Linux containers (LXC) on Arch Linux

Due to a recent Q&A from DistroWatch.com, I am considering the advantages of using the scheduled-release or fixed-release distros, especially Debian which is famed of its stability. The following is the quote from DistroWatch.com,

Rolling releases do tend to have their downsides though. For instance, it is difficult for third-party developers to create software for rolling-releases as a rolling-release distribution is a moving target. It is difficult to target and support an operating system which is changing on a regular basis.

I agree with this point, because I have to change the source code on my old project which uses CEGUI. Moreover, latest PHP source code may not work on the web hosting server, due to the version differences. Though some people argue that rolling release like Arch Linux is not stable, yet I am very satisfied with its stability. The only thing is the compatibility problem to our own source code and other distros or OSes.

Because of this problem, the Debian is always my interested distro. Yet Debian packages are normally not up-to-date, and there is no Mozilla Firefox in its official repository due to the strong philosophy in Debian.

Running the different OSes in the virtual machines such as VirtualBox and Qemu with KVM is a very good solution. However, both solutions show a strong feeling that an OS (guest) within another OS (host). VirtualBox is really useful because of the configuration of the bridged network is very easy. Moreover, the USB devices sharing allows to use the Windows in the VirtualBox to do the printing and using the interactive projector (which beyond my expectation). On the other hand, Qemu is difficult to setup the bridged network. (But Android Emulator is using Qemu.)

There are some disadvantages on VirtualBox. The 3D graphics do not work properly in VirtualBox (I didn’t try on Qemu about 3D graphics). However, we can still install the Direct3D drivers through the VirtualBox Guest Addition. Furthermore, the solutions of using VirtualBox and Qemu require to create virtual hard drives. That means, transferring the files requires some networking solutions such as FTP or SSH. Yet, VirtualBox allows easier solution that mounts the shared folder from the host.

Interestingly, when I come across to the Linux Containers (LXC), this shows an interesting alternative to the VirtualBox and Qemu. Unlike the VirtualBox or Qemu, the guest OS can be run almost side-by-side with the host OS.

Running GVim in LXC on Arch Linux
Running GVim in LXC on Arch Linux

Setup LXC network

There are some useful tutorials/documents regarding how to setup LXC on the Linux distribution on the Internet. However, I found some difficulties when setting up the LXC on the Arch Linux. In Arch Linux, the kernel does not support User Namespace for the LXC. Thus, the LXC has to run in root privilege.

(I will not explain some of the basic steps such as using the commands lxc-create, lxc-start, lxc-stop, etc.)

After creating the container, the network support is also very important, because by default, the container cannot access the network. The easiest way is using bridge.

To setup the bridge, we can use the netctl.

Create a static IP for the netctl,

#In the /etc/ctl/lxbridge
Description="LXC Bridge"
Interface=br0
Connection=bridge
BindsToInterfaces=(wlan0) #Depends which connection we want to bind, do not use multiple interface
IP=static
Address=10.0.2.1/24 #Any
FwdDelay=0

Then,

sudo netctl start lxcbridge

This will produce a bridge interface br0.

Then, similar to Qemu, iptables and IP fowarding are required.

sudo sysctl net.ipv4.ip_foward=1
sudo iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE #where wlan0 can be others

Note: iptables is a must, despising whether the iptables service is started or not.

Then, in the “config” file of the created container, we have to setup the networking

lxc.network.type=veth
lxc.network.link=br0
lxc.network.flags=up
lxc.network.name=eth0
lxc.network.ipv4=10.0.2.2/24
lxc.network.ipv4.gateway=10.0.2.1 #Based on the Bridge address

Because of using the root, the lxc-usernet file is not required to be configured.

In order to run the GUI application, in the config file, we can add this

lxc.mount.entry = /dev/dri dev/dri none bind,optional,create=dir
lxc.mount.entry = /dev/snd dev/snd none bind,optional,create=dir
lxc.mount.entry = /tmp/.X11-unix tmp/.X11-unix none bind,optional,create=dir
lxc.mount.entry = /dev/video0 dev/video0 none bind,optional,create=file

After installing GUI application such as GVim in the guest, to run and use the display,

DISPLAY=:0 gvim

This will run the GUI application as on the host.

Setup LXC sound

In order to play the sound, this can be done through PulseAudio. (I mostly refers to this page.)

The easier way is using the paprefs on the host OS and “Enable network access to local sound devices” in the “Network Server” tab. However, it can also be done in the command-line,

pactl load-module module-native-protocol-tcp #no root required

(If referring to other tutorials, there are other parameters. But in my case, the above command is sufficient.)

Note: The above command is run on host OS.

Once the module loaded, in the guest (container), we can set the environment variable,

export PULSE_SERVER=192.168.1.2 #where the IP address is the host IP address

Then, using the mplayer on any audio file can play the sound successfully.

 

Please note that LXC does not work with non-Linux OS such as Windows. There are some available OS templates for the container, such as Debian, CentOS, Fedora, Gentoo,OpenMandriva, OpenSUSE, and Ubuntu. This is very interesting that we can use different package manager in one computer almost seamlessly working on the host OS.

So far I didn’t test the OpenGL in container. But running glxinfo, it shows the same output as the host computer. I expect that it is using the host display, so the OpenGL should have no problem.

 

What next?

My next intention is to make the container accessible through the LAN of the host OS. Needs time to figure it out.

elinks “Host not found” crash in Arch Linux

I have come across with this problem for quite a long time. Whenever I elinks to a website, such as google.com or yahoo.com, it shows the message “Host not found”. I tried to google about the “elinks host not found”, “elinks resolve problem”, etc, none of them are relevant to my problem.

I thought it is the package error. But when I come across installation of the Arch Linux on a fresh computer, the elinks works fine.

The elinks can browse the http://localhost without any problem. And if I browse a website with the IP address (not the domain name), and if the website does not have redirection, then it works fine also. I think the problem is happened when elinks is trying to resolve the domain.

When going to seek for the help in the forum, in order to prepare significant information to other users, I tried to gather the error message as much as possible. Then I come across with the following message and I typed it out in “leafpad” (since copy and paste does not work in the terminal emulator).

elinks(dump_backtrace+0x22)[0x80ff9c2]
elinks[0x80cf3da]
elinks[0x80cfa5c]
linux-gate.so.1(__kernel_sigreturn+0x0)[0xb77c1d28]
elinks(timeval_add+0xf)[0x810463f]
/usr/lib/libsamba-util.so.0(timeval_current_ofs+0x34)[0xb5d51b64]
/usr/lib/samba/libgse.so(name_query+0x87)[0xb5cabe87]
/usr/lib/libnss_wins.so.2(_nss_wins_gethostbyname_r+0x4e8)[0xb5f24148]
/usr/lib/libnss_wins.so.2(_nss_wins_gethostbyname2_r+0x32)[0xb5f242]
/usr/lib/libc.so.6(+0xd217c)[0xb703917c]
/usr/lib/libc.so.6(getaddrinfo+0xe8)[0xb703a798]
elinks(do_real_lookup+0x69)[0x80cb0a9]
elinks[0x80cb24d]
elinks(start_thread+0xc0)[0x80cf110]
elinks[0x80cb360]
elinks(find_host+0xaf)[0x80cb4af]
elinks(make_connection+0xac)[0x80cc15c]
elinks(http_protocol_handler+0x4f)[0x80e22df]
elinks[0x80c91e0]
elinks[0x80c994f]

From the error message, I found that there is something wrong about the libnss_wins.so.2. Then I remembered I have done something regarding the nss for the Samba before. Thus, I open the /etc/nsswitch.conf and found the “wins” in “hosts” key.

The following is the corresponding line,

hosts: files wins dns myhostname

I remembered that this setting was done long time ago, and elinks never faced this problem before. Just a trial-and-error, I remove the “wins” from the line and elinks to Google again. Now it works.

So, it is confirmed that the “wins” is a problem. Then I add the wins again and disable the sambad systemd service and run the elinks. The problem still exists. That means it is not the sambad service problem, but the nsswitch.conf.

As a result, I just put the “wins” after the “dns”. Now, elinks work fine.

As a conclusion, the “wins” can be added, but only after the “dns”. So that, the elinks will use the DNS to resolve the domain first instead of using libnss_wins.so to resolve the the Windows computer name before hand, which causes some errors. Problem solved.