OK, this will still be kinda brief, but hopefully helps get you going with LXC containers (via LXD) quickly in a way that’s actually useful.
I have typically used things like Digital Ocean and AWS to quickly launch a testbed, deploy some modified packages and, check the changes and then tear it all down quickly. This works well for me but I’ve recently been trying to break my dependence on foreign services for this work. So I’ve been using LXD more and more which is just as fast, and is local so I can do this sort of work without an internet connection if need be. Below, I’ll outline a few very quick things to make using containers a bit more easy. Note, all of the info below assumes you are using Ubuntu 16.04 LTS or later, with LXD installed (LXD is installed by default on 16.04 and newer). Also, you should have at least some familiarity with lxc and lxd. For more information on those, see https://linuxcontainers.org/lxc/introduction/.
Tip 1: import images locally with useful aliases.
By default, when you launch a container, the image will be pulled from the internet if it does not already exist. Also, if you want to use that container base again locally, you sometimes need to find an ugly fingerprint ID to reference it with. I’ve prefer to locally import the images I want. Not only does this let me create my own, easily remembered names for this, I can pull a variety of images from various sources and have my own local, off-line catalog of LXD images to create containers from.
First, see what images are available. Since I do all my work on ubuntu, I only need to check the default ubuntu remote. This is done with the ‘image’ command for lxc:
bladernr@galactica:~$ lxc image list ubuntu: +--------------------+--------------+--------+-------------------------------------------------+---------+----------+-------------------------------+ | ALIAS | FINGERPRINT | PUBLIC | DESCRIPTION | ARCH | SIZE | UPLOAD DATE | +--------------------+--------------+--------+-------------------------------------------------+---------+----------+-------------------------------+ | p (5 more) | 4c1e4092ead8 | yes | ubuntu 12.04 LTS amd64 (release) (20170417) | x86_64 | 156.78MB | Apr 17, 2017 at 12:00am (UTC) | +--------------------+--------------+--------+-------------------------------------------------+---------+----------+-------------------------------+ | p/armhf (2 more) | 68a83fae9fd3 | yes | ubuntu 12.04 LTS armhf (release) (20170417) | armv7l | 135.58MB | Apr 17, 2017 at 12:00am (UTC) | +--------------------+--------------+--------+-------------------------------------------------+---------+----------+-------------------------------+ | p/i386 (2 more) | 056784ac045d | yes | ubuntu 12.04 LTS i386 (release) (20170417) | i686 | 141.27MB | Apr 17, 2017 at 12:00am (UTC) | +--------------------+--------------+--------+-------------------------------------------------+---------+----------+-------------------------------+ | t (5 more) | 536ea2799fc7 | yes | ubuntu 14.04 LTS amd64 (release) (20170405) | x86_64 | 119.89MB | Apr 5, 2017 at 12:00am (UTC) | +--------------------+--------------+--------+-------------------------------------------------+---------+----------+-------------------------------+ | t/arm64 (2 more) | 26b9b1fb1b15 | yes | ubuntu 14.04 LTS arm64 (release) (20170405) | aarch64 | 110.96MB | Apr 5, 2017 at 12:00am (UTC) | +--------------------+--------------+--------+-------------------------------------------------+---------+----------+-------------------------------+ | t/armhf (2 more) | 5e367a0ad31c | yes | ubuntu 14.04 LTS armhf (release) (20170405) | armv7l | 111.58MB | Apr 5, 2017 at 12:00am (UTC) | +--------------------+--------------+--------+-----------------------------lets--------------------+---------+----------+-------------------------------+ | t/i386 (2 more) | 38df07c91eac | yes | ubuntu 14.04 LTS i386 (release) (20170405) | i686 | 118.24MB | Apr 5, 2017 at 12:00am (UTC) | +--------------------+--------------+--------+-------------------------------------------------+---------+----------+-------------------------------+
There are a LOT of images available so I’ve trimmed the output significantly. I’m mostly interested in Trusty for now, which has the alias ‘t’, so let’s import that image locally using the ‘copy’ subcommand of the ‘image’ lxc command:
bladernr@galactica:~$ lxc image copy ubuntu:t local: --alias=ubuntu-trusty Image copied successfully! bladernr@galactica:~$ lxc image list +---------------+--------------+--------+---------------------------------------------+--------+----------+-------------------------------+ | ALIAS | FINGERPRINT | PUBLIC | DESCRIPTION | ARCH | SIZE | UPLOAD DATE | +---------------+--------------+--------+---------------------------------------------+--------+----------+-------------------------------+ | ubuntu-trusty | 536ea2799fc7 | no | ubuntu 14.04 LTS amd64 (release) (20170405) | x86_64 | 119.89MB | Apr 24, 2017 at 10:58pm (UTC) | +---------------+--------------+--------+---------------------------------------------+--------+----------+-------------------------------+ | ubuntu-xenial | f452cda3bccb | no | ubuntu 16.04 LTS amd64 (release) (20160627) | x86_64 | 310.30MB | Jul 15, 2016 at 5:55pm (UTC) | +---------------+--------------+--------+---------------------------------------------+--------+----------+-------------------------------+lets
What this does is download a copy of the arch appropriate trusty container image hosted on the default Ubuntu image store and make it available locally on my desktop. As you can see, I have both Trusty and Xenial images, with nice aliases that can be easily remembered later on when deploying containers.
I have the release versions of the images, that’s all I need. Because I’m just prototyping and testing locally, I don’t really worry too much about the latest package updates being installed on my containers.
Ubuntu has two different remotes (streams) to get images from:
bladernr@galactica:~$ lxc image list ubuntu: |head -10 +--------------------+--------------+--------+-------------------------------------------------+---------+----------+-------------------------------+ | ALIAS | FINGERPRINT | PUBLIC | DESCRIPTION | ARCH | SIZE | UPLOAD DATE | +--------------------+--------------+--------+-------------------------------------------------+---------+----------+-------------------------------+ | p (5 more) | 4c1e4092ead8 | yes | ubuntu 12.04 LTS amd64 (release) (20170417) | x86_64 | 156.78MB | Apr 17, 2017 at 12:00am (UTC) | +--------------------+--------------+--------+-------------------------------------------------+---------+----------+-------------------------------+ | p/armhf (2 more) | 68a83fae9fd3 | yes | ubuntu 12.04 LTS armhf (release) (20170417) | armv7l | 135.58MB | Apr 17, 2017 at 12:00am (UTC) | +--------------------+--------------+--------+-------------------------------------------------+---------+----------+-------------------------------+ | p/i386 (2 more) | 056784ac045d | yes | ubuntu 12.04 LTS i386 (release) (20170417) | i686 | 141.27MB | Apr 17, 2017 at 12:00am (UTC) | +--------------------+--------------+--------+-------------------------------------------------+---------+----------+-------------------------------+ | t (5 more) | 9e0493502f9d | yes | ubuntu 14.04 LTS amd64 (release) (20170424) | x86_64 | 120.03MB | Apr 24, 2017 at 12:00am (UTC) | bladernr@galactica:~$ lxc image list ubuntu-daily: |head -10 +--------------------+--------------+--------+-----------------------------------------------+---------+----------+-------------------------------+ | ALIAS | FINGERPRINT | PUBLIC | DESCRIPTION | ARCH | SIZE | UPLOAD DATE | +--------------------+--------------+--------+-----------------------------------------------+---------+----------+-------------------------------+ | p (5 more) | 12bb0982a94b | yes | ubuntu 12.04 LTS amd64 (daily) (20170424) | x86_64 | 155.64MB | Apr 24, 2017 at 12:00am (UTC) | +--------------------+--------------+--------+-----------------------------------------------+---------+----------+-------------------------------+ | p/armhf (2 more) | d95c2d1be3f8 | yes | ubuntu 12.04 LTS armhf (daily) (20170424) | armv7l | 136.64MB | Apr 24, 2017 at 12:00am (UTC) | +--------------------+--------------+--------+-----------------------------------------------+---------+----------+-------------------------------+ | p/i386 (2 more) | 4f516ec69c8f | yes | ubuntu 12.04 LTS i386 (daily) (20170424) | i686 | 139.71MB | Apr 24, 2017 at 12:00am (UTC) | +--------------------+--------------+--------+-----------------------------------------------+---------+----------+-------------------------------+ | t (5 more) | 9e0493502f9d | yes | ubuntu 14.04 LTS amd64 (daily) (20170424) | x86_64 | 120.03MB | Apr 24, 2017 at 12:00am (UTC) |
The first of those contains only the “release” versions of the Ubuntu images. That is, the versions that appear on each GA Release Day, or LTS Point Release Day. The second, ubuntu-daily, provides images from the daily builds of Ubuntu, which are updated far more frequently. This also gives you access to daily builds of the latest development / interim release such as the soon to be opened Ubuntu 17.10.
Tip 2: Configuring a user for easy login and actually getting work done.
The default Ubuntu images are missing two very important things, ssh keys and a default password for the ‘ubuntu’ user. There are a few different ways to tackle this. If a root access is all you need, then this will suffice:
bladernr@galactica:~$ lxc exec subtle-marlin /bin/bash root@subtle-marlin:~#
This will get you a root login, but I often need to have a non-privileged login. So the first thing we need to configure the user. This is accomplished using cloud-init and can be set using the profiles for lxc. Specifically, I’m setting this in the default profile. To access/edit this profile, as of lxc version 2.0.7-0ubuntu1~16.04.2, you need to use the lxc profile command to edit the default profile and add a few things.
To edit it use the command lxd profile edit <name> (Note, this command may be different on other versions of lxc, such as lxc edit profile <name>.
bladernr@galactica:~$ lxc profile list default docker juju-controller juju-default
Note that there are several profiles already created by default. We’re only interested in the ‘default‘ profile, so let’s edit that:
### This is a yaml representation of the profile.
### Any line starting with a '# will be ignored.
###
### A profile consists of a set of configuration items followed by a set of
### devices.
###
### An example would look like:
### name: onenic
### config:
### raw.lxc: lxc.aa_profile=unconfined
### devices:
### eth0:
### nictype: bridged
### parent: lxdbr0
### type: nic
###
### Note that the name is shown but cannot be changed
config:
user.vendor-data: |
#cloud-config
users:
- name: ubuntu
ssh-import-id: bladernr
lock_passwd: false
sudo: ALL=(ALL) NOPASSWD:ALL
shell: /bin/bash
description: ""
devices:
eth0:
name: eth0
nictype: bridged
parent: lxdbr0
type: nic
name: default
In that example, I have added modified the user.vendor-data section to set a few items for the “ubuntu” user. First, I used ssh-import-id to import my own ssh keys. I believe this pulls from launchpad, but it may pull locally. I’m honestly not sure which. Next, I set lock_passwd to ‘false’. letsIf you leave this unset, it defaults to ‘true’ which will prevent password logins. Of course, the ssh logins via key are MUCH more secure, but as I mentioned before, these are very short lived development instances, so security is of no concern to me, as proven in the next line.
On this next line, I tell cloud-init to setup sudo privileges for the ‘ubuntu’ user so that no password is required when performing ANY task via sudo. That is about as close as you can get to using the root user instead. It is VERY dangerous because anyone who gains access to ‘ubuntu’ now has full, unfettered root access. So don’t do this at home. Again, for my use, these are short lived test and dev instances where security is not important. I would NEVER do this on anthing that is even close to production level.
In fact, on a production system you should probably consider leaving only the ssh-import-id set to only allow logins via ssh and key-based authentication. You should definitely NOT set sudo as I have done here, also.
Finally, I set the shell to /bin/bash so when I ssh in, I’ll have a nice bash shell.
There are other items you can set in here, such as password, ssh authorized_keys, group membership and so on. You can find out more about cloud config in the cloudinit documentation.
Conclusion
So there you go. Those two tips should help setting up LXC/LXD to be much easier and less hassle when launching instances for testing your code, prototyping and other needs. Please do remember that I do some fairly ugly things (security wise) and you should make better choices there for production.
Once you have those things configured, you should be able to quickly launch instances and connect to them via SSH and be able to perform whatever tasks you need.
bladernr@galactica:~$ lxc list +---------------+---------+----------------------+------+------------+-----------+ | NAME | STATE | IPV4 | IPV6 | TYPE | SNAPSHOTS | +---------------+---------+----------------------+------+------------+-----------+ | subtle-marlin | RUNNING | 10.148.80.232 (eth0) | | PERSISTENT | 0 | +---------------+---------+----------------------+------+------------+-----------+ bladernr@galactica:~$ lxc launch ubuntu-trusty demo Creating demo Starting demo bladernr@galactica:~$ lxc list +---------------+---------+----------------------+------+------------+-----------+ | NAME | STATE | IPV4 | IPV6 | TYPE | SNAPSHOTS | +---------------+---------+----------------------+------+------------+-----------+ | demo | RUNNING | 10.148.80.217 (eth0) | | PERSISTENT | 0 | +---------------+---------+----------------------+------+------------+-----------+ | subtle-marlin | RUNNING | 10.148.80.232 (eth0) | | PERSISTENT | 0 | +---------------+---------+----------------------+------+------------+-----------+ bladernr@galactica:~$ ssh ubuntu@10.148.80.217 The authenticity of host '10.148.80.217 (10.148.80.217)' can't be established. ECDSA key fingerprint is SHA256:gyn682YAhs+LyZc7i0s9akfBoZCOnSYErMeds4MbaKI. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '10.148.80.217' (ECDSA) to the list of known hosts. Welcome to Ubuntu 14.04.5 LTS (GNU/Linux 4.4.0-70-generic x86_64) * Documentation: https://help.ubuntu.com/ System information as of Tue Apr 25 13:30:23 UTC 2017 System load: 0.77 Memory usage: 0% Processes: 15 Usage of /home: unknown Swap usage: 47% Users logged in: 0 Graph this data and manage this system at: https://landscape.canonical.com/ Get cloud support with Ubuntu Advantage Cloud Guest: http://www.ubuntu.com/business/services/cloud 0 packages can be updated. 0 updates are security updates. The programs included with the Ubuntu system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. ubuntu@demo:~$
