LXD is an initiative made by Canonical that aims to provide a better user experience to the LXC linux containers. It also adds some nifty features, like live migration of containers, remote admin, secure by default and more.

This guide is meant to be an introduction to LXD in order to setup a server in a container that can be moved between hosts. The setup can be done locally on a laptop and then deployed to the production environment when everything is setup. This guide describes the usage for LXD version 0.15.

Since LXD is currently in heavy development it isn’t available in Ubuntu < 15.04. If you are running an older system (not older than 14.04) we need to add the backport ppa:

Update: LXD 2.0 was released and then stable packages are available in trusty-backports.

$ sudo apt -t trusty-backports install lxd

This is the older way of installing lxd which may still work

$ sudo add-apt-repository ppa:ubuntu-lxc/lxd-stable
$ sudo apt-get update
$ sudo apt-get install lxd lxd-client

Get your group membership:

$ newgrp lxd

2.0 Update: In 2.0 you need to configure network for containers by running:

$ sudo dpkg-reconfigure -p medium lxd

Follow the wizard.

LXD is image based so we need to have some images to work with:

$ lxc remote add images images.linuxcontainers.org
$ lxc image list images:

This will add a new remote called images and list all the available images in that remote.

Then create a local copy of the desired image:

$ lxc image copy images:ubuntu/trusty/i386 local: --alias=trusty

This will copy a 32 bit ubuntu 14.04 image localy (local: target) and call it trusty.

Now we can list our local images:

$ lxc image list

Launch the container with the following command:

$ lxc launch trusty trusty-1
$ lxc list
+-----------+---------+------------+------+-----------+-----------+
|   NAME    |  STATE  |    IPV4    | IPV6 | EPHEMERAL | SNAPSHOTS |
+-----------+---------+------------+------+-----------+-----------+
| trusty-1  | RUNNING | 10.0.3.201 |      | NO        | 0         |
+-----------+---------+------------+------+-----------+-----------+

It is possible to skip downloading the image and launch a container from a remote image directly. The image will be cached on the local machine and will be removed when no new containers has been spawned from it for a while. Once a container is created, the image is no longer needed to run the container.

Containers can be started and stopped:

$ lxc stop trusty-1
$ lxc start trusty-1

To get a command prompt in the container:

$ lxc exec trusty-1 /bin/bash

Add user with sudo priveleges

# adduser me
# adduser me sudo

Inside the container install some software

# apt-get install openssh-server

Press Ctrl-D to get out of the container shell and ssh from host

$ ssh me@1.0.3.201

LXD provide an interface for uploading downloading files via the lxc file sub command. It’s a bit restricted and does not work on directories so I copy the files directly into the container file system instead. Or you can use scp, rsync or whatever you prefer. The container file system is located at /var/lib/lxd/containers/trusty-1/rootfs.

Setting up network services works the same as for an ordinary LXC container. I use port forwarding with iptables to redirect the wanted services to the container ip.

$ sudo iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 80 -j DNAT --to-destination 10.0.3.201:80
$ sudo iptables -A FORWARD -p tcp -d 10.0.3.201 --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

This will forward http traffic on eth0 to the container at 10.0.3.201 (trusty-1). Since PREROUTING does not work on the loopback device we need to add an OUTPUT rule to do some local testing:

$ sudo iptables -t nat -A OUTPUT -p tcp -o lo --dport 80 -j DNAT --to-destination 10.0.3.201:80

In order to make the rules persistent you need the iptables-persistent Ubuntu package. Then save the rules:

$ sudo bash -c 'iptables-save > /etc/iptables/rules.v4'

The host networking configuration obviously needs to be done on every host that the container will run on.

Since the container by default will live on separate network, accessing local samba servers on the LAN will not work. This can be solved in a number of ways:

1. Bridging the host network to share the IP address between the host and container instead of using the default configuration. This will make samba work as on the host.
2. Mount the samba share on the host and then give access to the host mount point to the container.

I chose option 2. This was actually a bit tricky to setup to get the appropriate permissions for the container but here we go:

Mount the samba share on the host. This would need something like the following in the /etc/fstab file:

//$IP_OF_SAMBA_SERVER/share /mnt/share cifs uid=root,gid=lxd_guest,username=user,password=secret,file_mode=0770,dir_mode=0770     0      0

The exact options are will vary with the use case. The key here is to set the gid of the mount to a specific group used for sharing with lxd containers and to give the latter the needed permissions.

$ addgroup lxd_guest
$ sudo mkdir /mnt/share
$ sudo mount /mnt/share

Lets assume that this new group lxd_guest has gid=1002. Now we must map this host gid to a gid in the LXD container to give that group access to the share. First we need to allow the host root user to map the gid of the lxd_guest group into a user namespace. This is needed since the LXD daemon is run by root. Add a new line in /etc/subgid:

root:1002:1

This means that root can use a range of size 1 starting at 1002. Now we need to create an id map for the lxd_guest gid to a container gid that is not already mapped into the container. Since the range 100000-165536 is mapped by default we need to chose something outside of that.

$ lxc config set trusty-1 raw.lxc "lxc.id_map = g 200000 1002 1"

The above will map gid 1002 on the host to gid 200000 on in the container. It’s actually a range of size 1. Next step is to mount the host directory from the samba share into the container:

$ lxc config device add trusty-1 share disk source=/mnt/share path=/mnt/samba_share

Restart the container and now in the container we need to create the group with gid 200000:

$ sudo addgroup --gid 200000 lxd_host
$ sudo adduser me lxd_host

Logout and login again into the container and listing the files in the share shall be possible.

Note that the procedure for mapping local host directories is the same except for the samba mounting part.

Some setup is needed in order to enable remote access to LXD. First LXD needs to be installed on the target host. Then enabling of the remote access needs to be done on both the source and target machine:

$ lxc config set core.trust_password somepassword
$ lxc config set core.https_address "ip_or_resolvable_hostname"

The setup is needed on both machines since it seems like the target actually pulls the container from the source. Take this with a pinch of salt since I have not confirmed this. In any case the target needs remote access to the source machine for copy to work.

Next step is to setup the remote target on the source machine:

$ lxc remote add target-host https://$IP_OR_HOSTNAME --password='somepassword'

Also the source needs to be setup as a remote on the source machine in order for the target machine to make contact with the source during transfer. This remote needs to be an address (ip or hostname) that is reachable from the target machine.

$ lxc remote add localhost https://$IP_OR_HOSTNAME:8443

Then, we are ready to make the copy:

$ lxc copy localhost:trusty-1 target-host:trusty-1

Note, that this is based on version 0.15 of lxd and in later releases the setup and use of localhost shall not be needed anymore as far as I understand.

Let’s check that the container arrived safely:

$ lxc list target-host:

Now, the iptables rules, samba mounts and other settings done to the source host needs to be done on the target host as well.