什麼是容器？在生活中我們常見的容器有各種瓶瓶罐罐、各種能夠容納其它物料的東西叫容器；容器的特點就是有着很好的隔離作用，使得不同的物料互相隔離；除此之外容器還方便運輸、方便儲存；這是生活中所說的容器，以及它的特點；在計算機領域中，所謂容器不外乎也有同生活中的容器的特點，隔離，方便“運輸”（計算機中的運輸我們叫移植，從系統A到系統B），方便“存儲”（這裏指程序以及運行所依賴的庫文件打包，即程序及運行時環境打包）；LXC是Linux containers的縮寫，意思就是Linux 容器；Linux容器技術其實就是整合內核的功能，讓其支持多個容器運行時資源相互隔離；我們知道內核的功能用戶是無法直接操作的，必須得有一用戶空間的軟件，通過系統調用去操作內核功能；所以lxc就是用來操作Linux內核容器化的工具；這種邏輯有點類似iptables，iptables本身不對用戶的報文做任何檢查，真正生效的是內核netfilter;

LXC關鍵技術點：

1、chroot：根切換，一個改變當前運行進程以及其子進程的根目錄的操作。一個運行在這種環境的程序無法訪問根目錄外的文件和命令。

2、namespaces：名稱空間，LXC在隔離控制方面依賴於Linux內核的namespace特性，具體而言就是在clone時加入相應的flag；

3、CGroups：控制組，LXC在資源管理方面依賴於Linux內核的cgroups子系統，cgroups子系統是Linux內核提供的一個基於進程組的資源管理的框架，可以爲特定的進程組限定可以使用的資源；

LXC簡單使用：

1、安裝LXC工具

[root@lxc ~]# yum install  lxc-* libcgroup* bridge-utils  
Loaded plugins: fastestmirror
base                                                               | 3.6 kB  00:00:00     
epel                                                               | 4.7 kB  00:00:00     
extras                                                             | 2.9 kB  00:00:00     
updates                                                            | 2.9 kB  00:00:00     
(1/7): base/7/x86_64/group_gz                                      | 153 kB  00:00:00     
(2/7): epel/x86_64/group_gz                                        |  95 kB  00:00:00     
(3/7): epel/x86_64/updateinfo                                      | 1.0 MB  00:00:00     
(4/7): updates/7/x86_64/primary_db                                 | 1.3 MB  00:00:00     
(5/7): extras/7/x86_64/primary_db                                  | 190 kB  00:00:00     
(6/7): base/7/x86_64/primary_db                                    | 6.1 MB  00:00:01     
(7/7): epel/x86_64/primary_db                                      | 6.8 MB  00:00:02     
Determining fastest mirrors
 * base: mirrors.aliyun.com
 * extras: mirrors.aliyun.com
 * updates: mirrors.aliyun.com
Resolving Dependencies
--> Running transaction check
---> Package bridge-utils.x86_64 0:1.5-9.el7 will be installed
---> Package libcgroup.x86_64 0:0.41-21.el7 will be installed
---> Package libcgroup-devel.x86_64 0:0.41-21.el7 will be installed
---> Package libcgroup-pam.x86_64 0:0.41-21.el7 will be installed
……省略部分信息
Installed:
  bridge-utils.x86_64 0:1.5-9.el7              libcgroup.x86_64 0:0.41-21.el7            
  libcgroup-devel.x86_64 0:0.41-21.el7         libcgroup-pam.x86_64 0:0.41-21.el7        
  libcgroup-tools.x86_64 0:0.41-21.el7         lxc.x86_64 0:1.0.11-2.el7                 
  lxc-devel.x86_64 0:1.0.11-2.el7              lxc-doc.noarch 0:1.0.11-2.el7             
  lxc-extra.x86_64 0:1.0.11-2.el7              lxc-libs.x86_64 0:1.0.11-2.el7            
  lxc-templates.x86_64 0:1.0.11-2.el7         

Dependency Installed:
  libtirpc.x86_64 0:0.2.4-0.16.el7         lua-alt-getopt.noarch 0:0.7.0-4.el7           
  lua-filesystem.x86_64 0:1.6.2-2.el7      lua-lxc.x86_64 0:1.0.11-2.el7                 
  python3.x86_64 0:3.6.8-13.el7            python3-libs.x86_64 0:3.6.8-13.el7            
  python3-pip.noarch 0:9.0.3-7.el7_7       python3-setuptools.noarch 0:39.2.0-10.el7     
  python36-lxc.x86_64 0:1.0.11-2.el7      

Complete!
[root@lxc ~]#

提示：安裝前請配置好epel源，以及base源；

2、添加網橋

3、檢查當前系統是否滿足創建容器的條件

[root@lxc ~]# lxc-checkconfig 
Kernel configuration not found at /proc/config.gz; searching...
Kernel configuration found at /boot/config-3.10.0-693.el7.x86_64
--- Namespaces ---
Namespaces: enabled
Utsname namespace: enabled
Ipc namespace: enabled
Pid namespace: enabled
User namespace: enabled
newuidmap is not installed
newgidmap is not installed
Network namespace: enabled
Multiple /dev/pts instances: enabled

--- Control groups ---
Cgroup: enabled
Cgroup clone_children flag: enabled
Cgroup device: enabled
Cgroup sched: enabled
Cgroup cpu account: enabled
Cgroup memory controller: enabled
Cgroup cpuset: enabled

--- Misc ---
Veth pair device: enabled
Macvlan: enabled
Vlan: enabled
Bridges: enabled
Advanced netfilter: enabled
CONFIG_NF_NAT_IPV4: enabled
CONFIG_NF_NAT_IPV6: enabled
CONFIG_IP_NF_TARGET_MASQUERADE: enabled
CONFIG_IP6_NF_TARGET_MASQUERADE: enabled
CONFIG_NETFILTER_XT_TARGET_CHECKSUM: enabled

--- Checkpoint/Restore ---
checkpoint restore: enabled
CONFIG_FHANDLE: enabled
CONFIG_EVENTFD: enabled
CONFIG_EPOLL: enabled
CONFIG_UNIX_DIAG: enabled
CONFIG_INET_DIAG: enabled
CONFIG_PACKET_DIAG: enabled
CONFIG_NETLINK_DIAG: enabled
File capabilities: enabled

Note : Before booting a new kernel, you can check its configuration
usage : CONFIG=/path/to/config /usr/bin/lxc-checkconfig

[root@lxc ~]#

提示：如果沒有報error之類的就表示當前環境滿足創建容器的條件

4、指定模板創建容器

[root@lxc ~]# lxc-create -n test -t /usr/share/lxc/templates/lxc-centos 
Host CPE ID from /etc/os-release: cpe:/o:centos:centos:7
Checking cache download in /var/cache/lxc/centos/x86_64/7/rootfs ... 
Downloading CentOS minimal ...
Loaded plugins: fastestmirror
base                                                               | 3.6 kB  00:00:00     
updates                                                            | 2.9 kB  00:00:00     
Determining fastest mirrors
 * base: mirrors.aliyun.com
 * updates: mirrors.aliyun.com
Resolving Dependencies
--> Running transaction check
---> Package chkconfig.x86_64 0:1.7.4-1.el7 will be installed
--> Processing Dependency: rtld(GNU_HASH) for package: chkconfig-1.7.4-1.el7.x86_64
--> Processing Dependency: libpopt.so.0(LIBPOPT_0)(64bit) for package: chkconfig-1.7.4-1.el7.x86_64
--> Processing Dependency: libc.so.6(GLIBC_2.14)(64bit) for package: chkconfig-1.7.4-1.el7.x86_64
……省略部分內容

Container rootfs and config have been created.
Edit the config file to check/enable networking setup.

The temporary root password is stored in:

        '/var/lib/lxc/test/tmp_root_pass'


The root password is set up as expired and will require it to be changed
at first login, which you should do as soon as possible.  If you lose the
root password or wish to change it without starting the container, you
can change it from the host by running the following command (which will
also reset the expired flag):

        chroot /var/lib/lxc/test/rootfs passwd

[root@lxc ~]#

提示：-t表示指定模板，該模板其實就是一shell腳本，在安裝lxc-templates這個包後，默認/usr/share/lxc/templates/下面有幾個模板；如果能看到以上提示表示容器已經成功創建，我們可以使用lxc-ls查看當前系統創建的所有容器；

[root@lxc ~]# lxc-ls
test  
[root@lxc ~]#

提示：可以看到當前系統只有名爲test的容器

5、修改當前test容器的root密碼

[root@lxc ~]# chroot /var/lib/lxc/test/rootfs passwd
Changing password for user root.
New password: 
BAD PASSWORD: The password is shorter than 8 characters
Retype new password: 
passwd: all authentication tokens updated successfully.
[root@lxc ~]#

提示：其實不用修改也行，默認的密碼存放在/var/lib/lxc/test/tmp_root_passwd這個文件中；不修改密碼登錄容器後，它會提示我們修改密碼

6、啓動容器，並登錄容器

[root@lxc ~]# lxc-start -n test
systemd 219 running in system mode. (+PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 -SECCOMP +BLKID +ELFUTILS +KMOD +IDN)
Detected virtualization lxc.
Detected architecture x86-64.

Welcome to CentOS Linux 7 (Core)!

Running in a container, ignoring fstab device entry for /dev/root.
Cannot add dependency job for unit display-manager.service, ignoring: Unit not found.
[  OK  ] Reached target Local Encrypted Volumes.
[  OK  ] Reached target Swap.
[  OK  ] Started Dispatch Password Requests to Console Directory Watch.
[  OK  ] Started Forward Password Requests to Wall Directory Watch.
[  OK  ] Reached target Paths.
[  OK  ] Reached target Remote File Systems.
[  OK  ] Created slice Root Slice.
[  OK  ] Listening on Journal Socket.
[  OK  ] Created slice User and Session Slice.
[  OK  ] Listening on /dev/initctl Compatibility Named Pipe.
[  OK  ] Listening on Delayed Shutdown Socket.
[  OK  ] Created slice System Slice.
         Mounting Huge Pages File System...
         Starting Read and set NIS domainname from /etc/sysconfig/network...
         Starting Journal Service...
         Starting Remount Root and Kernel File Systems...
[  OK  ] Reached target Slices.
[  OK  ] Created slice system-getty.slice.
         Mounting POSIX Message Queue File System...
[  OK  ] Mounted Huge Pages File System.
[  OK  ] Started Journal Service.
[  OK  ] Started Read and set NIS domainname from /etc/sysconfig/network.
[  OK  ] Mounted POSIX Message Queue File System.
[  OK  ] Started Remount Root and Kernel File Systems.
         Starting Configure read-only root support...
         Starting Flush Journal to Persistent Storage...
         Starting Rebuild Hardware Database...
[  OK  ] Reached target Local File Systems (Pre).
<46>systemd-journald[16]: Received request to flush runtime journal from PID 1
[  OK  ] Started Flush Journal to Persistent Storage.
[  OK  ] Started Configure read-only root support.
         Starting Load/Save Random Seed...
[  OK  ] Reached target Local File Systems.
         Starting Rebuild Journal Catalog...
         Starting Create Volatile Files and Directories...
         Starting Mark the need to relabel after reboot...
[  OK  ] Started Load/Save Random Seed.
[  OK  ] Started Rebuild Journal Catalog.
[  OK  ] Started Create Volatile Files and Directories.
[  OK  ] Started Mark the need to relabel after reboot.
         Starting Update UTMP about System Boot/Shutdown...
[  OK  ] Started Update UTMP about System Boot/Shutdown.
[  OK  ] Started Rebuild Hardware Database.
         Starting Update is Completed...
[  OK  ] Started Update is Completed.
[  OK  ] Reached target System Initialization.
[  OK  ] Listening on D-Bus System Message Bus Socket.
[  OK  ] Reached target Sockets.
[  OK  ] Reached target Basic System.
         Starting Permit User Sessions...
         Starting OpenSSH Server Key Generation...
         Starting LSB: Bring up/down networking...
[  OK  ] Started D-Bus System Message Bus.
         Starting Login Service...
[  OK  ] Started Daily Cleanup of Temporary Directories.
[  OK  ] Reached target Timers.
[  OK  ] Started Permit User Sessions.
         Starting Cleanup of Temporary Directories...
[  OK  ] Started Console Getty.
[  OK  ] Reached target Login Prompts.
[  OK  ] Started Command Scheduler.
[  OK  ] Started Cleanup of Temporary Directories.
[  OK  ] Started Login Service.
[  OK  ] Started OpenSSH Server Key Generation.

CentOS Linux 7 (Core)
Kernel 3.10.0-693.el7.x86_64 on an x86_64

test login: root
Password: 
You are required to change your password immediately (root enforced)
Changing password for root.
(current) UNIX password: 
New password: 
Retype new password: 
[root@test ~]# hostname
test
[root@test ~]#

提示：以上是啓動容器後，用默認密碼登錄容器，它會提示我們修改密碼；如果想要讓該容器後臺運行（不佔據當前shell終端），可以使用-d選項指定即可；

查看test容器的信息

[root@lxc ~]# lxc-info -n test
Name:           test
State:          RUNNING
PID:            5896
IP:             192.168.0.216
CPU use:        0.16 seconds
BlkIO use:      0 bytes
Memory use:     1.34 MiB
KMem use:       0 bytes
Link:           veth6WQY6V
 TX bytes:      1.67 KiB
 RX bytes:      17.50 KiB
 Total bytes:   19.17 KiB
[root@lxc ~]#

停止test容器

[root@lxc ~]# lxc-stop -n test
[root@lxc ~]# lxc-info -n test
Name:           test
State:          STOPPED
[root@lxc ~]#

銷燬容器

[root@lxc ~]# lxc-destroy -n test
[root@lxc ~]# lxc-ls
[root@lxc ~]#

提示：銷燬容器，容器的狀態必須是停止狀態，否則銷燬不了

以上就lxc容器的簡單管理；

相關文章