0

I'm using Ubuntu 14.10 and was trying to run a Fedora container. The container I created via given templates does not work properly. I guess the reason is that systemd is not set up correctly.

First, I installed lxc on the host. Then I create a Fedora container with

# lxc-create -t fedora -n fedora

Then start the container 

# lxc-start -n fedora

Unlike other containers, the Fedora container did not automatically get an IP address

# lxc-ls -f
NAME     STATE    IPV4        IPV6  GROUPS  AUTOSTART  
-----------------------------------------------------
centos   RUNNING  10.0.3.213  -     -       NO         
dropbox  RUNNING  10.0.3.222  -     -       NO         
fedora   RUNNING  -           -     -       NO

I use lxc-attach to enter the Fedora container and found the only running process is init. It could get an IP if dhclient is executed. 

[root@fedora ~]# ps x
  PID TTY      STAT   TIME COMMAND
    1 ?        Ss     0:00 /sbin/init
   12 ?        S      0:00 /bin/bash
   90 ?        R+     0:00 ps x

Shouldn't dhclient, openssh-server and other necessary services start automatically by systemd? Any advice/experience about a Fedora container on Ubuntu/Debian host is welcomed.

Tianren Liu
  • 111
  • 1
  • 5

1 Answers1

0

Firsteval, you created the fedora container twice : your first command is sufficient to download and create a fedora container from linux containers images.

Secondly, I'm betting than apparmor is messing up with your container's cgroups mounpoints. You should see apparmor denying this in /var/log/kern.log. Adding lxc.aa_profile = unconfined to your container's configuration in /var/lib/lxc/fedora/config is a "quick & dirty" way to make it start.

Then you will have an IPv4 address attributed by the dhcp daemon.

After this you can dig a bit more in apparmor's lxc profiles and set up something relevant to avoid your containers to run without protection on the host.

Xavier Lucas
  • 12,815
  • 2
  • 44
  • 50
  • Thank you, it works. As the duplicated methods of creating a container might be misleading, I delete one of them. – Tianren Liu Mar 23 '15 at 05:04
  • And advised by [lxc-users](https://lists.linuxcontainers.org/pipermail/lxc-users/2014-October/007907.html), `lxc.kmsg = 0` is also necessary for the container to work properly. – Tianren Liu Mar 23 '15 at 05:06
  • The reason why I list two method is when I create a centos container, `lxc-download` template leads to the same problem while `lxc-centos` won't. – Tianren Liu Mar 23 '15 at 05:12