Free Alpine Linux Shell Accounts

15791011

Comments

  • @yoursunny said:

    @Not_Oles said:
    Install of LXC
    What additional changes might be required, if any?

    • cgroups user delegation
    • subuid and subgid files
    fmt:/etc# ls -l *id
    -rw-r--r--    1 root     root            18 Dec 30 06:06 subgid
    -rw-r--r--    1 root     root            18 Dec 30 06:06 subuid
    fmt:/etc# cat *id
    root:100000:65536
    root:100000:65536
    fmt:/etc# 
    
    • network bridge and lxc-usernet file

    Friendly greetings! :)

  • I would like to have one thx

  • @Not_Oles said:

    @yoursunny said:

    @Not_Oles said:
    Install of LXC

    subuid and subgid files

    fmt:/etc# ls -l *id
    -rw-r--r--    1 root     root            18 Dec 30 06:06 subgid
    -rw-r--r--    1 root     root            18 Dec 30 06:06 subuid
    fmt:/etc# cat *id
    root:100000:65536
    root:100000:65536
    fmt:/etc# 
    

    This allows root to create unprivileged LXC containers, but not anybody else.
    subuid and subgid files need to have one entry per user, on non-overlapping ranges.
    Once assigned, the range cannot change, otherwise the user's containers cannot start again.
    I'd suggest deriving user ranges from their uids.

    getent passwd | awk -vFS=: -vOFS=: '
      $3>=1000 && $3<10000 {
        print $1, $3*1000000, 65536
      }
    '
    

    We accept Karma donations for the last flan. 🍮 affbrr

  • @g121 said:
    I would like to have one thx

    Hi @g121!

    Best wishes for a Happy New Year!

    Since you are new here at LES we can say that your being new helps us celebrate the new in the New Year. :)

    Do you want to share a little about who and where you are and what you want to do on the server?

    Thanks!

    Tom

  • Not_OlesNot_Oles Provider
    edited December 2022

    @yoursunny Thanks for yet another of your helpful and interesting comments!

    @yoursunny said: This allows root to create unprivileged LXC containers, but not anybody else.

    Do you see any issue with allowing non-root users to create their own containers? I was thinking of trying to set up LXC so that the containers each had their own IPv4 and IPv6/64.

    @yoursunny said: I'd suggest deriving user ranges from their uids.

    I haven't tried this yet, but it seems like a wonderful way to use getent and awk to derive user ranges! I would enjoy more context. For example, I took a quick look at the server's getent(1) man page. :) But that man page provided little historical context.

    May I please ask where did you get this idea? Do you have a link to an LXC setup tutorial that discusses this method? I did a quick Google search and didn't find this idea for configuring user ranges.

    Thanks again and a very happy new year! :)

  • @Not_Oles said:
    @yoursunny Thanks for yet another of your helpful and interesting comments!

    @yoursunny said: This allows root to create unprivileged LXC containers, but not anybody else.

    Do you see any issue with allowing non-root users to create their own containers? I was thinking of trying to set up LXC so that the containers each had their own IPv4 and IPv6/64.

    A container created by a non-root user would not have more privileges than that user.

    Address assignment is the next step: network bridge and lxc-usernet file.

    @yoursunny said: I'd suggest deriving user ranges from their uids.

    I haven't tried this yet, but it seems like a wonderful way to use getent and awk to derive user ranges! I would enjoy more context. For example, I took a quick look at the server's getent(1) man page. :) But that man page provided little historical context.

    You can safely run this command line to see its effect.
    It only prints the subuid map, but does not modify any files.

    May I please ask where did you get this idea? Do you have a link to an LXC setup tutorial that discusses this method? I did a quick Google search and didn't find this idea for configuring user ranges.

    These come from subuid manpage.
    In my own server I only have one entry lxc:100000:65536 that allows a user named lxc to create containers.

    We accept Karma donations for the last flan. 🍮 affbrr

  • Not_OlesNot_Oles Provider
    edited December 2022

    Happy New Year

    Happy New Year everyone! I hope you continue to enjoy our time on this server!

    I especially thank those who have thanked me for and posted replies to my server setup reports. Some of these have drawn so few thanks and so few comments that I considered no longer posting setup updates and transcripts.

    For example, here's a recent update that did not previously get posted:

    Man pages update

    I was wondering why I couldn't seem to see many man pages on the server. Looking around on Google, I found that, in Alpine, man pages frequently are an additional package with the name $package-doc. I found a neat trick at https://georgegarside.com/blog/technology/alpine-linux-install-all-man-pages/:

    apk list -I | sed -rn '/-doc/! s/([a-z-]+[a-z]).*/\1/p' | xargs -tI§ apk add §-doc

    This trick seemed to work to install a lot of the man pages which were not installed because I didn't add $package-doc to apk add $package.

    I won't post the lengthy output of this command, but I have it if anybody wants to see it. :)

    If you find a man page that still seems missing, please let me know, and I will try to add it. Thanks!

    Are people interested in continuing setup update posts?

  • @Not_Oles said:

    @g121 said:
    I would like to have one thx

    Hi @g121!

    Best wishes for a Happy New Year!

    Since you are new here at LES we can say that your being new helps us celebrate the new in the New Year. :)

    Do you want to share a little about who and where you are and what you want to do on the server?

    Thanks!

    Tom

    Thank you, I wish you a happy new year, I am a student from China, I already have two vps, but I haven't used alpine yet, so I want to try it, I will run a web service on it or telegram bot or something

  • @g121 said:

    @Not_Oles said:

    @g121 said:
    I would like to have one thx

    Hi @g121!

    Best wishes for a Happy New Year!

    Since you are new here at LES we can say that your being new helps us celebrate the new in the New Year. :)

    Do you want to share a little about who and where you are and what you want to do on the server?

    Thanks!

    Tom

    Thank you, I wish you a happy new year, I am a student from China, I already have two vps, but I haven't used alpine yet, so I want to try it, I will run a web service on it or telegram bot or something

    Hi @g121!

    Could you please post your ed25519 public key?

    May I please ask whether you are a high school student or a university student? Are you studying or do you want to study computer engineering?

    Best wishes!

    Tom

  • Maybe I should at least look around a little. . . .

    fmt:~$ git clone https://github.com/lxc/lxc.git
    Cloning into 'lxc'...
    remote: Enumerating objects: 89628, done.
    remote: Counting objects: 100% (498/498), done.
    remote: Compressing objects: 100% (279/279), done.
    remote: Total 89628 (delta 257), reused 438 (delta 219), pack-reused 89130
    Receiving objects: 100% (89628/89628), 33.93 MiB | 20.62 MiB/s, done.
    Resolving deltas: 100% (62684/62684), done.
    fmt:~$ 
    

    @Not_Oles said: @yoursunny said: I'd suggest deriving user ranges from their uids.

    # Probably will replace the login name with the UID 
    notoles:1000000000:65536
    yoursunny:1018000000:65536
    

    Anybody else want in on LXC? Thanks!

    @yoursunny said: Address assignment is the next step: network bridge and lxc-usernet file.

    Noted. Thanks for your help!

  • @yoursunny said: These come from subuid manpage.

    @Not_Oles said: If you find a man page that still seems missing, please let me know, and I will try to add it. Thanks!

    Hmm, the subuid manpage doesn't seem to be installed on fmt. How did I miss it? What apk package has it? :)

  • @Not_Oles said:
    Maybe I should at least look around a little. . . .

    fmt:~$ git clone https://github.com/lxc/lxc.git
    Cloning into 'lxc'...
    remote: Enumerating objects: 89628, done.
    remote: Counting objects: 100% (498/498), done.
    remote: Compressing objects: 100% (279/279), done.
    remote: Total 89628 (delta 257), reused 438 (delta 219), pack-reused 89130
    Receiving objects: 100% (89628/89628), 33.93 MiB | 20.62 MiB/s, done.
    Resolving deltas: 100% (62684/62684), done.
    fmt:~$ 
    

    @Not_Oles said: @yoursunny said: I'd suggest deriving user ranges from their uids.

    # Probably will replace the login name with the UID 
    notoles:1000000000:65536
    yoursunny:1018000000:65536
    

    Anybody else want in on LXC? Thanks!

    @yoursunny said: Address assignment is the next step: network bridge and lxc-usernet file.

    Noted. Thanks for your help!

    Why not LXD? It's a lot more usable than plain LXC.

  • @drunekndog said:
    Why not LXD? It's a lot more usable than plain LXC.

    Why not LXC?
    It's a lot more efficient than fancy LXD.

    An important technical limitation of LXD is the lack of isolation between host machine users authorized to create containers.

    From LXD installation:

    Access control for LXD is based on group membership.
    The root user and all members of the lxd group can interact with the local daemon.

    Anyone with access to the LXD socket can fully control LXD, which includes the ability to attach host devices and file systems.

    In contrast, LXC doesn't have a local daemon.
    Each user can launch their own unprivileged containers, without being able to access other users' containers.

    We accept Karma donations for the last flan. 🍮 affbrr

  • @Not_Oles said: @yoursunny said: I'd suggest deriving user ranges from their uids.

    # Probably will replace the login name with the UID 
    notoles:1000000000:65536
    yoursunny:1018000000:65536
    

    Anybody else want in on LXC? Thanks!

    >

    I'd love to Tinkle with lxc..

  • @localhost said:

    @Not_Oles said: @yoursunny said: I'd suggest deriving user ranges from their uids.

    # Probably will replace the login name with the UID 
    notoles:1000000000:65536
    yoursunny:1018000000:65536
    

    Anybody else want in on LXC? Thanks!

    >

    I'd love to Tinkle with lxc..

    Hi @localhost!

    I'd love to Tinkle with lxc..

    You are in. But it's not quite ready yet. So please keep watching this thread, and maybe helping me out with the configuration.

    notoles:1000000000:65536
    localhost:1002000000:65536
    yoursunny:1018000000:65536
    

    Tinkle

    May we please go easy on this kind of language here in this thread? Yes, I do appreciate the linguistic humor, maybe"tinker" vs "tinkle." But there are plenty enough other threads for humor. Thanks very much!

  • @drunekndog said: Why not LXD? It's a lot more usable than plain LXC.

    Hi! LXD probably is okay. Certainly I have nothing against LXD. I myself haven't got to LXD yet. As of course you know, LXD is built on top of LXC. I imagined it might be a good idea to learn a little about how the LXC foundation worked before moving on to LCD.

    @yoursunny said:

    [LXC] is a lot more efficient than fancy LXD.

    An important technical limitation of LXD is the lack of isolation between host machine users authorized to create containers.

    Thanks @yoursunny! I appreciate your mentioning efficiency and isolation. :)

  • @Not_Oles said: I imagined it might be a good idea to learn a little about how the LXC foundation worked before moving on to LCD.

    Do we get a fancy LCD screen once we aced the LXC game? :bleep_bloop:

    DM us for private tracker invite.

  • @Not_Oles said: Anybody else want in on LXC? Thanks!

    I would like to try it.
    Count me in.Thanks!

  • @subenhon said:

    @Not_Oles said: Anybody else want in on LXC? Thanks!

    I would like to try it.
    Count me in.Thanks!

    You are in! :)

    notoles:1000000000:65536
    localhost:1002000000:65536
    yoursunny:1018000000:65536
    subenhon:1022000000:65536
    
  • I'm interested, can i use this for building APKs ?

    it will involve abuild and aports;
    https://wiki.alpinelinux.org/wiki/Include:Abuild
    https://wiki.alpinelinux.org/wiki/Aports_tree

    Fuck this 24/7 internet spew of trivia and celebrity bullshit.

  • @Not_Oles said:

    @g121 said:

    @Not_Oles said:

    @g121 said:
    I would like to have one thx

    Hi @g121!

    Best wishes for a Happy New Year!

    Since you are new here at LES we can say that your being new helps us celebrate the new in the New Year. :)

    Do you want to share a little about who and where you are and what you want to do on the server?

    Thanks!

    Tom

    Thank you, I wish you a happy new year, I am a student from China, I already have two vps, but I haven't used alpine yet, so I want to try it, I will run a web service on it or telegram bot or something

    Hi @g121!

    Could you please post your ed25519 public key?

    May I please ask whether you are a high school student or a university student? Are you studying or do you want to study computer engineering?

    Best wishes!

    Tom

    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIATk14TvQ1rBHNPAIvStuSK6OsHQKn8gXxkYa890+4TP

    I am a university student. In fact, I am not learning computer related, but I am very interested in the computer. We learned C. Now I want to learn Python during the holidays

  • @Encoders said:
    I'm interested, can i use this for building APKs ?

    it will involve abuild and aports;
    https://wiki.alpinelinux.org/wiki/Include:Abuild
    https://wiki.alpinelinux.org/wiki/Aports_tree

    Maybe. But also maybe you are posting in the way you described yourself on your LES profile?

    About Me: 27/4 sh*tposting for teh lulz

    Best wishes! :)

  • @g121 said:

    @Not_Oles said:

    @g121 said:

    @Not_Oles said:

    @g121 said:
    I would like to have one thx

    Hi @g121!

    Best wishes for a Happy New Year!

    Since you are new here at LES we can say that your being new helps us celebrate the new in the New Year. :)

    Do you want to share a little about who and where you are and what you want to do on the server?

    Thanks!

    Tom

    Thank you, I wish you a happy new year, I am a student from China, I already have two vps, but I haven't used alpine yet, so I want to try it, I will run a web service on it or telegram bot or something

    Hi @g121!

    Could you please post your ed25519 public key?

    May I please ask whether you are a high school student or a university student? Are you studying or do you want to study computer engineering?

    Best wishes!

    Tom

    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIATk14TvQ1rBHNPAIvStuSK6OsHQKn8gXxkYa890+4TP

    I am a university student. In fact, I am not learning computer related, but I am very interested in the computer. We learned C. Now I want to learn Python during the holidays

    Hi @g121!

    Hope you have fun learning Python! Hope your new account can help you learn!

    You should be able to get in via IPv4 or IPv6 with your ssh key using something like:

    ssh [email protected] -p 42365

    Your account password is in a file in your home directory. Please change your password.

    Please let us know if you can login okay!

    I am looking forward to seeing your post here in this thread about fun stuff you accomplish on the server. Congrats in advance!

    Best!

    Tom

  • @Not_Oles said:

    @Encoders said:
    I'm interested, can i use this for building APKs ?

    it will involve abuild and aports;
    https://wiki.alpinelinux.org/wiki/Include:Abuild
    https://wiki.alpinelinux.org/wiki/Aports_tree

    Maybe. But also maybe you are posting in the way you described yourself on your LES profile?

    unfortunately, yes

    Fuck this 24/7 internet spew of trivia and celebrity bullshit.

  • FritzFritz Behlnd you

    @Not_Oles said:

    @subenhon said:

    @Not_Oles said: Anybody else want in on LXC? Thanks!

    I would like to try it.
    Count me in.Thanks!

    You are in! :)

    notoles:1000000000:65536
    localhost:1002000000:65536
    yoursunny:1018000000:65536
    subenhon:1022000000:65536
    

    May I jump in also @Not_Oles 😁

  • None of the subuid subgid settings are actually deployed :'(

    fmt:~$ cat /etc/subuid 
    root:100000:65536
    fmt:~$ cat /etc/subgid 
    root:100000:65536
    

    We accept Karma donations for the last flan. 🍮 affbrr

  • @Fritz said:

    @Not_Oles said:

    @subenhon said:

    @Not_Oles said: Anybody else want in on LXC? Thanks!

    I would like to try it.
    Count me in.Thanks!

    You are in! :)

    notoles:1000000000:65536
    localhost:1002000000:65536
    yoursunny:1018000000:65536
    subenhon:1022000000:65536
    

    May I jump in also @Not_Oles 😁

    Yep! Welcome again, @Fritz!

    notoles:1000000000:65536
    localhost:1002000000:65536
    Fritz:1005000000:65536
    yoursunny:1018000000:65536
    subenhon:1022000000:65536
    
  • @yoursunny said:
    None of the subuid subgid settings are actually deployed :'(

    fmt:~$ cat /etc/subuid 
    root:100000:65536
    fmt:~$ cat /etc/subgid 
    root:100000:65536
    

    Apologies @yoursunny! I am keeping the list locally. I haven't yet updated the subuid and subgid files on the server. I assumed I maybe could update the files on the server one time after the list seemed to be complete.

    Due to your constant and careful study of everything in all six directions, you caught my laziness.

    Guys, almost the last chance for this batch of LXC chicken. The next batch might be awhile. . . . Anybody else wanna jump on the LXC train?

    @yoursunny said: Address assignment is the next step: network bridge and lxc-usernet file.

    Just got a copy of the bridge setup I have been using elsewhere. 🔜 I hope. Thank you!

  • FritzFritz Behlnd you

    @Not_Oles said:

    @Fritz said:

    @Not_Oles said:

    @subenhon said:

    @Not_Oles said: Anybody else want in on LXC? Thanks!

    I would like to try it.
    Count me in.Thanks!

    You are in! :)

    notoles:1000000000:65536
    localhost:1002000000:65536
    yoursunny:1018000000:65536
    subenhon:1022000000:65536
    

    May I jump in also @Not_Oles 😁

    Yep! Welcome again, @Fritz!

    notoles:1000000000:65536
    localhost:1002000000:65536
    Fritz:1005000000:65536
    yoursunny:1018000000:65536
    subenhon:1022000000:65536
    

    Thanks Tom for letting me in. 😘

  • Been using metalvps as a build machine for the multiple VPSs running NixOS. Compiling software from source on this thing is fast!

    It usually take my own PC 20 minutes to finish compiling Zerotier (NixOS doesn't keep its binary on their repo for licensing reasons) but just couple minutes on metalvps!

    DM us for private tracker invite.

  • Not_OlesNot_Oles Provider
    edited January 2023

    Okay, here are the /etc/sub*id files.

    fmt:/etc# cat subgid
    root:100000:65536
    notoles:1000000000:65536
    localhost:1002000000:65536
    Fritz:1005000000:65536
    yoursunny:1018000000:65536
    subenhon:1022000000:65536
    fmt:/etc# cat subuid
    root:100000:65536
    notoles:1000000000:65536
    localhost:1002000000:65536
    Fritz:1005000000:65536
    yoursunny:1018000000:65536
    subenhon:1022000000:65536
    fmt:/etc# 
    

    @yoursunny said: Address assignment is the next step: network bridge and lxc-usernet file.

    ​👨‍💻​

  • @yoursunny said:

    @drunekndog said:
    Why not LXD? It's a lot more usable than plain LXC.

    Why not LXC?
    It's a lot more efficient than fancy LXD.

    I don't buy this; it seems a lot like complaints about ipv6 using more resources than ipv4: it may exist in theory, but it's unlikely to make a big impact in practice.

    An important technical limitation of LXD is the lack of isolation between host machine users authorized to create containers.

    From LXD installation:

    Access control for LXD is based on group membership.
    The root user and all members of the lxd group can interact with the local daemon.

    Anyone with access to the LXD socket can fully control LXD, which includes the ability to attach host devices and file systems.

    In contrast, LXC doesn't have a local daemon.
    Each user can launch their own unprivileged containers, without being able to access other users' containers.

    Ooh, completely missed this. Thanks for the info!

  • Today's updates; add bridge-utils-doc

    fmt:~# which brctl
    /usr/sbin/brctl
    fmt:~# man brctl
    man: No entry for brctl in the manual.
    fmt:~# apk update
    fetch http://mirror.fcix.net/alpine/edge/main/x86_64/APKINDEX.tar.gz
    fetch http://mirror.fcix.net/alpine/edge/community/x86_64/APKINDEX.tar.gz
    fetch http://mirror.fcix.net/alpine/edge/testing/x86_64/APKINDEX.tar.gz
    v3.17.0-2709-g997896f6cd [http://mirror.fcix.net/alpine/edge/main]
    v3.17.0-2722-gc84305397f [http://mirror.fcix.net/alpine/edge/community]
    v3.17.0-2718-g6580083d27 [http://mirror.fcix.net/alpine/edge/testing]
    OK: 24082 distinct packages available
    fmt:~# apk upgrade
    (1/15) Upgrading ncurses-terminfo-base (6.3_p20221224-r0 -> 6.4_p20221231-r0)
    (2/15) Upgrading ncurses-libs (6.3_p20221224-r0 -> 6.4_p20221231-r0)
    (3/15) Upgrading xz-libs (5.4.0-r0 -> 5.4.0-r1)
    (4/15) Upgrading libpcap (1.10.1-r1 -> 1.10.2-r0)
    (5/15) Upgrading libpcap-doc (1.10.1-r1 -> 1.10.2-r0)
    (6/15) Upgrading linux-firmware-isci (20221214-r0 -> 20221214-r1)
    (7/15) Upgrading zstd-libs (1.5.2-r9 -> 1.5.2-r10)
    (8/15) Upgrading linux-lts (6.1.1-r1 -> 6.1.2-r0)
    (9/15) Upgrading linux-lts-doc (6.1.1-r1 -> 6.1.2-r0)
    (10/15) Upgrading xxd (9.0.1093-r0 -> 9.0.1128-r0)
    (11/15) Upgrading vim (9.0.1093-r0 -> 9.0.1128-r0)
    (12/15) Upgrading vim-doc (9.0.1107-r0 -> 9.0.1128-r0)
    (13/15) Upgrading libx11 (1.8.2-r1 -> 1.8.2-r2)
    (14/15) Upgrading xz (5.4.0-r0 -> 5.4.0-r1)
    (15/15) Upgrading xz-doc (5.4.0-r0 -> 5.4.0-r1)
    Executing busybox-1.35.0-r29.trigger
    Executing kmod-30-r1.trigger
    Executing mkinitfs-3.7.0-r0.trigger
    ==> initramfs: creating /boot/initramfs-lts
    Executing mandoc-apropos-1.14.6-r6.trigger
    Executing syslinux-6.04_pre1-r11.trigger
    /boot is device /dev/sdc1
    OK: 1423 MiB in 337 packages
    fmt:~# fmt:~# apk info brctl-doc
    fmt:~# apk info brctl
    fmt:~# apk search brctl
    bridge-utils-1.7.1-r1
    fmt:~# apk info bridge-utils-doc
    bridge-utils-doc-1.7.1-r1 description:
    Tools for configuring the Linux kernel 802.1d Ethernet Bridge (documentation)
    
    bridge-utils-doc-1.7.1-r1 webpage:
    https://wiki.linuxfoundation.org/networking/bridge/
    
    bridge-utils-doc-1.7.1-r1 installed size:
    24 KiB
    
    fmt:~# apk add bridge-utils-doc
    (1/1) Installing bridge-utils-doc (1.7.1-r1)
    Executing mandoc-apropos-1.14.6-r6.trigger
    OK: 1423 MiB in 338 packages
    fmt:~# 
    
  • New /etc/network/interfaces ?

    Currently installed:

    fmt:~# cat /etc/network/interfaces
    auto lo
    iface lo inet loopback
    
    auto eth1
    iface eth1 inet static
            address 23.134.88.226
            netmask 255.255.255.240
            gateway 23.134.88.225
    
    iface eth1 inet6 static
            address 2602:fba1:999::2
            netmask 48
            gateway 2602:fba1:999::1
    fmt:~# 
    

    Is it too crazy just to give each container its own static WAN IPv4 and IPv6/64 ?

    Does the following look right for a first pass at the new /etc/network/interfaces?

    chronos@penguin:~$ cat interfaces-fmt-alpine-new
    auto lo
    iface lo inet loopback
    
    auto lxcbr0
    iface lxcbr0 inet static
      address 23.134.88.226
      netmask 255.255.255.240
      gateway 23.134.88.225
      bridge-ports eth1
      bridge-stp off
      bridge-fd 0
      pre-up brctl addbr vmbr0
        post-up ip route add 23.134.88.225/28  dev lxcbr0
        pre-down ip route del 23.134.88.225/28 dev lxcbr0
    
    iface lxcbr0 inet6 static
      address 2602:fba1:999::2
      netmask 48
      gateway 2602:fba1:999::1
    chronos@penguin:~$ 
    

    Next up: lxc-usernet file, maybe tomorrow, it's getting late here:

    fmt:~# man lxc-usernet # Works!
    fmt:~# cat /etc/lxc/lxc-usernet
    cat: can't open '/etc/lxc/lxc-usernet': No such file or directory
    fmt:~# 
    
  • @Not_Oles said:
    Is it too crazy just to give each container its own static WAN IPv4 and IPv6/64 ?

    I'd rather use NAT'ed IPv4, so that more containers can be accommodated.

    auto lxcbr0
    iface lxcbr0 inet static
      bridge-ports eth1
    

    Bridging containers directly on the physical port may result in the containers' MAC addresses becoming visible on the physical network.
    I don't know about Cloudie, but doing this in KVM would get filtered in Virtualizor, and doing this on Hetzner would trigger infraction warning letter.

    We accept Karma donations for the last flan. 🍮 affbrr

  • All working&gt; @Not_Oles said:

    @g121 said:

    @Not_Oles said:

    @g121 said:

    @Not_Oles said:

    @g121 said:
    I would like to have one thx

    Hi @g121!

    Best wishes for a Happy New Year!

    Since you are new here at LES we can say that your being new helps us celebrate the new in the New Year. :)

    Do you want to share a little about who and where you are and what you want to do on the server?

    Thanks!

    Tom

    Thank you, I wish you a happy new year, I am a student from China, I already have two vps, but I haven't used alpine yet, so I want to try it, I will run a web service on it or telegram bot or something

    Hi @g121!

    Could you please post your ed25519 public key?

    May I please ask whether you are a high school student or a university student? Are you studying or do you want to study computer engineering?

    Best wishes!

    Tom

    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIATk14TvQ1rBHNPAIvStuSK6OsHQKn8gXxkYa890+4TP

    I am a university student. In fact, I am not learning computer related, but I am very interested in the computer. We learned C. Now I want to learn Python during the holidays

    Hi @g121!

    Hope you have fun learning Python! Hope your new account can help you learn!

    You should be able to get in via IPv4 or IPv6 with your ssh key using something like:

    ssh [email protected] -p 42365

    Your account password is in a file in your home directory. Please change your password.

    Please let us know if you can login okay!

    I am looking forward to seeing your post here in this thread about fun stuff you accomplish on the server. Congrats in advance!

    Best!

    Tom

    All working ,thank you for everything you do

  • hey ,
    What are The Requirements to get this :-P

  • @raveen2k3 said:
    hey ,
    What are The Requirements to get this :-P

    hey ,
    Congrats on your First Post

    "A single swap file or partition may be up to 128 MB in size. [...] [I]f you need 256 MB of swap, you can create two 128-MB swap partitions." (M. Welsh & L. Kaufman, Running Linux, 2e, 1996, p. 49)

  • @raveen2k3 said:
    hey ,
    What are The Requirements to get this :-P

    Just tell @Not_Oles how great he is so he can add the quote to his wall of self-gratification.

  • Hi @yoursunny!

    Thanks for your helpful, relevant, and interesting comments!

    @yoursunny said: I'd rather use NAT'ed IPv4, so that more containers can be accommodated.

    May I please ask, how many containers do you think we should accommodate?

    @yoursunny said: Bridging containers directly on the physical port may result in the containers' MAC addresses becoming visible on the physical network.
    I don't know about Cloudie, but doing this in KVM would get filtered in Virtualizor, and doing this on Hetzner would trigger infraction warning letter.

    What we previously did at Hetzner was assign VMs an IPv4/32. If I understand correctly, having the VMs use link layer prevented the issue of the VM MAC addresses becoming visible. A difference between what formerly was at Hetzner and what is happening now at Cloudie was that, at Hetzner, the extra IPs were out of band relative to the server's main IPv4. The /etc/network/interfaces file formerly in use at Hetzner looked something like that shown below.

    May I please ask, assuming for the purpose of the question that we stick to assigning VMs individual IPv4s and do not do NAT, would assigning IPv4/32s to the VMs mitigate the MAC address leak without having the extra IPs out of band with respect to the main IP? If no, could adding an additional main IPv4 and gateway from Cloudie plus using link layer solve the MAC address leak problem as it apparently did at Hetzner?

    May I please ask what do others think about whether we should do NAT or assign individual IPs? And, how many containers do others think we should have?

    root@fsn1 ~ # cat /etc/network/interfaces
    ### Hetzner Online GmbH installimage
    
    source /etc/network/interfaces.d/*
    
    auto lo
    iface lo inet loopback
    iface lo inet6 loopback
    
    auto enp7s0
    iface enp7s0 inet static
      address 157.90.35.101
      netmask 255.255.255.255
      gateway 157.90.35.65
      pointopoint 157.90.35.65
        post-up echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up echo 0 > /proc/sys/net/ipv4/conf/enp7s0/send_redirects
    
    iface enp7s0 inet6 static
      address 2a01:4f8:251:595a::2
      netmask 128
      gateway fe80::1
        post-up echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
    
    auto vmbr0
    iface vmbr0 inet static
      address 157.90.35.101
      netmask 255.255.255.255
      bridge_ports none
      bridge_stp off
      bridge_fd 0
      bridge_maxwait 0  pre-up brctl addbr vmbr0
        post-up ip route add 148.251.166.96/32 dev vmbr0
        pre-down ip route del 148.251.166.96/32 dev vmbr0
        post-up ip route add 148.251.166.97/32 dev vmbr0
        pre-down ip route del 148.251.166.97/32 dev vmbr0
        [ . . . ]
        post-up ip route add 148.251.166.111/32 dev vmbr0
        pre-down ip route del 148.251.166.111/32 dev vmbr0
    
    iface vmbr0 inet6 static
      address 2a01:4f8:251:595a::2
      netmask 64
    root@fsn1 ~ #  
    
  • edited January 2023

    @Not_Oles said:

    @yoursunny said: I'd rather use NAT'ed IPv4, so that more containers can be accommodated.

    May I please ask, how many containers do you think we should accommodate?

    Typically, I create one LXC container for each app or use case.
    In my closet server, there are separate containers for C++ development and Go development, plus one for push-up video encoding (ffmpeg with iGPU access).

    MetalVPS-fmt has dozens of accounts.
    You would eventually run out of dedicated IPv4 if everyone wants an IPv4.
    Thus, NAT is unavoidable.

    would assigning IPv4/32s to the VMs mitigate the MAC address leak

    In my closet server, I just let the MAC addresses leak, and the home router gives each container its own IPs.
    Datacenter switches might not like this.

    In my KVM servers, the bridge for LXC containers has NAT'ed IPv4 and routed IPv6.
    It's defined in Netplan.io like this:

    network:
      bridges:
        brlink:
          interfaces: []
          mtu: 1448
          dhcp4: false
          dhcp6: false
          link-local: []
          addresses:
            - 172.25.0.0/32
            - 2001:db8:0:8d::1b9:b/128
    

    There's also a systemd service that sets static binding of container IP ranges (each container gets IPv4 /24 and IPv6 /116) and MAC addresses.

    I don't know what to do in interfaces file, as it's no longer preferred for Ubuntu.

    We accept Karma donations for the last flan. 🍮 affbrr

  • @raveen2k3 said:
    hey ,
    What are The Requirements to get this :-P

    Hi @raveen2k3!

    I see from your profile that you are new here. Welcome to LES! It is great to meet you!

    Want to introduce yourself? I'm sure everyone would be interested to know your name, where you are from, and something about your Linux experience. Also, what do you want to do on the server?

    I'm looking forward to hearing more from you!

    Best wishes and kindest regards,

    Tom

  • I don't know whether this is at all correct, but here, quoting from above, I fixed a couple of little mistakes. The changed lines are followed by comments.

    chronos@penguin:~$ cat interfaces-fmt-alpine-new
    auto lo
    iface lo inet loopback
    
    auto lxcbr0
    iface lxcbr0 inet static
      address 23.134.88.226
      netmask 255.255.255.240
      gateway 23.134.88.225
      bridge-ports eth1
      bridge-stp off
      bridge-fd 0
      pre-up brctl addbr lxcbr0 # Changed vmbr0 to lxcbr0
        post-up ip route add 23.134.88.224/28  dev lxcbr0  # Changed 225 to 224
        pre-down ip route del 23.134.88.225/28 dev lxcbr0
    
    iface lxcbr0 inet6 static
      address 2602:fba1:999::2
      netmask 48
      gateway 2602:fba1:999::1
    chronos@penguin:~$ 
    
  • @Not_Oles said: Next up: lxc-usernet file, maybe tomorrow, it's getting late here:

    fmt:~# man lxc-usernet # Works!
    fmt:~# cat /etc/lxc/lxc-usernet
    cat: can't open '/etc/lxc/lxc-usernet': No such file or directory
    fmt:~# 
    

    Okay, it's tomorrow already! :)

    From man lxc-usernet(5):

    This file consists of multiple entries, one per line, of the form:

      user type bridge number
    

    So here's lxc-usernet:

    fmt:~# ls /etc/lxc
    default.conf
    fmt:~# touch /etc/lxc/lxc-usernet # The busybox version of ed editor can edit existing files but seemingly can't create files!
    fmt:~# cat /etc/subuid 
    root:100000:65536
    notoles:1000000000:65536
    localhost:1002000000:65536
    Fritz:1005000000:65536
    yoursunny:1018000000:65536
    subenhon:1022000000:65536
    fmt:~# ed /etc/lxc/lxc-usernet # ed editor allows me to see what was printed in the terminal just before I started editing.
    0
    a
    notoles veth lxcbr0 1 # I am guessing that root doesn't need an entry in the lxc-usernet file, but I am not sure. 
    localhost veth lxcbr0 1
    Fritz veth lxcbr0 1
    yoursunny veth lxcbr0 1
    subenhon veth lxcbr0 1
    .
    w
    113
    q
    fmt:~# 
    

    LXC still is not expected to work yet partly because lxcbr0 isn't present because /etc/network/interfaces hasn't been updated yet. There is no bridge in the current setup. I sent the possible new interfaces configuration to Cloudie, so we will see what he says.

    Best wishes and kindest regards! :)

  • @Not_Oles said:
    Next up: lxc-usernet file

    notoles veth lxcbr0 1
    localhost veth lxcbr0 1
    Fritz veth lxcbr0 1
    yoursunny veth lxcbr0 1
    subenhon veth lxcbr0 1
    

    Need larger numbers, e.g. 16.

    I am guessing that root doesn't need an entry in the lxc-usernet file, but I am not sure.

    root account shouldn't be used except for modifying system settings.

    We accept Karma donations for the last flan. 🍮 affbrr

  • @yoursunny said: Need larger numbers, e.g. 16.

    Hi @yoursunny! Thanks for letting me know your preference! :) Would it be okay with you to leave the lxc-usernet number at 1 until we hopefully find that everyone can make a container that works? Then we could increase the number. However, if you or anyone else needs a larger number from the beginning, please just let me know, and I will increase the number.

  • Tshark and friends

    fmt:~# apk search tshark
    tshark-4.0.2-r0
    fmt:~# apk search tshark-doc
    fmt:~# apk search termshark
    termshark-2.4.0-r6
    fmt:~# apk search termshark-doc
    fmt:~# apk -U add tshark termshark
    fetch http://mirror.fcix.net/alpine/edge/main/x86_64/APKINDEX.tar.gz
    fetch http://mirror.fcix.net/alpine/edge/community/x86_64/APKINDEX.tar.gz
    fetch http://mirror.fcix.net/alpine/edge/testing/x86_64/APKINDEX.tar.gz
    (1/15) Installing libmount (2.38.1-r2)
    (2/15) Installing glib (2.74.4-r0)
    (3/15) Installing c-ares (1.18.1-r1)
    (4/15) Installing krb5-conf (1.0-r2)
    (5/15) Installing keyutils-libs (1.6.3-r1)
    (6/15) Installing libverto (0.3.2-r1)
    (7/15) Installing krb5-libs (1.20.1-r0)
    (8/15) Installing lua5.2-libs (5.2.4-r11)
    (9/15) Installing libmaxminddb-libs (1.7.1-r0)
    (10/15) Installing libnl3 (3.7.0-r0)
    (11/15) Installing libssh (0.10.4-r0)
    (12/15) Installing libxml2 (2.10.3-r2)
    (13/15) Installing wireshark-common (4.0.2-r0)
    Executing wireshark-common-4.0.2-r0.pre-install
    Executing wireshark-common-4.0.2-r0.post-install
    *
    * If you want to run wireshark as an unprivileged user
    * then you must add that user to the group "wireshark".
    *
    (14/15) Installing tshark (4.0.2-r0)
    (15/15) Installing termshark (2.4.0-r6)
    Executing busybox-1.35.0-r29.trigger
    OK: 1566 MiB in 353 packages
    fmt:~#
    
  • @angstrom said:

    @raveen2k3 said:
    hey ,
    What are The Requirements to get this :-P

    hey ,
    Congrats on your First Post

    Thanks ;-)

  • @Not_Oles said:

    @raveen2k3 said:
    hey ,
    What are The Requirements to get this :-P

    Hi @raveen2k3!

    I see from your profile that you are new here. Welcome to LES! It is great to meet you!

    Want to introduce yourself? I'm sure everyone would be interested to know your name, where you are from, and something about your Linux experience. Also, what do you want to do on the server?

    I'm looking forward to hearing more from you!

    Best wishes and kindest regards,

    Tom

    Hi

    Actually I'm new to this forum kind of stuffs , More like this is first forum I've joined .

    And I'm Actually from India,
    I've been Using a Debian 11 for nearly a year , I'm new to linux community though

    I've been looking for a free server to host some of python projects , most likely telegram and Discord Bots That I've made ,

    Also I've never used any other distro than debian, i would love to explore a new distro :-)

Sign In or Register to comment.