Proxmox - перенос контейнеров из LXC и отключение apparmor
Материал из support.qbpro.ru
- Имеем виртуальный хост LXC 3.0.1 на базе Debian Мне надо перенести контейнеры с этого хоста на хост Proxmox.
- Создание архива контейнера исходном хосте:
- останавливаем контейнер:
lxc-stop -n wiki
- На хосте LXC находим папку с контейнером и переходим в нее, в rootfs.
cd /var/lib/lxc/wiki/rootfs
- создаем архив контейнера в папке /home:
tar -czvf /home/wiki.tar.gz ./
- полученный архив переносим на хост Proxmox и выполняем его конвертацию:
pct create 101 wiki.tar.gz -description wiki -hostname wiki -memory 1024 -rootfs volume=vmdata1:32 -storage vmdata1 -password mypassword
- пояснение:
pct create 101 - создание ноды 101 wiki.tar.gz -description wiki - архив wiki.tar.gz с пометкой wiki -hostname wiki - имя контейнера / хоста -rootfs volume=<имя носителя proxmox>:<размер образа диска в Гб> -storage vmdata1 - носитель на Proxmox где будет создан образ с носителем
- Для того чтобы не прописывать массу настроек для вновь созданного контейнера после конвертации в apparmor, правим:
mcedit /var/lib/lxc/101/101.conf .. lxc.apparmor.profile = generated lxc.apparmor.allow_nesting = 1 ..
mcedit /var/lib/lxc/apparmor/lxc-107_\<-var-lib-lxc\> #include <tunables/global> profile "lxc-107_" flags=(attach_disconnected,mediate_deleted) { ### Base profile capability, dbus, file, network, umount, # Allow us to receive signals from anywhere. signal (receive), # Allow us to send signals to ourselves signal peer=@{profile_name}, # Allow other processes to read our /proc entries, futexes, perf tracing and # kcmp for now (they will need 'read' in the first place). Administrators can # override with: # deny ptrace (readby) ... ptrace (readby), # Allow other processes to trace us by default (they will need 'trace' in # the first place). Administrators can override with: # deny ptrace (tracedby) ... ptrace (tracedby), # Allow us to ptrace ourselves ptrace peer=@{profile_name}, # ignore DENIED message on / remount deny mount options=(ro, remount) -> /, deny mount options=(ro, remount, silent) -> /, # allow tmpfs mounts everywhere mount fstype=tmpfs, # allow hugetlbfs mounts everywhere mount fstype=hugetlbfs, # allow mqueue mounts everywhere mount fstype=mqueue, # allow fuse mounts everywhere mount fstype=fuse, mount fstype=fuse.*, # deny access under /proc/bus to avoid e.g. messing with pci devices directly deny @{PROC}/bus/** wklx, # deny writes in /proc/sys/fs but allow binfmt_misc to be mounted mount fstype=binfmt_misc -> /proc/sys/fs/binfmt_misc/, deny @{PROC}/sys/fs/** wklx, # allow efivars to be mounted, writing to it will be blocked though mount fstype=efivarfs -> /sys/firmware/efi/efivars/, # block some other dangerous paths deny @{PROC}/kcore rwklx, deny @{PROC}/sysrq-trigger rwklx, deny @{PROC}/acpi/** rwklx, # deny writes in /sys except for /sys/fs/cgroup, also allow # fusectl, securityfs and debugfs to be mounted there (read-only) mount fstype=fusectl -> /sys/fs/fuse/connections/, mount fstype=securityfs -> /sys/kernel/security/, mount fstype=debugfs -> /sys/kernel/debug/, deny mount fstype=debugfs -> /var/lib/ureadahead/debugfs/, mount fstype=proc -> /proc/, mount fstype=sysfs -> /sys/, mount options=(rw, nosuid, nodev, noexec, remount) -> /sys/, deny /sys/firmware/efi/efivars/** rwklx, # note, /sys/kernel/security/** handled below mount options=(ro, nosuid, nodev, noexec, remount, strictatime) -> /sys/fs/cgroup/, # deny reads from debugfs deny /sys/kernel/debug/{,**} rwklx, # allow paths to be made dependent, shared, private or unbindable # TODO: This currently doesn't work due to the apparmor parser treating those as allowing all mounts. # mount options=(rw,make-slave) -> **, # mount options=(rw,make-rslave) -> **, # mount options=(rw,make-shared) -> **, # mount options=(rw,make-rshared) -> **, # mount options=(rw,make-private) -> **, # mount options=(rw,make-rprivate) -> **, # mount options=(rw,make-unbindable) -> **, # mount options=(rw,make-runbindable) -> **, # Allow limited modification of mount propagation mount options=(rw,make-slave) -> /, mount options=(rw,make-rslave) -> /, mount options=(rw,make-shared) -> /, mount options=(rw,make-rshared) -> /, mount options=(rw,make-private) -> /, mount options=(rw,make-rprivate) -> /, mount options=(rw,make-unbindable) -> /, mount options=(rw,make-runbindable) -> /, # allow bind-mounts of anything except /proc, /sys and /dev mount options=(rw,bind) /[^spd]*{,/**}, mount options=(rw,bind) /d[^e]*{,/**}, mount options=(rw,bind) /de[^v]*{,/**}, mount options=(rw,bind) /dev/.[^l]*{,/**}, mount options=(rw,bind) /dev/.l[^x]*{,/**}, mount options=(rw,bind) /dev/.lx[^c]*{,/**}, mount options=(rw,bind) /dev/.lxc?*{,/**}, mount options=(rw,bind) /dev/[^.]*{,/**}, mount options=(rw,bind) /dev?*{,/**}, mount options=(rw,bind) /p[^r]*{,/**}, mount options=(rw,bind) /pr[^o]*{,/**}, mount options=(rw,bind) /pro[^c]*{,/**}, mount options=(rw,bind) /proc?*{,/**}, mount options=(rw,bind) /s[^y]*{,/**}, mount options=(rw,bind) /sy[^s]*{,/**}, mount options=(rw,bind) /sys?*{,/**}, # Allow rbind-mounts of anything except /, /dev, /proc and /sys mount options=(rw,rbind) /[^spd]*{,/**}, mount options=(rw,rbind) /d[^e]*{,/**}, mount options=(rw,rbind) /de[^v]*{,/**}, mount options=(rw,rbind) /dev?*{,/**}, mount options=(rw,rbind) /p[^r]*{,/**}, mount options=(rw,rbind) /pr[^o]*{,/**}, mount options=(rw,rbind) /pro[^c]*{,/**}, mount options=(rw,rbind) /proc?*{,/**}, mount options=(rw,rbind) /s[^y]*{,/**}, mount options=(rw,rbind) /sy[^s]*{,/**}, mount options=(rw,rbind) /sys?*{,/**}, # allow moving mounts except for /proc, /sys and /dev mount options=(rw,move) /[^spd]*{,/**}, mount options=(rw,move) /d[^e]*{,/**}, mount options=(rw,move) /de[^v]*{,/**}, mount options=(rw,move) /dev/.[^l]*{,/**}, mount options=(rw,move) /dev/.l[^x]*{,/**}, mount options=(rw,move) /dev/.lx[^c]*{,/**}, mount options=(rw,move) /dev/.lxc?*{,/**}, mount options=(rw,move) /dev/[^.]*{,/**}, ..