Installing Linux-VServer on Debian Buster

Published 8 February 2020

Getting Linux-VServer working properly on Debian Buster required a number of workarounds. With help from the #vserver IRC channel and from Bertl, AlexanderS and Guy, I eventually got Buster guest systems running reliably.

I tested this on a dual-core HP Compaq dc7800. The host installation was deliberately simple: a normal SATA disk, GRUB bootloader and no RAID.

Base system installation

I used Debian 10.11 Buster amd64 as the host system. At the time, Buster was the latest Debian release for which the required Linux-VServer packages and patches were readily available.

The Debian release can be checked with:

cat /etc/debian_version

During installation I used the graphical installer and allocated the disk to the root filesystem plus approximately 1 GB swap. I did not install a desktop environment or print server, only:

• SSH server
• Standard system utilities

See also: Errors when starting a guest VServer .

Initial packages and SSH setup

After booting the host and logging in as root, I installed Midnight Commander and edited the SSH configuration:

apt-get install mc
mcedit /etc/ssh/sshd_config

In my installation I enabled:

PermitRootLogin yes
PubkeyAuthentication yes

and restarted SSH with:

/etc/init.d/ssh restart

For an administrative account I used something equivalent to:

su
apt-get install sudo
echo "MyAdminAccount ALL = NOPASSWD: ALL" >> /etc/sudoers

After login, a root shell could then be obtained with:

sudo -s

The remaining base packages were:

apt-get update
apt-get upgrade
apt-get install -y gnupg2
apt-get install curl
apt-get install debootstrap

Installing the VServer kernel

I used Benjamin Green's VServer kernel packages from the psand repository:

wget -q -O - http://repo.psand.net/pubkey.txt | apt-key add -

echo "deb http://repo.psand.net/ buster main" \
    | tee /etc/apt/sources.list.d/kernel-psand.list

apt-get update

apt-get install linux-image-vserver-4.9-beng \
                linux-headers-vserver-4.9-beng

apt-get install util-vserver util-vserver-build

Selecting the VServer kernel in GRUB

I modified /etc/default/grub so that GRUB remembered the most recently selected kernel:

#GRUB_DEFAULT=0
GRUB_DEFAULT=saved
GRUB_SAVEDEFAULT=true

Then:

update-grub

After rebooting I selected:

Advanced options for Debian GNU/Linux
  Debian GNU/Linux, with Linux 4.9.227-vs2.3.9.12-beng

The running kernel could then be verified with:

uname -a

My system reported:

Linux j2dc7800 4.9.227-vs2.3.9.12-beng #1 SMP
Thu Sep 3 11:55:45 BST 2020 x86_64 GNU/Linux

Fixing util-vserver

The default util-vserver installation did not work correctly for me. Starting or stopping a guest could cause the host's /proc, /sys and /dev mounts to disappear.

If /proc disappears temporarily, it can be restored with:

mount -t proc none /proc

One possible historical workaround was to remove systemd from the host. I chose not to do that because of the risk of breaking other parts of the system, including GRUB.

Instead I installed AlexanderS' util-vserver packages:

cd /root
mkdir AlexS
cd AlexS

wget http://repo.psand.net/util-vserver_AlexanderS/libvserver0_0.30.216-pre3126-1_amd64.deb
wget http://repo.psand.net/util-vserver_AlexanderS/util-vserver-core_0.30.216-pre3126-1_amd64.deb
wget http://repo.psand.net/util-vserver_AlexanderS/util-vserver-build_0.30.216-pre3126-1_amd64.deb
wget http://repo.psand.net/util-vserver_AlexanderS/util-vserver_0.30.216-pre3126-1_amd64.deb

dpkg --install *.deb

I also patched:

/usr/share/util-vserver/vserver.functions

changing the loop around line 327 from:

for i in /etc/init.d/rc /etc/rc.d/rc; do

to:

for i in /etc/init.d/rc /etc/rc.d/rc /lib/init/rc /usr/lib/init/rc; do

Restricting the host SSH daemon

The host normally has its own SSH daemon running. It should listen only on the host's IP address and not bind to addresses that belong to VServer guests.

Otherwise a connection to a guest may unexpectedly be accepted by the host's SSH daemon.

For example, instead of:

Port 22
#ListenAddress ::

I used something like:

Port 22
ListenAddress your.hosts.ip.here

The address must be the host's own address, not one belonging to a guest.

Otherwise connecting to a guest can be a little like calling your wife and having your mother-in-law answer.

Checking versions

Linux-VServer version information can be displayed with:

vserver-info

My installation showed approximately:

Kernel:       4.9.227-vs2.3.9.12-beng
util-vserver: 0.30.216-pre3126

To prevent a normal package upgrade from replacing the working util-vserver packages, I placed them on hold:

apt-mark hold libvserver0
apt-mark hold util-vserver
apt-mark hold util-vserver-build
apt-mark hold util-vserver-core

Packages currently on hold can be displayed with:

apt-mark showhold

Creating a Buster guest

With the host working, I created an amd64 Buster guest using debootstrap:

vserver buildbuster642 build \
  -n buildbuster642 \
  -m debootstrap \
  --i-know-its-there \
  --context 2000 \
  --hostname buildbuster642.my.domain \
  --interface enp0s25:192.168.10.9/24 \
  -- -d buster -- \
  --arch=amd64 \
  --exclude=systemd-sysv,systemd,libsystemd0 \
  --include=cron,sysvinit-core,sysvinit-utils

The network interface on this machine was called enp0s25, rather than the older eth0 naming convention.

Starting the guest

Before starting a guest I restarted vprocunhide:

/etc/init.d/vprocunhide restart

Then started the guest:

vserver buildbuster642 start

A successful startup looked like:

Using makefile-style concurrent boot in runlevel 3.
Starting enhanced syslogd: rsyslogd.
Starting periodic command scheduler: cron.

Guest status could then be checked using:

vserver-stat

For example:

CTX   PROC    VSZ    RSS   userTIME  sysTIME   UPTIME   NAME
2000     5   225.9M    0   0m00s00   0m00s00  4m37s97  buildbuster642

The guest can then be entered with:

vserver buildbuster642 enter

Adjusting guest startup and shutdown scripts

A VServer guest cannot directly manipulate much of the underlying hardware, yet a normal Debian SysV startup/shutdown sequence attempts to do so.

This generated errors involving udev, the hardware clock, filesystem mounts, swap and networking.

Typical errors included:

[FAIL] udev requires a mounted sysfs, not started ... failed!
hwclock: Cannot access the Hardware Clock via any known method.
umount: /tmp: must be superuser to unmount.
swapoff: Not superuser.
ifdown: shutdown enp0s25: Operation not permitted

To remove these unnecessary operations I removed several startup and shutdown links inside the guest.

Removed from /etc/rc0.d

K01brightness
K01udev
K03hwclock.sh
K03umountnfs.sh
K04networking
K05umountfs
K06umountroot
K07halt

Removed from /etc/rc6.d

K01brightness
K01udev
K03hwclock.sh
K03umountnfs.sh
K04networking
K05umountfs
K06umountroot
K07reboot

Removed from /etc/rcS.d

S01mountkernfs.sh
S02udev
S03mountdevsubfs.sh
S04hwclock.sh
S05checkroot.sh
S06checkfs.sh
S07checkroot-bootclean.sh
S07kmod
S08mountall.sh
S09mountall-bootclean.sh
S10brightness
S10procps
S11networking
S12mountnfs.sh
S13mountnfs-bootclean.sh
S14bootmisc.sh

After removing these scripts, startup and shutdown behaved as expected for my guest.

Starting guests automatically at boot

First I checked that both util-vserver and vprocunhide were present in the host startup configuration:

ls /etc/rc*.d/ | grep util
ls /etc/rc*.d/ | grep vproc

A guest can then be marked for automatic startup:

echo "default" \
    > /etc/vservers/buildbuster642/apps/init/mark

Increasing /tmp size

In the default guest configuration, /tmp is a tmpfs filesystem limited to 16 MB.

To remove this limit before starting the guest:

sed -i "s/size=16m,//g" /etc/vservers/$XNAME/fstab

Here $XNAME is the guest name, for example buildbuster642.

See also

• Errors when starting a guest VServer
• Installing Pi-hole as a Linux-VServer guest on Debian 10
• Linux-VServer: Installation on Debian