maybe finish LXD post?
This commit is contained in:
		
							parent
							
								
									47bc405d8a
								
							
						
					
					
						commit
						547b0c29f0
					
				| 
						 | 
					@ -39,6 +39,11 @@ migrate as soon as there's an installable release.
 | 
				
			||||||
 | 
					
 | 
				
			||||||
{{< /adm >}}
 | 
					{{< /adm >}}
 | 
				
			||||||
 | 
					
 | 
				
			||||||
 | 
					Questions, comments, and corrections are welcome! Feel free to use the
 | 
				
			||||||
 | 
					self-hosted comment system at the bottom, send me an email, an IM, reply to the
 | 
				
			||||||
 | 
					fediverse post, etc. Edits and corrections, if there are any, will be noted just
 | 
				
			||||||
 | 
					below this paragraph.
 | 
				
			||||||
 | 
					
 | 
				
			||||||
## The benefits of VMs and containers
 | 
					## The benefits of VMs and containers
 | 
				
			||||||
 | 
					
 | 
				
			||||||
- **Isolation:** you don't want to allow an attacker to infiltrate your email
 | 
					- **Isolation:** you don't want to allow an attacker to infiltrate your email
 | 
				
			||||||
| 
						 | 
					@ -362,12 +367,37 @@ entered. You should see the home page with just the text `earl` on it. If you go
 | 
				
			||||||
to `/login`, you'll be able to enter whatever access token you set earlier and
 | 
					to `/login`, you'll be able to enter whatever access token you set earlier and
 | 
				
			||||||
log in.
 | 
					log in.
 | 
				
			||||||
 | 
					
 | 
				
			||||||
### Executing a fork bomb
 | 
					### Further tips
 | 
				
			||||||
 | 
					
 | 
				
			||||||
 | 
					One of the things you mind want to do post-installation is mess around with
 | 
				
			||||||
 | 
					profiles. There's a `default` profile in LXD that you can show with `lxc profile
 | 
				
			||||||
 | 
					show default`.
 | 
				
			||||||
 | 
					
 | 
				
			||||||
 | 
					``` text
 | 
				
			||||||
 | 
					$ lxc profile show default
 | 
				
			||||||
 | 
					config: {}
 | 
				
			||||||
 | 
					description: Default LXD profile
 | 
				
			||||||
 | 
					devices:
 | 
				
			||||||
 | 
					  eth0:
 | 
				
			||||||
 | 
					    name: eth0
 | 
				
			||||||
 | 
					    network: lxdbr0
 | 
				
			||||||
 | 
					    type: nic
 | 
				
			||||||
 | 
					  root:
 | 
				
			||||||
 | 
					    path: /
 | 
				
			||||||
 | 
					    pool: default
 | 
				
			||||||
 | 
					    type: disk
 | 
				
			||||||
 | 
					name: default
 | 
				
			||||||
 | 
					used_by: []
 | 
				
			||||||
 | 
					```
 | 
				
			||||||
 | 
					
 | 
				
			||||||
 | 
					Not all config options are listed here though; you'll need to read [the
 | 
				
			||||||
 | 
					documentation] for a full enumeration.
 | 
				
			||||||
 | 
					
 | 
				
			||||||
 | 
					[the documentation]: https://documentation.ubuntu.com/lxd/en/latest/config-options/
 | 
				
			||||||
 | 
					
 | 
				
			||||||
I've seen some people say that executing a fork bomb from inside a container is
 | 
					I've seen some people say that executing a fork bomb from inside a container is
 | 
				
			||||||
equivalent to executing it on the host. The fork bomb will blow up the whole
 | 
					equivalent to executing it on the host. The fork bomb will blow up the whole
 | 
				
			||||||
system and render every application and container you're running inoperable.
 | 
					system and render every application and container you're running inoperable.
 | 
				
			||||||
 | 
					 | 
				
			||||||
That's partially true because LXD _by default_ doesn't put a limit on how many
 | 
					That's partially true because LXD _by default_ doesn't put a limit on how many
 | 
				
			||||||
processes a particular container can spawn. You can limit that number yourself
 | 
					processes a particular container can spawn. You can limit that number yourself
 | 
				
			||||||
by running
 | 
					by running
 | 
				
			||||||
| 
						 | 
					@ -380,12 +410,9 @@ Any container you create under the `default` profile will have a total process
 | 
				
			||||||
limit of `<num-processes>`. I can't tell you what a good process limit is
 | 
					limit of `<num-processes>`. I can't tell you what a good process limit is
 | 
				
			||||||
though; you'll need to do some testing and experimentation on your own.
 | 
					though; you'll need to do some testing and experimentation on your own.
 | 
				
			||||||
 | 
					
 | 
				
			||||||
Note that this doesn't _save_ you from fork bombs, all it does is prevent an
 | 
					As stated in [the containers section,](#containers) this doesn't _save_ you from
 | 
				
			||||||
affected container from affecting _other_ containers. If someone executes a fork
 | 
					fork bombs. It just helps prevent a fork bomb from affecting the host OS or
 | 
				
			||||||
bomb in a container, it'll be the same as if they executed it in a virtual
 | 
					other containers.
 | 
				
			||||||
machine; assuming it's a one-off, you'll need to fix it by rebooting the
 | 
					 | 
				
			||||||
container. If it was set to run at startup, you'll need to recreate the
 | 
					 | 
				
			||||||
container, restore from a backup, revert to a snapshot, etc.
 | 
					 | 
				
			||||||
 | 
					
 | 
				
			||||||
[^1]:
 | 
					[^1]:
 | 
				
			||||||
    There's a [technical
 | 
					    There's a [technical
 | 
				
			||||||
| 
						 | 
					
 | 
				
			||||||
		Loading…
	
		Reference in New Issue