Virtualization using LXC

LXC Host Details

hostname: infrabase1 Network: 172.16.149.128/25 IP Address : 172.16.149.176 Subnet Mask: 255.255.255.128 Gateway: 172.16.176.129 DNS: 8.8.8.8 Server OS: Ubuntu 18.04 Edition: LTS, server sudo user: kedar FTP Client: Filezilla ssh client: terminal, reminna Text editors: gedit, sublime-text User PC Details PC type: Desktop OS: Ubuntu Desktop IP Address: 172.16.162.65 sudo user:kedar

Introduction

LXC (Linux Containers) is an operating system level virtualization method for running several isolated Linux systems (containers) on a host running a linux operating system. The containers use the kernel of the host operating system and hence lxc does not have to virtualize the entire hardware of the host. Containers are relatively low on resource requirement and a singe host has the ability to run a very dense container environment, running several containers as opposed to a conventional KVM based virtualization. More information is available on here.

Preparing lxc Host

• ssh from local machine to the lxc host

ssh kedar@172.16.149.176

• Ensure infrabase1 (host server) is updated with latest patches and updates

sudo apt update && sudo apt upgrade -y

• Remove unwanted software

sudo apt autoremove

• Restart the host server

sudo init 6

Installing lxc

• Install lxc using the ubuntu repositories

sudo apt install lxc

Creating Containers

• Create a container called as apache. This container will be used as a webserver and apache will be installed as a webserver. You can name the container as you like.

sudo lxc-create -t download -n apache -- -d ubuntu -r bionic -a amd64

Useful commands

Container status modification

sudo lxc-start -n apache
sudo lxc-stop -n apache 
sudo lxc-destroy -n apache
sudo lxc-ls --fancy

Logging into the container

• sudo lxc-start -n apache This will start the container
• sudo lxc-attach -n apache This will log you in the container as root
• Important to note that only root user is enabled in the container. You will have to create a user if you like
• Creating a user while logged into the container. Run the below commands as root in the container

adduser kedar It will ask you many questions, Generally keep the default

• Add the user in sudoer group

usermod -aG sudo kedar

• Install necessary software like openssh server so that you can ssh into the container

apt install openssh-server
systemctl status sshd

LXC containes on network

• By default lxc containers have a private IP and are not accessible to the outside network. The containers are accessible only through the host, however the containers can communicate with each other.
• To make the containers available on the network, we have to bridge the network. Add the below content as follows

sudo nano /etc/netplan/50-cloud-init.yaml

• You must make necessary changes at your end

network:
  version: 2
  renderer: networkd

  ethernets:
    enp4s0:
      dhcp4: false
      dhcp6: false
  bridges:
    br0:
      interfaces: [enp4s0]
      addresses: [172.16.149.176/25]
      gateway4: 172.16.176.129
      mtu: 1500
      nameservers:
        addresses: [8.8.8.8]
      parameters:
        stp: true
        forward-delay: 4
      dhcp4: no
      dhcp6: no

• Save & exit
• Restart netplan

sudo netplan restart

• Change the interface in /etc/default/lxc-net

.
.
.
USE_LXC_BRIDGE="true"
.
.
.
LXC_BRIDGE="br0"
.
.
.

• Restart the lxc-net service

sudo systemctl restart lxc-net

Conclusion

• Lxc is a great way to understand containers and should be a starting point for users who are interested in container based virtualization
• There are several advantages of using Lxc but it is by design and default that the containers are not accessible from outside the host. To enable that there are two options.
  • Create a network bride
  • Using iptables forward ports to the containers
• Explore Lxc and have fun !

Experimental

• For those who do not want to use terminal for creating and managing containers, there is a web panel that allows you manage containers, networks through the browser.
• You can check it out [here]