pct: improve container documentation

[pve-docs.git] / pct.adoc

ifdef::manvolnum[]
PVE({manvolnum})
================
include::attributes.txt[]

NAME
----

pct - Tool to manage Linux Containers (LXC) on Proxmox VE


SYNOPSYS
--------

include::pct.1-synopsis.adoc[]

DESCRIPTION
-----------
endif::manvolnum[]

ifndef::manvolnum[]
Proxmox Container Toolkit
=========================
include::attributes.txt[]
endif::manvolnum[]


Containers are a lightweight alternative to fully virtualized
VMs. Instead of emulating a complete Operating System (OS), containers
simply use the OS of the host they run on. This implies that all
containers use the same kernel, and that they can access resources
from the host directly.

This is great because containers do not waste CPU power nor memory due
to kernel emulation. Container run-time costs are close to zero and
usually negligible. But there are also some drawbacks you need to
consider:

* You can only run Linux based OS inside containers, i.e. it is not
  possible to run Free BSD or MS Windows inside.

* For security reasons, access to host resources need to be
  restricted. This is done with AppArmor, SecComp filters and other
  kernel feature. Be prepared that some syscalls are not allowed
  inside containers.

{pve} uses https://linuxcontainers.org/[LXC] as underlying container
technology. We consider LXC as low-level library, which provides
countless options. It would be to difficult to use those tools
directly. Instead, we provide a small wrapper called `pct`, the
"Proxmox Container Toolkit".

The toolkit it tightly coupled with {pve}. That means that it is aware
of the cluster setup, and it can use the same network and storage
resources as fully virtualized VMs. You can even use the {pve}
firewall, or manage containers using the HA framework.

Our primary goal is to offer an environment as one would get from a
VM, but without the additional overhead. We call this "System
Containers".

NOTE: If you want to run micro-containers with docker, it is best to
run them inside a VM.


Security Considerations
-----------------------

Containers use the same kernel as the host, so there is a big attack
surface for malicious users. You should consider this fact if you
provide containers to totally untrusted people. In general, fully
virtualized VM provides better isolation.

The good news is that LXC uses many kernel security features like
AppArmor, CGroups and PID and user namespaces, which makes containers
usage quite secure. We distinguish two types of containers:

Privileged containers
~~~~~~~~~~~~~~~~~~~~~

Security is done by dropping capabilities, using mandatory access
control (AppArmor), SecComp filters and namespaces. The LXC team
considers this kind of container as unsafe, and they will not consider
new container escape exploits to be security issues worthy of a CVE
and quick fix. So you should use this kind of containers only inside a
trusted environment, or when no untrusted task is running as root in
the container.

Unprivileged containers
~~~~~~~~~~~~~~~~~~~~~~~

This kind of containers use a new kernel feature, called user
namespaces. The root uid 0 inside the container is mapped to an
unprivileged user outside the container. This means that most security
issues (container escape, resource abuse, ...) in those containers
will affect a random unprivileged user, and so would be a generic
kernel security bug rather than a LXC issue. LXC people think
unprivileged containers are safe by design.


Managing Containers with 'pct'
------------------------------

'pct' is a tool to manages Linux Containers (LXC). You can create and
destroy containers, and control execution
(start/stop/suspend/resume). Besides that, you can use pct to set
parameters in the associated config file, like network configuration
or memory.

CLI Usage Examples
------------------

Create a container based on a Debian template (provided you downloaded
the template via the webgui before)

 pct create 100 /var/lib/vz/template/cache/debian-8.0-standard_8.0-1_amd64.tar.gz

Start container 100

 pct start 100

Start a login session via getty

 pct console 100

Enter the LXC namespace and run a shell as root user

 pct enter 100

Display the configuration

 pct config 100

Add a network interface called eth0, bridged to the host bridge vmbr0,
set the address and gateway, while it's running

 pct set 100 -net0 name=eth0,bridge=vmbr0,ip=192.168.15.147/24,gw=192.168.15.1

Reduce the memory of the container to 512MB

 pct set -memory 512 100

Files
------

'/etc/pve/lxc/<vmid>.conf'::

Configuration file for the container <vmid>


Container Advantages
--------------------

- Simple, and fully integrated into {pve}. Setup looks similar to a normal
  VM setup. 

  * Storage (ZFS, LVM, NFS, Ceph, ...)

  * Network

  * Authentification

  * Cluster

- Fast: minimal overhead, as fast as bare metal

- High density (perfect for idle workloads)

- REST API

- Direct hardware access


Technology Overview
-------------------

- Integrated into {pve} graphical user interface (GUI)

- LXC (https://linuxcontainers.org/)

- cgmanager for cgroup management

- lxcfs to provive containerized /proc file system

- apparmor

- CRIU: for live migration (planned)

- We use latest available kernels (4.2.X)

- image based deployment (templates)

- Container setup from host (Network, DNS, Storage, ...)


ifdef::manvolnum[]
include::pve-copyright.adoc[]
endif::manvolnum[]