Create OpenVZ Cotainers

1. Download the template

echo 'Now downloading CentOS6 x86_64 template....'
cd /vz/template/cache
wget http://download.openvz.org/template/precreated/centos-6-x86_64.tar.gz

2. $vzctl create 101 centos-6-x86_64

It uses the default conf from /etc/vz/conf

Templates:
http://wiki.openvz.org/Download/template/precreated

Install OpenVZ on Amazon EC2 Instance

1. Create an CentOS 6 Amazon Instance from the MarketPlace. 

Click on launch instance, then click on AWS marketpalce
I choose:

CentOS 6.5 (x86_64) - Release Media

Rating

Sold by CentOS.org

$0.00/hr for software

2. Download this script into instance and run it. 

https://raw.githubusercontent.com/H2so4/CentOS-6-Quick-Install-Scripts/master/installOpenVZ-with-WebPanel.sh

#!/bin/bash
# run: source <(curl -s https://raw.github.com/qrpike/CentOS6---OpenVZ-Installer/master/installOpenVZ.sh)


clear
echo 'Going to install OpenVZ for you..'

echo 'installing wget..'
yum install -y wget

echo 'now adding openvz Repo'
cd /etc/yum.repos.d
wget -P /etc/yum.repos.d/ http://ftp.openvz.org/openvz.repo
rpm --import http://ftp.openvz.org/RPM-GPG-Key-OpenVZ

echo 'Installing OpenVZ Kernel'
yum install -y vzkernel.x86_64

echo 'Installing additional tools'
yum install -y vzctl vzquota

echo 'Changing around some config files..'
sed -i 's/kernel.sysrq = 0/kernel.sysrq = 1/g' /etc/sysctl.conf
sed -i 's/net.ipv4.ip_forward = 0/net.ipv4.ip_forward = 1/g' /etc/sysctl.conf

echo 'net.ipv4.conf.default.proxy_arp = 0' >> /etc/sysctl.conf
echo 'net.ipv4.conf.all.rp_filter = 1' >> /etc/sysctl.conf
echo 'net.ipv4.conf.default.send_redirects = 1' >> /etc/sysctl.conf
echo 'net.ipv4.conf.all.send_redirects = 0' >> /etc/sysctl.conf
echo 'net.ipv4.icmp_echo_ignore_broadcasts=1' >> /etc/sysctl.conf
echo 'net.ipv4.conf.default.forwarding=1' >> /etc/sysctl.conf

echo 'Done with that, purging your sys configs'
sysctl -p

sed -i 's/NEIGHBOUR_DEVS=detect/NEIGHBOUR_DEVS=all/g' /etc/vz/vz.conf
sed -i 's/SELINUX=enabled/SELINUX=disabled/g' /etc/sysconfig/selinux

echo 'Now downloading CentOS6 x86_64 template....'
cd /vz/template/cache
wget http://download.openvz.org/template/precreated/centos-6-x86_64.tar.gz

/bin/cp /etc/rc.local /tmp/rc.local
cat > /etc/rc.local << EOF
#!/bin/bash
wget -O - http://ovz-web-panel.googlecode.com/svn/installer/ai.sh | sh 
modprobe vzcpt
modprobe nf_conntrack_ftp
modprobe ip_nat_ftp
/bin/cp -f /tmp/rc.local /etc/rc.local
EOF

# BARE MINIMUM OpenVZ iptables config - CENTOS 6.4
cat > /etc/sysconfig/iptables << EOF
*nat
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o eth+ -j MASQUERADE
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type echo-request -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 3000 -j ACCEPT
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -p icmp -m icmp --icmp-type echo-request -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -p icmp -j ACCEPT
-A FORWARD -i lo -j ACCEPT
-A FORWARD -o eth+ -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
EOF
reboot


echo ' - - - - - - - - - - - - - - - - - - - - - - '
echo ' The server will reboot now and install OpenVZ Web panel'
echo ' '
echo 'When the server boots, it will run the OpenVZ Web panel installation which can take up to 10 minutes'
echo 'This script is executed by backing up/replacing /etc/rc.local with a new file containing the installation script.'
echo 'Once complete, the original /etc/rc.local file is replaced'
echo ' - - - - - - - - - - - - - - - - - - - - - - '

echo '..... well.... that should do it.'
echo 'oh, and ur welcome...'

More info
http://scaleup.us/2014/01/01/centos-one-liner-installation-openvz-and-openvz-web-panel/

update an OpenVZ kernel to the latesr version on CentOS

yum update vzkernel

fix nobody nobody issue in OpenVZ containers for NFS

Just to the NFS server, run
$ chown -R root:root ./*

You don't want to change the ownership on the NFS client side.

Bug: OpenVZ migration with NFS version 4

There is bug for OpenVZ migration with NFS version 4


I mount the /vz and /etc/vz/conf directories to a NFS server to reduce the migration time.

I am able to suspend the container, but it give me error message when resuming it. If I unmount the two directories, problem would be resolved.

Here is the error message when I am using NFS

[root@sr2s1 /]# vzctl suspend 106

Setting up checkpoint...

suspend...

dump...

kill...

Checkpointing completed successfully

Container is unmounted

[root@sr2s1 /]# vzctl resume 106

Restoring container ...

Container is mounted

undump...

Setting CPU units: 1000

Restore error, undump failed: Not a directory

Error: can't open file /lib64/libnss_files-2.12.so

Error: do_rst_vma: rst_file: 107776

Error: do_rst_mm: failed to restore vma: -20

Error: do_rst_mm 183376

Error: rst_mm: -20

Container restore failed

Container is unmounted

The error message complains that the /vz/private/106/lib64/libnss_files-2.12.so file is not accessible, although I set up the correct access and ownership for that file. 

I solved this problem by downgrading the NFS version from 4 to 3. I think the NFS v4 does some security checks that prevents the vzctl resume to access the library files. 

How to downgrade NFS:

http://fengweizhang.blogspot.com/2014/01/downgrade-nfs-from-version-4-to-3.html

redirect stdout and stderr to a file

program [arguments...] 2>&1 | tee -a outfile &

2>&1: directs stderr to stdout

tee receives the content from stdout and write them to a file. -a means append
see man tee for more info.

E.g.,

I want to append the openvz migration log message to a file. This shell script migrates 100 openvz containers in parallel, and wait all of them to finish. It outputs the time at the end.

#!/bin/sh

echo "*********************************************************" | tee -a migrationResult.txt

date | tee -a migrationResult.txt

for i in {1..100}
do
        vzmigrate --live -t  sr1s1 $i 2>&1 | tee -a migrationResult.txt &
done
wait // wait all of the processes to finish
date | tee -a migrationResult.txt

Install license for parallel cloud server

parallel cloud server user guide:

http://www.parallels.com/fileadmin/parallels/documents/hosting-cloud-enablement/pcs/Production_Documents/Update_2/Parallels_Cloud_Server_User_s_Guide_03262013.pdf


nstalling the License
Depending on the way you have obtained your Parallels Cloud Server license, the process of
installing the license slightly differs:
• If you have obtained the license in the form of a product key, you can install it on the server
using the -p option of the vzlicload command. For example, you can execute the following
command to install the XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX product key:
# vzlicload -p XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX
Note: You can also use the vzlicload utility to upgrade the license. For example, this may be
necessary if your current license does not support using Parallels Virtual Automation for managing
Parallels servers.
• If you have obtained the license in the form of an activation code, you can install it on the server
using the -a option of the vzlicupdate command. For example:
# vzlicupdate -a XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX
where XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX is your activation code. When executed,
vzlicupdate connects to the Parallels Key Authentication (KA) licensing server and transmits
the specified activation code there. The licensing server, in turn, generates a license file, sends it
back to the server from where the activation code has been dispatched, and automatically
installs it on this server. So, before executing the aforementioned command, make sure that
your Parallels server is connected to the Internet.
If you are activating your installation by means of an activation key, you must have an active Internet
connection to successfully complete the license installation. Otherwise, you will be presented with
the corresponding warning message informing you of the steps you have to take to activate your
license. As a rule, these steps are the following:
1 Visiting the http://www.parallels.com/en/support/virtuozzo/activate web page and activating the
license manually.
2 Providing the following information on this web page:
• In the Product Code field, specify your license activation code.
• In the HWID field, provide the ID of your server.
• In the Enter following digits field, type the digits displayed next to this field.
3 Clicking the ACTIVATE LICENSE button.
If you have entered the correct information on the Virtuozzo License Activation page, you will be
provided with a link to a license file that you should download to and install on the server. For
example, you can run this command to install the obtained license file
# vzlicload -f /etc/vzlicense
This command will install the license file with the name of vzlicense on your server.

OpenVZ live migration

OpenVZ has its own migration tool: vzmigrate

Usage:

vzmigrate --live -t REMOTE_IP CONTAINER_ID

More detail: $man vzmigrate

A paper describe how it works: 

http://www.landley.net/kdocs/ols/2008/ols2008v2-pages-85-90.pdf

Basic Commands of OpenVZ

$ vzlist
list all of the active containers

$vzctl start 101
$vzctl stop 101
$vzctl restart 101

$vzctl destroy 101
$vzct enter 101

More: http://openvz.org/Basic_operations_in_OpenVZ_environment

[root@sr1s1 ~]# vz
vzcalc         vzcpucheck     vzdqdump       vzifup-post    vzmigrate      vzpid          vzstats      
vzcfgvalidate  vzctl          vzdqload       vzlist         vznetaddbr     vzquota        vzubc        
vzcptcheck     vzdqcheck      vzeventd       vzmemcheck     vznetcfg       vzsplit      

$ vzctl exec 101 ps -ef
See more on man vzctl

Enable networking in VENET OpenVZ container

I followed the instruction from OpenVZ website fo quickly create an VENET container, but it took me a while to enable networking.
Environment: CentOS 6.4 as the server, and try to create an centos-6-x86_64 container

Here is the instruction from OpenVZ website:

https://openvz.org/Quick_Installation_CentOS_6

Create a VENET Container

• Create a CT

# vzctl create 101 --ostemplate centos-6-x86_64 --config vswap-1g

• Configure the CT

# vzctl set 101 --save --name server101
# vzctl set 101 --save --onboot yes
# vzctl set 101 --save --hostname server101.example.com
# vzctl set 101 --save --ipadd 192.168.1.101
# vzctl set 101 --save --searchdomain example.com
# vzctl set 101 --save --nameserver 8.8.8.8 --nameserver 8.8.4.4
# vzctl set 101 --save --cpus 4
# vzctl set 101 --save --ram 8G
# vzctl set 101 --save --swap 4G
# vzctl set 101 --save --diskspace 100G
# vzctl start 101
# vzctl exec 101 passwd

• Done. Enjoy your new VENET container

The instruction is correct, but there are 3 things you may want to pay attention.

1. set up a correct nameserver.
If you are setting up a real server, you can use command $dhclient, and it automatically identify the nameservers and write them into /etc/resovl.conf file. In OpenVZ container, we need to set it up manually.

2. use a correct IP.
In my case, I followed the instruction, and use IP address as 192.168.1.101, which causes me problem to connect to internet in the container. Then, I changed the IP address to 192.168.0.101, and the container can ping google successfully. I think this is because there are internal setting in my subnet, and they may have some IP restrictions.

3. set up a correct IP tables in host node.
Because I used Cent OS 6.4 as my host server, it has IP tables firewall enabled. One simpler solution is to run command $ iptables --flush, it clean all of the IP table rules, but it comes back after reboot. If you want to permanetly change the iptable settings, you need to add a rule to allow the connection from the container to the Internt.

Additionally, take read this page: https://openvz.org/Common_Networking_HOWTOs
My experiments have been working with private IP inaccessible from LAN (case 1) and public static IP accessible from the same LAN (case 2).

Note that, we need to change the interface name (run ifconfig to see which interface that connections to the outside on host) to run this command that enables ping google from the containers.

[host-node]# iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Install OpenVZ on CentOS

Installation: I successfully installed OpenVZ on CentOS 6.4, but CentOS 5.5 has booting problem after switching to OpenVZ kernel

http://openvz.org/Quick_installation
https://openvz.org/Quick_Installation_CentOS_6

Create and Run a Container:
http://openvz.org/Basic_operations_in_OpenVZ_environment
http://openvz.org/Quick_installation