/
lxc.container.conf.sgml.in
2879 lines (2706 loc) · 110 KB
/
lxc.container.conf.sgml.in
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!--
lxc: linux Container library
(C) Copyright IBM Corp. 2007, 2008
Authors:
Daniel Lezcano <daniel.lezcano at free.fr>
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-->
<!DOCTYPE refentry PUBLIC @docdtd@ [
<!ENTITY seealso SYSTEM "@builddir@/see_also.sgml">
]>
<refentry>
<docinfo><date>@LXC_GENERATE_DATE@</date></docinfo>
<refmeta>
<refentrytitle>lxc.container.conf</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>lxc.container.conf</refname>
<refpurpose>
LXC container configuration file
</refpurpose>
</refnamediv>
<refsect1>
<title>Description</title>
<para>
LXC is the well-known and heavily tested low-level Linux container
runtime. It is in active development since 2008 and has proven itself in
critical production environments world-wide. Some of its core contributors
are the same people that helped to implement various well-known
containerization features inside the Linux kernel.
</para>
<para>
LXC's main focus is system containers. That is, containers which offer an
environment as close as possible as the one you'd get from a VM but
without the overhead that comes with running a separate kernel and
simulating all the hardware.
</para>
<para>
This is achieved through a combination of kernel security features such as
namespaces, mandatory access control and control groups.
</para>
<para>
LXC has support for unprivileged containers. Unprivileged containers are
containers that are run without any privilege. This requires support for
user namespaces in the kernel that the container is run on. LXC was the
first runtime to support unprivileged containers after user namespaces
were merged into the mainline kernel.
</para>
<para>
In essence, user namespaces isolate given sets of UIDs and GIDs. This is
achieved by establishing a mapping between a range of UIDs and GIDs on the
host to a different (unprivileged) range of UIDs and GIDs in the
container. The kernel will translate this mapping in such a way that
inside the container all UIDs and GIDs appear as you would expect from the
host whereas on the host these UIDs and GIDs are in fact unprivileged. For
example, a process running as UID and GID 0 inside the container might
appear as UID and GID 100000 on the host. The implementation and working
details can be gathered from the corresponding user namespace man page.
UID and GID mappings can be defined with the <option>lxc.idmap</option>
key.
</para>
<para>
Linux containers are defined with a simple configuration file. Each
option in the configuration file has the form <command>key =
value</command> fitting in one line. The "#" character means the line is a
comment. List options, like capabilities and cgroups options, can be used
with no value to clear any previously defined values of that option.
</para>
<para>
LXC namespaces configuration keys use single dots. This means complex
configuration keys such as <option>lxc.net.0</option> expose various
subkeys such as <option>lxc.net.0.type</option>,
<option>lxc.net.0.link</option>, <option>lxc.net.0.ipv6.address</option>, and
others for even more fine-grained configuration.
</para>
<refsect2>
<title>Configuration</title>
<para>
In order to ease administration of multiple related containers, it is
possible to have a container configuration file cause another file to be
loaded. For instance, network configuration can be defined in one common
file which is included by multiple containers. Then, if the containers
are moved to another host, only one file may need to be updated.
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.include</option>
</term>
<listitem>
<para>
Specify the file to be included. The included file must be
in the same valid lxc configuration file format.
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>Architecture</title>
<para>
Allows one to set the architecture for the container. For example, set a
32bits architecture for a container running 32bits binaries on a 64bits
host. This fixes the container scripts which rely on the architecture to
do some work like downloading the packages.
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.arch</option>
</term>
<listitem>
<para>
Specify the architecture for the container.
</para>
<para>
Some valid options are
<option>x86</option>,
<option>i686</option>,
<option>x86_64</option>,
<option>amd64</option>
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>Hostname</title>
<para>
The utsname section defines the hostname to be set for the container.
That means the container can set its own hostname without changing the
one from the system. That makes the hostname private for the container.
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.uts.name</option>
</term>
<listitem>
<para>
specify the hostname for the container
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>Halt signal</title>
<para>
Allows one to specify signal name or number sent to the container's
init process to cleanly shutdown the container. Different init systems
could use different signals to perform clean shutdown sequence. This
option allows the signal to be specified in kill(1) fashion, e.g.
SIGPWR, SIGRTMIN+14, SIGRTMAX-10 or plain number. The default signal is
SIGPWR.
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.signal.halt</option>
</term>
<listitem>
<para>
specify the signal used to halt the container
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>Reboot signal</title>
<para>
Allows one to specify signal name or number to reboot the container.
This option allows signal to be specified in kill(1) fashion, e.g.
SIGTERM, SIGRTMIN+14, SIGRTMAX-10 or plain number. The default signal
is SIGINT.
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.signal.reboot</option>
</term>
<listitem>
<para>
specify the signal used to reboot the container
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>Stop signal</title>
<para>
Allows one to specify signal name or number to forcibly shutdown the
container. This option allows signal to be specified in kill(1) fashion,
e.g. SIGKILL, SIGRTMIN+14, SIGRTMAX-10 or plain number. The default
signal is SIGKILL.
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.signal.stop</option>
</term>
<listitem>
<para>
specify the signal used to stop the container
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>Init command</title>
<para>
Sets the command to use as the init system for the containers.
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.execute.cmd</option>
</term>
<listitem>
<para>
Absolute path from container rootfs to the binary to run by default. This
mostly makes sense for <command>lxc-execute</command>.
</para>
</listitem>
</varlistentry>
</variablelist>
<variablelist>
<varlistentry>
<term>
<option>lxc.init.cmd</option>
</term>
<listitem>
<para>
Absolute path from container rootfs to the binary to use as init. This
mostly makes sense for <command>lxc-start</command>. Default is <command>/sbin/init</command>.
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>Init working directory</title>
<para>
Sets the absolute path inside the container as the working directory for the containers.
LXC will switch to this directory before executing init.
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.init.cwd</option>
</term>
<listitem>
<para>
Absolute path inside the container to use as the working directory.
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>Init ID</title>
<para>
Sets the UID/GID to use for the init system, and subsequent commands.
Note that using a non-root UID when booting a system container will
likely not work due to missing privileges. Setting the UID/GID is mostly
useful when running application containers.
Defaults to: UID(0), GID(0)
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.init.uid</option>
</term>
<listitem>
<para>
UID to use for init.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.init.gid</option>
</term>
<listitem>
<para>
GID to use for init.
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>Proc</title>
<para>
Configure proc filesystem for the container.
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.proc.[proc file name]</option>
</term>
<listitem>
<para>
Specify the proc file name to be set. The file names available
are those listed under /proc/PID/.
Example:
</para>
<programlisting>
lxc.proc.oom_score_adj = 10
</programlisting>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>Ephemeral</title>
<para>
Allows one to specify whether a container will be destroyed on shutdown.
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.ephemeral</option>
</term>
<listitem>
<para>
The only allowed values are 0 and 1. Set this to 1 to destroy a
container on shutdown.
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>Network</title>
<para>
The network section defines how the network is virtualized in
the container. The network virtualization acts at layer
two. In order to use the network virtualization, parameters
must be specified to define the network interfaces of the
container. Several virtual interfaces can be assigned and used
in a container even if the system has only one physical
network interface.
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.net</option>
</term>
<listitem>
<para>
may be used without a value to clear all previous network options.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.net.[i].type</option>
</term>
<listitem>
<para>
specify what kind of network virtualization to be used
for the container.
Multiple networks can be specified by using an additional index
<option>i</option>
after all <option>lxc.net.*</option> keys. For example,
<option>lxc.net.0.type = veth</option> and
<option>lxc.net.1.type = veth</option> specify two different
networks of the same type. All keys sharing the same index
<option>i</option> will be treated as belonging to the same
network. For example, <option>lxc.net.0.link = br0</option>
will belong to <option>lxc.net.0.type</option>.
Currently, the different virtualization types can be:
</para>
<para>
<option>none:</option> will cause the container to share
the host's network namespace. This means the host
network devices are usable in the container. It also
means that if both the container and host have upstart as
init, 'halt' in a container (for instance) will shut down the
host. Note that unprivileged containers do not work with this
setting due to an inability to mount sysfs. An unsafe workaround
would be to bind mount the host's sysfs.
</para>
<para>
<option>empty:</option> will create only the loopback
interface.
</para>
<para>
<option>veth:</option> a virtual ethernet pair
device is created with one side assigned to the container
and the other side on the host.
<option>lxc.net.[i].veth.mode</option> specifies the
mode the veth parent will use on the host.
The accepted modes are <option>bridge</option> and <option>router</option>.
The mode defaults to bridge if not specified.
In <option>bridge</option> mode the host side is attached to a bridge specified by
the <option>lxc.net.[i].link</option> option.
If the bridge link is not specified, then the veth pair device
will be created but not attached to any bridge.
Otherwise, the bridge has to be created on the system
before starting the container.
<command>lxc</command> won't handle any
configuration outside of the container.
In <option>router</option> mode static routes are created on the host for the
container's IP addresses pointing to the host side veth interface.
Additionally Proxy ARP and Proxy NDP entries are added on the host side veth interface
for the gateway IPs defined in the container to allow the container to reach the host.
By default, <command>lxc</command> chooses a name for the
network device belonging to the outside of the
container, but if you wish to handle
this name yourselves, you can tell <command>lxc</command>
to set a specific name with
the <option>lxc.net.[i].veth.pair</option> option (except for
unprivileged containers where this option is ignored for security
reasons).
Static routes can be added on the host pointing to the container using the
<option>lxc.net.[i].veth.ipv4.route</option> and
<option>lxc.net.[i].veth.ipv6.route</option> options.
Several lines specify several routes.
The route is in format x.y.z.t/m, eg. 192.168.1.0/24.
</para>
<para>
<option>vlan:</option> a vlan interface is linked with
the interface specified by
the <option>lxc.net.[i].link</option> and assigned to
the container. The vlan identifier is specified with the
option <option>lxc.net.[i].vlan.id</option>.
</para>
<para>
<option>macvlan:</option> a macvlan interface is linked
with the interface specified by
the <option>lxc.net.[i].link</option> and assigned to
the container.
<option>lxc.net.[i].macvlan.mode</option> specifies the
mode the macvlan will use to communicate between
different macvlan on the same upper device. The accepted
modes are <option>private</option>, <option>vepa</option>,
<option>bridge</option> and <option>passthru</option>.
In <option>private</option> mode, the device never
communicates with any other device on the same upper_dev (default).
In <option>vepa</option> mode, the new Virtual Ethernet Port
Aggregator (VEPA) mode, it assumes that the adjacent
bridge returns all frames where both source and
destination are local to the macvlan port, i.e. the
bridge is set up as a reflective relay. Broadcast
frames coming in from the upper_dev get flooded to all
macvlan interfaces in VEPA mode, local frames are not
delivered locally. In <option>bridge</option> mode, it
provides the behavior of a simple bridge between
different macvlan interfaces on the same port. Frames
from one interface to another one get delivered directly
and are not sent out externally. Broadcast frames get
flooded to all other bridge ports and to the external
interface, but when they come back from a reflective
relay, we don't deliver them again. Since we know all
the MAC addresses, the macvlan bridge mode does not
require learning or STP like the bridge module does. In
<option>passthru</option> mode, all frames received by
the physical interface are forwarded to the macvlan
interface. Only one macvlan interface in <option>passthru</option>
mode is possible for one physical interface.
</para>
<para>
<option>ipvlan:</option> an ipvlan interface is linked
with the interface specified by
the <option>lxc.net.[i].link</option> and assigned to
the container.
<option>lxc.net.[i].ipvlan.mode</option> specifies the
mode the ipvlan will use to communicate between
different ipvlan on the same upper device. The accepted
modes are <option>l3</option>, <option>l3s</option> and
<option>l2</option>. It defaults to <option>l3</option> mode.
In <option>l3</option> mode TX processing up to L3 happens on the stack instance
attached to the slave device and packets are switched to the stack instance of the
master device for the L2 processing and routing from that instance will be
used before packets are queued on the outbound device. In this mode the slaves
will not receive nor can send multicast / broadcast traffic.
In <option>l3s</option> mode TX processing is very similar to the L3 mode except that
iptables (conn-tracking) works in this mode and hence it is L3-symmetric (L3s).
This will have slightly less performance but that shouldn't matter since you are
choosing this mode over plain-L3 mode to make conn-tracking work.
In <option>l2</option> mode TX processing happens on the stack instance attached to
the slave device and packets are switched and queued to the master device to send
out. In this mode the slaves will RX/TX multicast and broadcast (if applicable) as well.
<option>lxc.net.[i].ipvlan.isolation</option> specifies the isolation mode.
The accepted isolation values are <option>bridge</option>,
<option>private</option> and <option>vepa</option>.
It defaults to <option>bridge</option>.
In <option>bridge</option> isolation mode slaves can cross-talk among themselves
apart from talking through the master device.
In <option>private</option> isolation mode the port is set in private mode.
i.e. port won't allow cross communication between slaves.
In <option>vepa</option> isolation mode the port is set in VEPA mode.
i.e. port will offload switching functionality to the external entity as
described in 802.1Qbg.
</para>
<para>
<option>phys:</option> an already existing interface
specified by the <option>lxc.net.[i].link</option> is
assigned to the container.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.net.[i].flags</option>
</term>
<listitem>
<para>
Specify an action to do for the network.
</para>
<para><option>up:</option> activates the interface.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.net.[i].link</option>
</term>
<listitem>
<para>
Specify the interface to be used for real network traffic.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.net.[i].l2proxy</option>
</term>
<listitem>
<para>
Controls whether layer 2 IP neighbour proxy entries will be added to the
lxc.net.[i].link interface for the IP addresses of the container.
Can be set to 0 or 1. Defaults to 0.
When used with IPv4 addresses, the following sysctl values need to be set:
net.ipv4.conf.[link].forwarding=1
When used with IPv6 addresses, the following sysctl values need to be set:
net.ipv6.conf.[link].proxy_ndp=1
net.ipv6.conf.[link].forwarding=1
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.net.[i].mtu</option>
</term>
<listitem>
<para>
Specify the maximum transfer unit for this interface.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.net.[i].name</option>
</term>
<listitem>
<para>
The interface name is dynamically allocated, but if another name
is needed because the configuration files being used by the
container use a generic name, eg. eth0, this option will rename
the interface in the container.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.net.[i].hwaddr</option>
</term>
<listitem>
<para>
The interface mac address is dynamically allocated by default to
the virtual interface, but in some cases, this is needed to
resolve a mac address conflict or to always have the same
link-local ipv6 address. Any "x" in address will be replaced by
random value, this allows setting hwaddr templates.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.net.[i].ipv4.address</option>
</term>
<listitem>
<para>
Specify the ipv4 address to assign to the virtualized interface.
Several lines specify several ipv4 addresses. The address is in
format x.y.z.t/m, eg. 192.168.1.123/24.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.net.[i].ipv4.gateway</option>
</term>
<listitem>
<para>
Specify the ipv4 address to use as the gateway inside the
container. The address is in format x.y.z.t, eg. 192.168.1.123.
Can also have the special value <option>auto</option>,
which means to take the primary address from the bridge
interface (as specified by the
<option>lxc.net.[i].link</option> option) and use that as
the gateway. <option>auto</option> is only available when
using the <option>veth</option>,
<option>macvlan</option> and <option>ipvlan</option> network types.
Can also have the special value of <option>dev</option>,
which means to set the default gateway as a device route.
This is primarily for use with layer 3 network modes, such as IPVLAN.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.net.[i].ipv6.address</option>
</term>
<listitem>
<para>
Specify the ipv6 address to assign to the virtualized
interface. Several lines specify several ipv6 addresses. The
address is in format x::y/m, eg.
2003:db8:1:0:214:1234:fe0b:3596/64
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.net.[i].ipv6.gateway</option>
</term>
<listitem>
<para>
Specify the ipv6 address to use as the gateway inside the
container. The address is in format x::y, eg. 2003:db8:1:0::1
Can also have the special value <option>auto</option>,
which means to take the primary address from the bridge
interface (as specified by the
<option>lxc.net.[i].link</option> option) and use that as
the gateway. <option>auto</option> is only available when
using the <option>veth</option>,
<option>macvlan</option> and <option>ipvlan</option> network types.
Can also have the special value of <option>dev</option>,
which means to set the default gateway as a device route.
This is primarily for use with layer 3 network modes, such as IPVLAN.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.net.[i].script.up</option>
</term>
<listitem>
<para>
Add a configuration option to specify a script to be
executed after creating and configuring the network used
from the host side.
</para>
<para>
In addition to the information available to all hooks. The
following information is provided to the script:
<itemizedlist>
<listitem>
<para>
LXC_HOOK_TYPE: the hook type. This is either 'up' or 'down'.
</para>
</listitem>
<listitem>
<para>
LXC_HOOK_SECTION: the section type 'net'.
</para>
</listitem>
<listitem>
<para>
LXC_NET_TYPE: the network type. This is one of the valid
network types listed here (e.g. 'vlan', 'macvlan', 'ipvlan', 'veth').
</para>
</listitem>
<listitem>
<para>
LXC_NET_PARENT: the parent device on the host. This is only
set for network types 'mavclan', 'veth', 'phys'.
</para>
</listitem>
<listitem>
<para>
LXC_NET_PEER: the name of the peer device on the host. This is
only set for 'veth' network types. Note that this information
is only available when <option>lxc.hook.version</option> is set
to 1.
</para>
</listitem>
</itemizedlist>
Whether this information is provided in the form of environment
variables or as arguments to the script depends on the value of
<option>lxc.hook.version</option>. If set to 1 then information is
provided in the form of environment variables. If set to 0
information is provided as arguments to the script.
</para>
<para>
Standard output from the script is logged at debug level.
Standard error is not logged, but can be captured by the
hook redirecting its standard error to standard output.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.net.[i].script.down</option>
</term>
<listitem>
<para>
Add a configuration option to specify a script to be
executed before destroying the network used from the
host side.
</para>
<para>
In addition to the information available to all hooks. The
following information is provided to the script:
<itemizedlist>
<listitem>
<para>
LXC_HOOK_TYPE: the hook type. This is either 'up' or 'down'.
</para>
</listitem>
<listitem>
<para>
LXC_HOOK_SECTION: the section type 'net'.
</para>
</listitem>
<listitem>
<para>
LXC_NET_TYPE: the network type. This is one of the valid
network types listed here (e.g. 'vlan', 'macvlan', 'ipvlan', 'veth').
</para>
</listitem>
<listitem>
<para>
LXC_NET_PARENT: the parent device on the host. This is only
set for network types 'mavclan', 'veth', 'phys'.
</para>
</listitem>
<listitem>
<para>
LXC_NET_PEER: the name of the peer device on the host. This is
only set for 'veth' network types. Note that this information
is only available when <option>lxc.hook.version</option> is set
to 1.
</para>
</listitem>
</itemizedlist>
Whether this information is provided in the form of environment
variables or as arguments to the script depends on the value of
<option>lxc.hook.version</option>. If set to 1 then information is
provided in the form of environment variables. If set to 0
information is provided as arguments to the script.
</para>
<para>
Standard output from the script is logged at debug level.
Standard error is not logged, but can be captured by the
hook redirecting its standard error to standard output.
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>New pseudo tty instance (devpts)</title>
<para>
For stricter isolation the container can have its own private
instance of the pseudo tty.
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.pty.max</option>
</term>
<listitem>
<para>
If set, the container will have a new pseudo tty
instance, making this private to it. The value specifies
the maximum number of pseudo ttys allowed for a pts
instance (this limitation is not implemented yet).
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>
<title>Container system console</title>
<para>
If the container is configured with a root filesystem and the
inittab file is setup to use the console, you may want to specify
where the output of this console goes.
</para>
<variablelist>
<varlistentry>
<term>
<option>lxc.console.buffer.size</option>
</term>
<listitem>
<para>
Setting this option instructs liblxc to allocate an in-memory
ringbuffer. The container's console output will be written to the
ringbuffer. Note that ringbuffer must be at least as big as a
standard page size. When passed a value smaller than a single page
size liblxc will allocate a ringbuffer of a single page size. A page
size is usually 4KB.
The keyword 'auto' will cause liblxc to allocate a ringbuffer of
128KB.
When manually specifying a size for the ringbuffer the value should
be a power of 2 when converted to bytes. Valid size prefixes are
'KB', 'MB', 'GB'. (Note that all conversions are based on multiples
of 1024. That means 'KB' == 'KiB', 'MB' == 'MiB', 'GB' == 'GiB'.
Additionally, the case of the suffix is ignored, i.e. 'kB', 'KB' and
'Kb' are treated equally.)
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.console.size</option>
</term>
<listitem>
<para>
Setting this option instructs liblxc to place a limit on the size of
the console log file specified in
<option>lxc.console.logfile</option>. Note that size of the log file
must be at least as big as a standard page size. When passed a value
smaller than a single page size liblxc will set the size of log file
to a single page size. A page size is usually 4KB.
The keyword 'auto' will cause liblxc to place a limit of 128KB on
the log file.
When manually specifying a size for the log file the value should
be a power of 2 when converted to bytes. Valid size prefixes are
'KB', 'MB', 'GB'. (Note that all conversions are based on multiples
of 1024. That means 'KB' == 'KiB', 'MB' == 'MiB', 'GB' == 'GiB'.
Additionally, the case of the suffix is ignored, i.e. 'kB', 'KB' and
'Kb' are treated equally.)
If users want to mirror the console ringbuffer on disk they should set
<option>lxc.console.size</option> equal to
<option>lxc.console.buffer.size</option>.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.console.logfile</option>
</term>
<listitem>
<para>
Specify a path to a file where the console output will be written.
Note that in contrast to the on-disk ringbuffer logfile this file
will keep growing potentially filling up the users disks if not
rotated and deleted. This problem can also be avoided by using the
in-memory ringbuffer options
<option>lxc.console.buffer.size</option> and
<option>lxc.console.buffer.logfile</option>.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.console.rotate</option>
</term>
<listitem>
<para>
Whether to rotate the console logfile specified in
<option>lxc.console.logfile</option>. Users can send an API
request to rotate the logfile. Note that the old logfile will have
the same name as the original with the suffix ".1" appended.
Users wishing to prevent the console log file from filling the
disk should rotate the logfile and delete it if unneeded. This
problem can also be avoided by using the in-memory ringbuffer
options <option>lxc.console.buffer.size</option> and
<option>lxc.console.buffer.logfile</option>.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>lxc.console.path</option>
</term>
<listitem>
<para>
Specify a path to a device to which the console will be
attached. The keyword 'none' will simply disable the
console. Note, when specifying 'none' and creating a device node
for the console in the container at /dev/console or bind-mounting
the hosts's /dev/console into the container at /dev/console the
container will have direct access to the hosts's /dev/console.
This is dangerous when the container has write access to the
device and should thus be used with caution.
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect2>
<refsect2>