What do you want to see in a minimal template (OpenVZ 7)

InceptionHosting

Hi Folks,

Just to get the troll answer out of the way: KVM

Moving on..

As per the title as a VPS user, what would you like to see in a minimal template for Debian 10 and Ubuntu 18 and CentOS 7? (8 not yet available as an EZ template to modify)

I am only focusing on the latest versions for now.

Current package set I have made up in my list to create a new minimal set:

debian10

• apt
• openssh-client
• openssh-server
• wget
• nano
• iputils-ping
• iptables
• tar
• unzip
• bzip2
• gzip
• bash
• sudo

ubuntu18

• apt
• openssh-client
• openssh-server
• wget
• nano
• iputils-ping
• iptables
• bash
• tar
• unzip
• bzip2
• gzip
• bash
• sudo

centos7

• initscripts
• authconfig
• yum
• rpm
• wget
• vim-minimal
• nano
• iproute
• iptables
• iptables-services
• openssh-clients
• openssh-server
• tar
• unzip
• bzip2
• gzip
• bash
• sudo

Packages must be available in the standard distro repo's

tetech

CentOS 7

• authconfig
• basesystem
• bash
• binutils
• ca-certificates
• coreutils
• deltarpm
• device-mapper
• device-mapper-event
• dhclient
• filesystem
• grep
• gzip
• haveged
• hostname
• iptables
• iptables-services
• openssh-server
• passwd
• rpm
• rsyslog
• sed
• sudo
• sysstat
• systemd
• tar
• util-linux
• vim-minimal
• virt-what
• wget
• which
• yum

Rather less than more, so fewer than the above OK.

tgl

man, add also ALPINE LINUX, its 2MB or something

kramer

Some of the additional small stuff I always install and use regularly with Ubuntu. I'll just leave them here ...
changetrack
dstat
iperf
iptraf
msmtp
rdiff-backup
s-nail
tmux

InceptionHosting

tgl said: man, add also ALPINE LINUX, its 2MB or something

Not so simple with OpenVZ 7 as the template creation process is different.

mmuyskens

Xen.

vimalware

How about ensuring the a beefier set of default locales installed?
en_US.utf8 is necessary to get software like mosh working correctly and almost everyone can needs it.
I always end up wasting 5-10m with VZ virtualization when the locales are missing.

seanho

For debian, in addition to what you've listed: git, rsync, locales, apt-transport-https. Perhaps bash, but dash may well be sufficient.

Nowadays, just ssh and apt are enough for ansible to install everything else I'd need.

schnafi

For debian
What about ca-certificates? Are they included in openssh-server already? Because I don't think so
I also like htop very much

beagle

For a CentOS 7 min template I would add:

• firewalld

InceptionHosting

@beagle said:
For a CentOS 7 min template I would add:

• firewalld

Really? In a minimal template?

beagle

@AnthonySmith said:

@beagle said:
For a CentOS 7 min template I would add:

• firewalld

Really? In a minimal template?

That's the default firewall on CentOS.

InceptionHosting

I know, but it is not a requirement.

beagle

Indeed, but because it's the default option it's what I expect to find in a minimal CentOS template.

InceptionHosting

I did not even put ip tables in the last set I made

uhu

I'd go firewalld not iptables on Centos too.

beagle

@AnthonySmith said:
I did not even put ip tables in the last set I made

Stingy

alento

Ubuntu 18.04

I (foolishly perhaps?) tried to install Mail-in-a-Box on an OpenVZ7 VPS today and there were two things that were annoyingly missing.
1. nano (which you have included)
2. curl

The third thing was Locale info which someone else already noted.

tetech

@uhu said:
I'd go firewalld not iptables on Centos too.

I hate firewalld and try to get rid of it. For me iptables makes it easier to manage scripts across different distros.

Generally less is better. If you've got wget, yum, which, rpm then pretty much anything else people want can be added by individuals in their standard setup script. Removing is trickier because your script has to figure which dependencies might break, and dependencies change.

flips

I also prefer minimal to be minimal ...

BTW; Any easy way in CentOS to strip away packages to a required minimum?

(In Debian I'd use deborphan to help me remove stuff, then save the ouput of
dpkg --get-selections and use that with --set-selections on another installation ...)

tetech

flips said: BTW; Any easy way in CentOS to strip away packages to a required minimum?

I don't know of an easy way. My script has a 'whitelist' of minimal packages, and does a rpm --query -a then builds a list of what to remove based on the difference. The annoying thing about this is I have to add all the dependencies into the whitelist, which is why minimal is easier to handle.

flips

I upgraded a not very small "minimal" centos7 to centos8, it worked, but I couldn't figure out an easy way to identify the orphans/deps I could get rid off easily, it used 1.1 GB of my 5 GB disk space in OVZ7 ...

tetech

@flips said:
I upgraded a not very small "minimal" centos7 to centos8, it worked, but I couldn't figure out an easy way to identify the orphans/deps I could get rid off easily, it used 1.1 GB of my 5 GB disk space in OVZ7 ...

For orphans you can probably do something like orphans="" ; for r in $( rpm --query -a ) ; do d=$( rpm -qR ${r} | wc -l ) ; if [[ "${d}" -eq "0" ]] ; then orphans="${orphans} ${r}" ; fi ; done (just freestyling, completely untested).

FlamingSpaceJunk

@flips said:
I upgraded a not very small "minimal" centos7 to centos8, it worked, but I couldn't figure out an easy way to identify the orphans/deps I could get rid off easily, it used 1.1 GB of my 5 GB disk space in OVZ7 ...

Try yum autoremove to get rid of the orphans.

FlamingSpaceJunk

Plus

• tmux
• curl
• tree
• which
• jitterentropy
• rsync
• systemd
• firewalld

Minus

• wget
• nano

TigersWay

I feel the need to express a simple fact: Minimal means Minimal!
There's only one thing needed: SSH

tgl

openvpn ? many ppl buy these for just that

InceptionHosting

@TigersWay said:
I feel the need to express a simple fact: Minimal means Minimal!
There's only one thing needed: SSH

You don’t even want a package manager?

Rahul

which came first: the chicken or the egg?

InceptionHosting

@Rahul said:
which came first: the chicken or the egg?

Very helpful thanks for your invaluable contribution.

TigersWay

@AnthonySmith said:

@TigersWay said:
I feel the need to express a simple fact: Minimal means Minimal!
There's only one thing needed: SSH

You don’t even want a package manager?

what would I do with it?

Jokes aside, what you set in your first post is more than fine; anything optional should not be in a minimal.
The problem - if I understand correctly - is that you have to un-install / delete stuff, while a minimal install is to build only with the mandatory bricks/packages.

Daniel

I don't actually like SSH being pre-installed as I'm never sure if the template correctly generates an SSH host key or if every single person that uses the template gets the same key (which would open you up to MitM attacks). Also hard to confirm that the installed OpenSSH version is legit (which is why I always install from ISO on KVM). First thing I do with a template that has OpenSSH installed is purge it then reinstall so I know for sure the key is randomly generated.

If the minimal image isn't going to be extremely minimal, also add ca-certificates and apt-transport-https please.

InceptionHosting

Daniel said: I don't actually like SSH being pre-installed as I'm never sure if the template correctly generates an SSH host key

There are hooks within (within solusvm anyway) to take care of that, i do however appreciate the comment, it is a valid one that has been an issue in the past, the problem is though that no ssh would baffle and confuse 80% of customers.

kokkez

I'm also a fan of rsync, I would put it on every minimal distro...

havoc

Haven't tried OVZ frankly...sticking to KVM because that's what I know/understand. From that list I'd probably miss:

tree
ufw
htop

poisson

Maybe what is important is also to have a list of what your minimal templates include so that people know what packages they need when they deploy? You can't satisfy everyone, but at least people can know what they need to install on top of the minimal with a glance.

TigersWay

Starting with Debian (the only one I really need and know):

• apt (nothing can be done without)
• openssh-server (You need to talk to it)
• nano (default Editor)
• bash (default command shell)

If I am not wrong, anything else can then be installed

dahartigan

@AnthonySmith the Debian 9 install I got from you the other day is awesomely minimal, and I'm very thankful for that. Keeps things clean and simple, plus everything else that might be missing is an apt install away.

Locales and tmux, easy fix. Run: sudo dpkg-reconfigure locales

Side effect is the lack of "dialog" being installed was interesting, it was neat to see an unexpectedly minimal screen while apt was setting things up and asking questions. Never came across it before and I learned something new!

Someone mentioned ssh, that would probably have confused the absolute shit out of me if that was missing! :-P

Tl;dr: keep it as it is, minimal means minimal. Everything is an apt install away.

vimalware

Yes, Provider should probably add 'sudo, dialog, nano, locales'
Those are the ones that trip me up when setting up manually on a minimal image.

I do ssh key regen everytime I spin-up from a template. No point in leaving out openssh-server from minimal.
Terminal-first UX beats the VNC, then terminal UX.

dahartigan

I think debian leaves out sudo by default, I've always had to install sudo if I needed it.

I love nano, but like curl it's not always available by default.

I have basically memorized a one liner for apt that I run the first time I hit the terminal.

flips

dahartigan said: I love nano, but like curl it's not always available by default.
I have basically memorized a one liner for apt that I run the first time I hit the terminal.

Editor flame war? I actually remove nano, doing something like
apt-get install vim nano-
(The minus/dash doing a remove)

(I find it confusing that "vim-tiny" does not provide vim, but just vi ... So, if using vim-tiny or other systems with just vi, I need an alias, as vim is to hard imprinted in my muscle memory by now.)

Daniel

@dahartigan said: I think debian leaves out sudo by default, I've always had to install sudo if I needed it.

It depends on what you do during setup.

If you enter a root password, it does not install sudo. However, if you do not enter a root password (just leave the password field blank), it locks the root user, installs sudo, and adds the user account you created during installation to the sudoers group. The latter is my preferred approach - the root user is locked down on all my systems.