OpenVZ is used for Virtualization and is both light weight (minimal software on the host, guests have small footprints on the hard drive, and minimal use of RAM) and fast (native speed).
I know there are some fans of Openvz out there who wish to use Ubuntu templates (you know who you are).
Cautionary note: The init scripts in Ubuntu 10.04 are problematic and you may have problems starting servers. For example , mysql will not start on boot unless you edit /etc/init/mysql.conf . Updates (to upstart and or the boot scripts [ mountall ] ) may break any fixes you add.
Because of these issues, I would hold off on using Ubuntu 10.04 on a “Production” server.
In this post I will walk you through how I create Ubuntu Lucid (10.04) Templates. There have been a few glitches along the way, and I would like to especially thank Stéphane Graber for the Openvz init scripts.
This walk through is loosely based on OpenVZ Debian Template and assumes you have OpenVZ set up and that you know the basics of chroot, debootstrap, and openvz commands.
To make a template, use Debootstrap. for this how-to the chroot (location to build the template) is /vz/private/777.
Note: On Debian / Ubuntu hosts I mount /var/lib/vz at /vz by adding this line in /etc/fstab :
/var/lib/vz /vz bind bind 0 0
To create a template, follow the Ubuntu wiki Debootstrap page.
Debootstrap
I assume you were able to create what will be a chroot at /vz/private/777 via deboostrtap.
sudo mkdir -p /vz/private/777
sudo debootstrap --variant=minbase --arch i386 lucid /vz/private/777 http://archive.ubuntu.com/ubuntu/
Change --arch i386 to --arch amd64 for a 64 bit template.
Template Configuration
Fix openvz – we need an init script for openvz to start
sudo nano /vz/private/777/etc/init/openvz.conf
Add these lines:
# OpenVZ - Fix init sequence to have OpenVZ working with upstart
description "Fix OpenVZ"
start on startup
task
pre-start script
mount -t devpts devpts /dev/pts
mount -t tmpfs varrun /var/run
mount -t tmpfs varlock /var/lock
mkdir -p /var/run/network
if [ ! -e /etc/mtab ]; then
cat /proc/mounts > /etc/mtab
fi
touch /var/run/utmp
chmod 664 /var/run/utmp
chown root.utmp /var/run/utmp
if [ "$(find /etc/network/ -name upstart -type f)" ]; then
chmod -x /etc/network/*/upstart || true
fi
end script
script
start networking
initctl emit filesystem --no-wait
initctl emit local-filesystems --no-wait
initctl emit virtual-filesystems --no-wait
init 2
end script
Init script from Stéphane Graber modified by bodhi.zazen to work with Proxmox
Fix /etc/init/rc.conf . This fix was submitted by Jean-Michel Dault and Tomoiaga (see the comments below).
Open etc/init/rc.conf and comment out the line “console output”
#console output
#env INIT_VERBOSE
Now remove init scripts we do not need (these scripts are not relevant to openvz guests).
cd /vz/private/777/etc/init/
sudo rm -f console* control* hwclock* module* mount* network-interface* plymouth* procps* tty* udev* upstart*
Note: The final init scripts I have (on a template with ssh-server, mysql, and apache) are :
cron.conf
hostname.conf
mysql.conf
networking.conf
openvz.conf
rc-sysinit.conf
rcS.conf
rc.conf
ssh.conf
You can likely remove rcS.conf and rc-sysinit.conf if you wish. cron.conf will fill your logs, so if you do not run cron scripts / jobs you can remove this script as well.
Configure the template (openvz configuration)
sudo vzctl set 777 --applyconfig vps.basic --save
sudo sh -c 'echo "OSTEMPLATE=ubuntu-10.04-i386-minimal" >> /etc/vz/conf/777.conf'
# Set an ipaddress on the guest (adjust for your network)
sudo vzctl set 777 --ipadd 192.168.0.77 --nameserver 192.168.0.1 --save
Start the template and perform additional configuration
Start the template
sudo vzctl start 777
The next series of steps will configure your template. DO NOT RUN THESE COMMANDS ON THE HOST !!!
Enter into the template
sudo vzctl enter 777
Install some additional packages (you need quota, vim/nano are optional).
apt-get install --force-yes -y gpgv
apt-get update
apt-get install -y adduser apt-utils console-setup iproute netbase nano openssh-blacklist openssh-blacklist-extra openssh-server quota ping sudo vim
Put upstart and mountall on hold (these packages will not be upgraded with apt-get upgrade).
echo "mountall hold"|dpkg --set-selections
echo "upstart hold"|dpkg --set-selections
Replace rsyslog with syslog-ng.
rsyslog is the default in Ubuntu, but, IMO, rsyslog does not work well in an OpenVZ VPS, so I suggest you replace it with syslog-ng.
apt-get purge rsyslog
apt-get -y install syslog-ng
“Fix” Modprobe -
modprobe does not work inside openvz templates, and any script/binary which call modprobe will fail. As a potential fix you can remove modprobe and link to /bin/true
rm /sbin/modprobe
ln -s /bin/true /sbin/modprobe
Depending on the script this may or may not help. For example it helps with ufw, but does not fix all the problems with ufw :
See this discussion on the openVZ forums .
Lock down the root account. If you lock the root account, and wish to access the guest via ssh, you will need to create additional user accounts and configure sudo (in the template). I do this after bringing up a guest and so it is not part of template configuration.
chmod 700 /root
usermod -p '!' root
Fix ssh
sed -i -e 's_oom never_#oom never_g' /etc/init/ssh.conf
Edit /etc/apt/sources.list, add these repositories (if you so desire).
deb http://us.archive.ubuntu.com/ubuntu/ lucid main universe multiverse
deb http://us.archive.ubuntu.com/ubuntu/ lucid-security main universe multiverse
Set a few aliases. This is optional, but I set these in /root/.bashrc .
alias ll="ls -l"
alias la="ls -A"
alias nano="nano -w"
alias cp="cp -i"
alias mv="mv -i"
alias rm="rm -i"
Set locale (adjust your language accordingly).
apt-get update
apt-get -y install language-pack-en
locale-gen en_US.UTF-8
/usr/sbin/update-locale LANG="en_US.UTF-8" LANGUAGE="en_US.UTF-8" LC_ALL="en_US.UTF-8" LC_CTYPE="C"
Next edit /etc/environment and define your environmental variables:
LANG="en_US.UTF-8"
LANGUAGE="en_US.UTF-8"
LC_ALL="en_US.UTF-8"
LC_CTYPE="C"
Package the template
I strongly suggest you use the “S15ssh_gen_host_keys” script to automatically generate a unique set of ssh host keys for each openvz template.
Run these commands in the TEMPLATE , not the host.
# clean your packages
apt-get clean
apt-get autoremove
#Generate a unique set of ssh (host) keys.
rm -f /etc/ssh/ssh_host_*
cat << EOF > /etc/rc2.d/S15ssh_gen_host_keys
#!/bin/sh
ssh-keygen -f /etc/ssh/ssh_host_rsa_key -t rsa -N ''
ssh-keygen -f /etc/ssh/ssh_host_dsa_key -t dsa -N ''
rm -f \$0
EOF
chmod a+x /etc/rc2.d/S15ssh_gen_host_keys
# disable some unnecessary boot scripts
update-rc.d -f ondemand remove
# Clear log files
> /etc/resolv.conf \
echo localhost > /etc/hostname \
> /var/log/messages; > /var/log/auth.log; > /var/log/kern.log; > /var/log/bootstrap.log; \
> /var/log/dpkg.log; > /var/log/syslog; > /var/log/daemon.log; > /var/log/apt/term.log; rm -f /var/log/*.0 /var/log/*.1
Exit the template.
exit
On the HOST stop the template and package.
vzctl set 777 --ipdel all --nameserver ' ' --save
vzctl stop 777
Package with tar
cd /vz/private/777
tar --numeric-owner -vzcf /vz/template/cache/ubuntu-10.04-i386-minimal.tar.gz .
Test the template
sudo vzctl create 888 --ostemplate ubuntu-10.04-i386-minimal
sudo vzctl set 888 --ipadd 192.168.0.88 --nameserver 192.168.0.1 --hostname ubuntu-minimal --save
sudo vzctl start 888
If all went well you should have a working Ubuntu template.
I am always looking for comments or feedback on my templates.
I will post Ubuntu 10.04 templates for others to download in the near future.