELinux. Its main function is to set access control permissions for an executable program and restrict the program from reading/writing a directory/file, open/read/write Network Ports. By default, apparmor is installed and loaded. It uses the profiles of each program to determine what files and permissions the program requires. Some packages will install their own profiles. Additional profiles can be found in the apparmor-profiles package. The following describes how to use apparmor: (1) apparmor_status is used to view the current status of the apparmor configuration file.

1. Sudo apparmor_status

(2) AA-Complain puts a program into the complain mode.

1. Sudo AA-complain/path/to/bin // path of the executable program

(3) AA-enforce: place a program into the enforce mode.

1. Sudo AA-Enforce/path/to/bin // path of the executable program

The/etc/apparmor. d directory is where the apparmor configuration file is located. It can be used to operate the mode of all configuration files.
(4) To put all configuration files in complain mode, enter:

1. Sudo AA-complain/etc/apparmor. d /*

(5) Place all configuration files in enforce mode:

1. Sudo AA-Enforce/etc/apparmor. d /*

(6) apparmor_parser is used to load a configuration file to the kernel. It can also re-load the currently loaded configuration file by using the-r option. To load a configuration file:

1. CAT/etc/apparmor. d/profile. Name | sudo apparmor_parser-

(7) re-load a configuration file:

1. CAT/etc/apparmor. d/profile. Name | sudo apparmor_parser-R

(8)/etc/init. d/apparmor can be used to reload all configuration files:

1. Sudo/etc/init. d/apparmor reload

(9) The/etc/apparmor. d/disable directory can be used with the apparmor_parser-r option to disable a configuration file.

1. Sudo ln-S/etc/apparmor. d/profile. Name/etc/apparmor. d/disable/
2. Sudo apparmor_parser-r/etc/apparmor. d/profile. Name

(10) to reactivate a disabled configuration file, delete the soft link to its configuration file in/etc/apparmor. d/disable. Then use option-a to load the configuration file.

1. Sudo RM/etc/apparmor. d/disable/profile. Name
2. CAT/etc/apparmor. d/profile. Name | sudo apparmor_parser-

(11) apparmor can be disabled. Its kernel module can be uninstalled by running the following command:

1. Sudo/etc/init. d/apparmor stop
2. Sudo update-rc.d-F apparmor remove

(12) to re-enable apparmor, enter:

1. Sudo/etc/init. d/apparmor start
2. Sudo update-rc.d apparmor defaults

How to compile the apparmor configuration file will be introduced in the following article!

Let's get back to the apparmor in lxc. Lxc uses the apparmor configuration file to protect the host from malicious behaviors of instances in the container, such: the instances in the container do not have the write permission on most files in the/proc/sysrq-Tigger and/sys directories. In addition, the USR. bin. lxc-start configuration file is used to prevent lxc-start from mounting other files listed in the container root directory. Before executing the INIT process of the container instance, go back to/etc/apparmor. d/lxc-default to check the permission and disable init from accessing some dangerous resources.

In the next article, we will focus on the cgroup mechanism!