1. Install the btrfs-progs package.

   sudo yum install btrfs-progs

2. Install the lxc and wget packages.

   sudo yum install lxc wget

   This command installs all of the required packages. The LXC template scripts are installed in /usr/share/lxc/templates. LXC uses wget to download packages from the Oracle Linux yum server.

3. Start the LXC network management service, lxc-net, and configure the service to start at boot time.

   sudo systemctl start lxc-net.service
   sudo systemctl enable lxc-net.service

   LXC includes its own network management service to support network bridging for containers.

4. If you are going to compile applications that require the LXC header files and libraries, install the lxc-devel package.

   sudo yum install lxc-devel

1. Create a btrfs file system on a suitably sized device such as /dev/sdb.

   sudo mkfs.btrfs /dev/sdb

2. Mount the /container file system. The /container directory is created automatically when you install LXC.

   sudo mount /dev/sdb /container

3. Add an entry for /container to the /etc/fstab file.

   /dev/sdb      /container    btrfs    defaults   0 0

For more information, see About the Btrfs File System in Oracle Linux 7: Managing File Systems.

1. Create an Oracle Linux 6 container named ol6ctr1 using the lxc-oracle template script.

   sudo lxc-create -n ol6ctr1 -B btrfs -t oracle -- --release=6.latest

   Host is OracleEverything 7.0
   Create configuration file /container/ol6ctr1/config
   Yum installing release 6.latest for x86_64
     .
     .
     .
     yum-metadata-parser.x86_64 0:1.1.2-16.el6                                     
     zlib.x86_64 0:1.2.3-29.el6                                                    
   
   Complete!
   Rebuilding rpm database
   Patching container rootfs /container/ol6ctr1/rootfs for Oracle Linux 6.5
   Configuring container for Oracle Linux 6.5
   Added container user:oracle password:oracle
   Added container user:root password:root
   Container : /container/ol6ctr1/rootfs
   Config    : /container/ol6ctr1/config
   Network   : eth0 (veth) on lxcbr0

   Note:

   For LXC version 1.0 and later, you must specify the -B btrfs option if you want to use the snapshot features of btrfs. For more information, see the lxc-create(1) manual page.

   The lxc-create command runs the template script lxc-oracle to create the container in /container/ol6ctr1 with the btrfs subvolume /container/ol6ctr1/rootfs as its root file system. The command then uses yum to install the latest available update of Oracle Linux 6 from the Oracle Linux yum server. It also writes the container's configuration settings to the file /container/ol6ctr1/config and its fstab file to /container/ol6ctr1/fstab. The default log file for the container is /container/ol6ctr1/ol6ctr1.log.

   You can specify the following template options after the -- option to lxc-create:

   -a | --arch=i386|x86_64

   Specifies the architecture. The default value is the architecture of the host.

   --baseurl=pkg_repo

   Specify the file URI of a package repository. You must also use the --arch and --release options to specify the architecture and the release, for example:

   mount -o loop OracleLinux-R7-GA-Everything-x86_64-dvd.iso /mnt
   lxc-create -n ol70beta -B btrfs -t oracle -- -R 7.0 -a x86_64 --baseurl=file:///mnt/Server

   -P | --patch=path

   Patch the rootfs at the specified path.

   --privileged[=rt]

   Allows you to adjust the values of certain kernel parameters under the /proc hierarchy.

   The container uses a privilege configuration file, which mounts /proc read-only with some exceptions. See Configuring Kernel Parameter Settings for Oracle Linux Containers.

   This option also enables the CAP_SYS_NICE capability, which allows you to set negative nice values (that is, more favored for scheduling) for processes from within the container.

   If you specify the =rt (real-time) modifier, you can configure the lxc.cgroup.cpu.rt_runtime_us setting in the container's configuration file or when you start the container. This setting specifies the maximum continuous period in microseconds for which the container has access to CPU resources from the base period set by the system-wide value of cpu.rt_period_us. Otherwise, a container uses the system-wide value of cpu.rt_runtime_us, which might cause it to consume too many CPU resources. In addition, this modifier ensures that rebooting a container terminates all of its processes and boots it to a clean state.

   -R | --release=major.minor

   Specifies the major release number and minor update number of the Oracle release to install. The value of major can be set to 4, 5, 6, or 7. If you specify latest for minor, the latest available release packages for the major release are installed. If the host is running Oracle Linux, the default release is the same as the release installed on the host. Otherwise, the default release is the latest update of Oracle Linux 6.

   -r | --rpms=rpm_name

   Install the specified RPM in the container.

   -t | --templatefs=rootfs

   Specifies the path to the root file system of an existing system, container, or Oracle VM template that you want to copy. Do not specify this option with any other template option. See Creating Additional Containers.

   -u | --url=repo_URL

   Specifies a yum repository other than Oracle Public Yum. For example, you might want to perform the installation from a local yum server. The repository file in configured in /etc/yum.repos.d in the container's root file system. The default URL is https://yum.oracle.com.

2. If you want to create additional copies of the container in its initial state, create a snapshot of the container's root file system, for example:

   sudo btrfs subvolume snapshot /container/ol6ctr1/rootfs /container/ol6ctr1/rootfs_snap

   See About the Btrfs File System in Oracle^® Linux 7: Managing File Systems and Creating Additional Containers.

3. Start the container ol6ctr1 as a daemon that writes its diagnostic output to a log file other than the default log file.

   sudo lxc-start -n ol6ctr1 -d -o /container/ol6ctr1_debug.log -l DEBUG

   Note:

   If you omit the -d option, the container's console opens in the current shell.

   The following logging levels are available: FATAL, CRIT, WARN, ERROR, NOTICE, INFO, and DEBUG. You can set a logging level for all lxc-* commands.

   If you run the ps -ef --forest command on the host system and the process tree below the lxc-start process shows that the /usr/sbin/sshd and /sbin/mingetty processes have started in the container, you can log in to the container from the host. See Logging in to Containers.

The lxc-oracle template script defines system settings and resources that are assigned to a running container, including the following:

• Default passwords for the oracle and root users, which are set to oracle and root respectively

• Host name (lxc.utsname), which is set to the name of the container

• Number of available terminals (lxc.tty), which is set to 4

• Location of the container's root file system on the host (lxc.rootfs)

• Location of the fstab mount configuration file (lxc.mount)

• All of the system capabilities that are not available to the container (lxc.cap.drop)

• Local network interface configuration (lxc.network)

• All of the allowed cgroup devices (lxc.cgroup.devices.allow)

The template script sets the virtual network type (lxc.network.type) and bridge (lxc.network.link) to veth and lxcbr0. If you want to use a macvlan bridge or Virtual Ethernet Port Aggregator that allows external systems to access your container via the network, you must modify the container's configuration file. See About Veth and Macvlan and Modifying a Container to Use Macvlan.

To enhance security, you can uncomment lxc.cap.drop capabilities to prevent root in the container from performing certain actions. For example, dropping the sys_admin capability prevents root from remounting the container's fstab entries as writable. However, dropping sys_admin also prevents the container from mounting any file system and disables the hostname command. By default, the template script drops the following capabilities: mac_admin, mac_override, setfcap, setpcap, sys_module, sys_nice, sys_pacct, sys_rawio, and sys_time.

For more information, see the capabilities(7) and lxc.conf(5) manual pages.

When you create a container, the template script writes the container's configuration settings and mount configuration to /container/name/config and /container/name/fstab, and sets up the container's root file system under /container/name/rootfs.

Unless you specify to clone an existing root file system, the template script installs the following packages under rootfs (by default, from the Oracle Linux Yum Server at https://yum.oracle.com):

• chkconfig: chkconfig utility for maintaining the /etc/rc*.d hierarchy.

• dhclient: DHCP client daemon (dhclient) and dhclient-script.

• initscripts: /etc/inittab file and /etc/init.d scripts.

• openssh-server: Open source SSH server daemon, /usr/sbin/sshd.

• oraclelinux-release: Oracle Linux release and information files.

• passwd: passwd utility for setting or changing passwords using PAM.

• policycoreutils: SELinux policy core utilities.

• rootfiles: Basic files required by the root user.

• rsyslog: Enhanced system logging and kernel message trapping daemons.

• vim-minimal: Minimal version of the VIM editor.

• yum: yum utility for installing, updating and managing RPM packages.

The template script edits the system configuration files under rootfs to set up networking in the container and to disable unnecessary services including volume management (LVM), device management (udev), the hardware clock, readahead, and the Plymouth boot system.

By default, the lxc-oracle template script sets up networking by setting up a veth bridge. In this mode, a container obtains its IP address from the dnsmasq server that the lxc-net service runs on the private virtual bridge network (lxcbr0) between the container and the host. The host allows a container to connect to the rest of the network by using NAT rules in iptables, but these rules do not allow incoming connections to the container. Both the host and other containers on the veth bridge have network access to the container via the bridge.

Figure 2-1 illustrates a host system with two containers that are connected via the veth bridge lxcbr0.

Figure 2-1 Network Configuration of Containers Using a Veth Bridge

If you want to allow network connections from outside the host to be able to connect to the container, the container needs to have an IP address on the same network as the host. One way to achieve this configuration is to use a macvlan bridge to create an independent logical network for the container. This network is effectively an extension of the local network that is connected the host's network interface. External systems can access the container as though it were an independent system on the network, and the container has network access to other containers that are configured on the bridge and to external systems. The container can also obtain its IP address from an external DHCP server on your local network. However, unlike a veth bridge, the host system does not have network access to the container.

Figure 2-2 illustrates a host system with two containers that are connected via a macvlan bridge.

Figure 2-2 Network Configuration of Containers Using a Macvlan Bridge

If you do not want containers to be able to see each other on the network, you can configure the Virtual Ethernet Port Aggregator (VEPA) mode of macvlan. Figure 2-3 illustrates a host system with two containers that are separately connected to a network by a macvlan VEPA. In effect, each container is connected directly to the network, but neither container can access the other container nor the host via the network.

Figure 2-3 Network Configuration of Containers Using a Macvlan VEPA

For information about configuring macvlan, see Modifying a Container to Use Macvlan and the lxc.conf(5) manual page.

To modify a container so that it uses the bridge or VEPA mode of macvlan, edit /container/name/config and replace the following lines:

lxc.network.type = veth
lxc.network.link = lxcbr0
lxc.network.flags = up

with these lines for bridge mode:

lxc.network.type = macvlan
lxc.network.macvlan.mode = bridge
lxc.network.flags = up
lxc.network.link = eth0

or these lines for VEPA mode:

lxc.network.type = macvlan
lxc.network.macvlan.mode = vepa
lxc.network.flags = up
lxc.network.link = eth0

In these sample configurations, the setting for lxc.network.link assumes that you want the container's network interface to be visible on the network that is accessible via the host's eth0 interface.