1 <?xml version="1.0" encoding="UTF-8"?>
2 <!DOCTYPE database SYSTEM "configuration.dtd" []>
5 <database xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
6 xsi:noNamespaceSchemaLocation="file:configuration.xsd">
8 <!-- Global configuration -->
9 <collection name=".defaults" use="optional">
10 <collection name="init" type="fixed">
12 <description>Default mtab file</description>
16 <link name="vdirbase">
17 <default>/vservers</default>
18 <description>A link to the default vserver rootdirectory.</description>
22 <boolean id="global-nonamespace" name="nonamespace">
24 Disable namespace usage globally. It can be overridden for a single vserver
25 by setting the <optionref ref="global-namespace">namespace</optionref> flag
28 In this mode the /vservers directory must have the 'barrier'
29 attribute. Else, common chroot(2) exploits are possible.
35 Path of the vserver run reverse directory. This directory contains
36 symlinks named with XID numbers which point back to the configuration
37 directory of vservers. Under kernel 2.4 this is required for the XID
38 to VSERVER mapping; Under kernel 2.6 it is unused.
40 NOTE: this link exists in 0.30.202+ only; in previous versions it was
41 a vserver specific setting.
45 <collection name="apps">
46 <collection name="pkgmgmt">
48 <default>/vservers/.pkg</default>
50 <data name="apt.conf">
51 <description>The default apt.conf which is going to be used. It is overridden by
52 distribution specific configuration file.
57 <collection name="debootstrap">
58 <scalar name="mirror">
60 The Debian mirror to use with the <tool>debootstrap</tool> program
65 When the <tool>debootstrap</tool> package is not installed; fetch it
66 from this uri and install it at a temporary place.
71 <collection name="vshelper">
74 The file where output will be logged to when <tool>vshelper</tool>
75 is invoked from the kernel. This should point somewhere e.g. into
80 <collection name="vshelper-methods">
81 <program name="handler" type="symbolic">
88 <boolean name="disabled">
90 When existing, the vshelper functionality will be disabled for all
95 <boolean name="debug">
97 When existing, the vshelper execution will be traced.
101 <boolean name="warning-disabled">
103 When existing, sanity checks for the vshelper functionality will be
110 <collection name="vprocunhide">
113 A list of files which will be made visibly by vprocunhide. Wildcards are
114 allowed and anything ending in '/' will be processed recursively. When this file exists,
115 it overrides the defaults in SYSDEFAULTDIR/vprocunhide-files. The entries there must be
116 absolute filenames inclusive the leading '/proc'.
121 <collection name="init">
124 A symlink to the TTY device where input/output will be redirected from/to
125 at startup via initscript.
130 <collection name="vunify">
131 <list name="exclude">
132 <description>Static list of excluded files.</description>
135 <collection name="hash" since="0.30.205">
137 A directory which will be used as the storage place for the
138 <tool>vhashify</tool> command.
140 <link name="id" type="symbolic">
142 Points to a directory within the filesystems which are used for the
143 vservers. There must be not more than one of such a directory per
148 <scalar name="method" since="0.30.299">
149 <default>SHA1</default>
150 <description>The used hash method.</description>
154 <boolean name="pkgmgmt-ignore" default="off" since="0.30.205">
156 When existing, information from packagemanagement will not be used to
157 create dynamic exclude-lists.
161 <boolean name="pgkmgmt-force" default="off" since="0.30.205">
163 When existing, information from packagemanagement will be used to
164 create dynamic exclude-lists. This option requires that (a known)
165 packagemanagement is configured for the vserver; else the requested
166 operation will fail. Most tools assume 'on' as the default value.
174 <collection name=".distributions" use="optional">
175 <collection name="dist" type="symbolic">
177 <description></description>
179 <collection name="yum">
181 The default, yum-related content of the /etc directory.
183 <scalar name="yum.conf">
185 The master yum configuration file. It supports the @YUMETCDIR@,
186 @YUMCACHEDIR@ and @YUMLOGDIR@ placeholder which will be replaced at
187 <command>vserver ... build</command> time.
191 <collection name="yum.repos.d">
192 <description>A directory with yum repositories.</description>
194 <data name="apt.conf">
196 The default apt.conf which is going to be used. It overrides the
197 apt.conf from CONFDIR/.defaults/apps/pkgmgmt.
200 <program name="initpre">
202 Script which will be executed before packages will be installed.
205 <parameter name="confdir">
207 The configuration directory of the vserver which is going to be set up.
210 <parameter name="vserver">
212 The pathname of the vserver binary.
217 <program name="initpost">
219 Script which will be executed after packages are installed.
222 <parameter name="confdir">
224 The configuration directory of the vserver which is going to be set up.
227 <parameter name="vserver">
229 The pathname of the vserver binary.
235 <collection name="pkgs">
237 Contains files with packagenames.
241 File which contains the name of packages. On top of file the special
242 keywords '--reinstall' and '--can-fail' are possible.
247 <collection name="pubkeys">
249 Directory with GPG pubkeys which are used to sign the packages of this
254 <collection name="apt">
256 Default content of the /etc/apt/ directory.
260 <collection name="rpm">
262 Default content of the /etc/rpm directory.
268 Directory which overrides /usr/lib/rpm.
271 <link name="execdir">
273 Directory with all executables and libraries which are required for
280 <!-- Vserver configuration -->
281 <collection name="vserver-name" type="symbolic">
283 The configuration directory for the vserver vserver-name.
288 Path of the vserver root directory
294 Points to a file which will contain the XID of the running vserver. When
295 the vserver is stopped, this can be a dangling symlink.
299 <list id="bcapabilities" name="bcapabilities">
301 [experimental; name is subject of possible change] Contains the system capabilities. See
302 <ulink url="http://savannah.nongnu.org/cgi-bin/viewcvs/util-vserver/util-vserver/lib/bcaps-v13.c?rev=HEAD">lib/bcaps-v13.c</ulink>
306 <list name="ccapabilities">
308 [experimental; name is subject of possible change] Contains the
309 context capabilities. See <ulink
310 url="http://savannah.nongnu.org/cgi-bin/viewcvs/util-vserver/util-vserver/lib/ccaps-v13.c?rev=HEAD">lib/ccaps-v13.c</ulink>
315 <boolean id="global-namespace" name="namespace">
317 Overrides the global <optionref ref="global-nonamespace">nonamespace</optionref> flag and enables
318 namespace usage for the current vserver.
322 <boolean name="nonamespace">
324 Disables namespace usage for the current vserver.
326 In this mode the /vservers directory must have the 'barrier'
327 attribute. Else, common chroot(2) exploits are possible.
331 <hash name="schedule">
333 [experimental; name is subject of possible change] Contains the
334 scheduler parameters, one per line.
336 The Hard CPU limit uses a mechanism called a Token Bucket. the
337 concept is simple: you have a bucket of a certain size which is
338 filled with a specified amount R of tokens each interval T until the
339 maximum is reached (excess tokens are spilled). At each timer tick,
340 a running process consumes one token from the bucket, unless the
341 bucket is empty. If the bucket is empty the process is put in the
342 hold queue. When the bucket has been refilled to at least M tokens,
343 all on hold processes are rescheduled.
346 <key id="fill_rate" name="fill-rate">
348 Amount of tokens append to the bucket each interval.
351 <key name="interval">
353 The intervall between refills of amount <optionref>fill_rate</optionref>. This
354 value is express in ticks.
359 Initial bucket contents.
362 <key name="tokens-min">
364 The minimum amount of tokens required to unhold processes
367 <key name="tokens-max">
372 <key name="priority-bias">
381 Contains the name of the vserver. When not given, the basename of the directory
382 will be assumed as this name.
387 The nice-level on which the vserver will be started.
390 <list name="capabilities">
392 Contains per line a capability. This file is used for the 2.4 kernel
393 only; for 2.6 use <optionref>bcapabilities</optionref>.
396 <scalar name="shell">
398 Contains the pathname of the shell which will be used by the "vserver
404 Contains per line a flag. See <ulink
405 url="http://savannah.nongnu.org/cgi-bin/viewcvs/util-vserver/util-vserver/lib/cflags-v13.c?rev=HEAD">lib/cflags-v13.c</ulink>
409 <element name="fakeinit">
411 The new process will believe it is process number 1. Useful to run a
412 real /sbin/init in a vserver. Warning: this flag should not be used
413 unless you know what you are doing. Often, it is better to use the
417 <element name="lock">
419 The new process is trapped and can't use chcontext anymore.
422 <element name="sched">
424 The new process and its children will share a common
427 <element name="nproc">
429 Limit the number of process in the vserver according to
430 ulimit setting. Normally, ulimit is a per user thing.
431 With this flag, it becomes a per vserver thing.
434 <element name="private">
436 No one can join this security context once created.
439 <element name="ulimit">
441 Apply the current ulimit to the whole context
446 <scalar name="context">
448 Contains the context which shall be used for the vserver.
453 The fstab file for the vserver. Entries in this file will be mounted
454 within the network context of the vserver; this means that mount will
455 be called as <command>chbind <options> mount ...</command>. Use
456 the 'fstab.local' file when you do not want this behavior, but in most
457 cases the 'fstab' file should be used.
460 <data name="fstab.local">
462 The fstab file for the vserver. In opposite to the normal 'fstab'
463 file, the mounting happens in the local network context. Currently
464 there is no way to mix entries of both files; 'fstab' will be always
465 processed before 'fstab.local'.
469 <collection name="apps">
470 <collection name="init">
473 The initial-mtab which will be used for the vserver.
477 <scalar name="style">
479 Contains the init-style.
482 <enumeration value="sysv"/>
483 <enumeration value="plain"/>
484 <enumeration value="minit"/>
485 <enumeration value="gento"/>
489 <scalar name="runlevel">
490 <description>The start runlevel.</description>
493 <scalar name="runlevel.start">
494 <description>The start runlevel.</description>
497 <scalar name="runlevel.stop">
498 <description>The stop runlevel.</description>
501 <scalar name="killseq">
503 Contains the 'signal [wait signal]*' sequence which is used to stop
508 <list name="cmd.start">
510 The command which is used to start the vserver. Each option must be on
515 <list name="cmd.start-sync">
517 The command which is used to wait on the vserver after it has been
518 started. Each option must be on a separate line. This file will be
519 ignored when the <optionref>sync</optionref> flag does not exist and the
520 '--sync' option was not used.
524 <list name="cmd.stop">
526 The command which is used to stop the vserver. Each option must be on
531 <list name="cmd.stop-sync">
533 The command which is used to wait on the vserver after it has been
534 stopped. Each option must be on a separate line. This file will be
535 ignored when the <optionref>sync</optionref> flag does not exist and the
536 '--sync' option was not used.
540 <list name="cmd.prepare">
542 The command which is used to setup the init-system (e.g. to set the
543 runlevel in the utmp-file). Each option must be on a separate line.
547 <boolean id="sync" name="sync">
549 If this file is not present, all 'cmd.*-sync files will be ignored.
555 A symlink to the TTY device where input/output will be redirected
556 from/to at startup via initscript.
562 This file is used to mark group of vservers which shall be started/stopped
563 together by the initscript. Content is a simple string like 'default'.
567 <list name="depends">
569 This file is used to configure vservers which must be running before
570 the current vserver can be started. At shutdown, the current vserver
571 will be stopped before its dependencies. Content of this file are
572 vserver ids (one name per line).
577 <collection name="vshelper">
578 <scalar name="sync-timeout">
579 <default>30</default>
581 The timeout in seconds which is used when synchronising vserver
582 startup/shutdown with the vshelper. When no set, 30 seconds will be
587 <scalar name="action">
588 <default>restart</default>
590 The action which is going to be executed when a vshelper event
591 occurs. The default value is 'restart', but there can be defined own
592 methods by placing scripts into the
593 <optionref>vshelper-methods</optionref> directories. These scripts are
594 fed with the same arguments as the <tool>vshelper</tool> script.
598 <program name="event" type="symbolic">
600 When existing, these scripts will be executed *instead* of the default
601 handler defined in 'action'. Their name must match the event which caused
602 the execution of <tool>vshelper</tool>; e.g. 'restart' or 'poweroff'. See
603 the vs_reboot() function in the kernel for more details.
606 <parameter name="xid">
608 The xid of the context calling the vshelper
611 <parameter name="event">
619 <boolean name="disabled">
621 When existing, the vshelper functionality will be disabled for this
626 <boolean name="debug">
628 When existing, the vshelper execution will be traced for this vserver.
632 <boolean name="warning-disabled">
634 When existing, sanity checks for the vshelper functionality will be
641 <collection id="vshelper-methods" name="vshelper-methods">
642 <program name="handler" type="symbolic">
649 <collection name="vunify">
651 This directory contains configuration data required for vserver
655 <list name="exclude">
657 <p>Static list of files which are excluded for unification. This list
658 supports an rsync-like syntax: when a file is prefixed by '+', it is a
659 candidate for unification; when there is no prefix or a '-' or a '~' it
660 will be excluded. Shell-wildcards are allowed for the filenames.</p>
661 <p>When used with <tool>vcopy</tool>, the '~' prefix prevents copying
662 of the file entirely (e.g. for keyfiles). With this tool, the file will
663 be copied instead of hardlinked when the '-' prefix is used.</p>
667 <link name="refserver.X" type="symbolic">
669 These are symlinks to the configuration directory
670 (e.g. CONFDIR/vservers/<id>) of a refserver. There may be
671 multiple such symlinks but they must be prefixed by 'refserver.' and
672 will be processed in alphanumerical order.
676 <collection name="hash" since="0.30.205">
678 A directory which will be used as the storage place for the
679 <tool>vhashify</tool> command.
681 <link name="id" type="symbolic">
683 Points to a directory within the filesystems which are used for the
684 vservers. There must be not more than one of such a directory per
689 <scalar name="method" since="0.30.299">
690 <default>SHA1</default>
691 <description>The used hash method.</description>
695 <boolean name="pkgmgmt-ignore" default="off" since="0.30.205">
697 When existing, information from packagemanagement will not be used to
698 create dynamic exclude-lists.
702 <boolean name="pgkmgmt-force" default="off" since="0.30.205">
704 When existing, information from packagemanagement will be used to
705 create dynamic exclude-lists. This option requires that (a known)
706 packagemanagement is configured for the vserver; else the requested
707 operation will fail. Most tools assume 'on' as the default value.
714 <collection name="scripts">
716 A directory for scripts. By default, when one of these scripts will be
717 executed, the execution of defaultscripts (within .../.defaults/scripts)
718 will be skipped. To execute them nevertheless, the $DONT_SKIP_DEFAULTS
719 environment variable must be set by one of the in-shellcontext scripts
720 (the non-executable ones).
723 <program name="prepre-start">
725 The scriptlet which will be executed before the network-interfaces are
726 enabled and the directories are mounted."
729 <parameter name="vserver-dir">
731 The configuration directory of the current vserver.
734 <parameter name="vserver-name">
736 The name of the current vserver.
739 <parameter name="action">
741 The fixed value of the current action (e.g. 'prepre-start', 'post-stop'...).
746 <collection name="prepre-start.d">
748 Repository of prepre-start like scripts
750 <program name="script" type="symbolic">
751 <description>See prepre-start.</description>
753 <parameter name="vserver-dir">
755 The configuration directory of the current vserver.
758 <parameter name="vserver-name">
760 The name of the current vserver.
763 <parameter name="action">
765 The fixed value of the current action (e.g. 'prepre-start', 'post-stop'...).
772 <program name="pre-start">
774 The scriptlet which will be executed after network-interfaces were
775 enabled and the directories mounted, but before the vserver itself has
779 <parameter name="vserver-dir">
781 The configuration directory of the current vserver.
784 <parameter name="vserver-name">
786 The name of the current vserver.
789 <parameter name="action">
791 The fixed value of the current action (e.g. 'prepre-start', 'post-stop'...).
796 <collection name="pre-start.d">
798 Repository of pre-start like scripts
800 <program name="script" type="symbolic">
801 <description>See pre-start.</description>
803 <parameter name="vserver-dir">
805 The configuration directory of the current vserver.
808 <parameter name="vserver-name">
809 <description>The name of the current vserver.</description>
811 <parameter name="action">
813 The fixed value of the current action (e.g. 'prepre-start', 'post-stop'...).
821 <program name="post-start">
823 The scriptlet which will be executed after the vserver has been started.
826 <parameter name="vserver-dir">
827 <description>The configuration directory of the current vserver.</description>
829 <parameter name="vserver-name">
830 <description>The name of the current vserver.</description>
832 <parameter name="action">
834 The fixed value of the current action (e.g. 'prepre-start', 'post-stop'...).
839 <collection name="post-start.d">
840 <description>Repository of post-start like scripts</description>
841 <program name="script" type="symbolic">
842 <description>See post-start.</description>
844 <parameter name="vserver-dir">
845 <description>The configuration directory of the current vserver.</description>
847 <parameter name="vserver-name">
848 <description>The name of the current vserver.</description>
850 <parameter name="action">
852 The fixed value of the current action (e.g. 'prepre-start', 'post-stop'...).
860 <program name="pre-stop">
862 The scriptlet which will be executed before the vserver will be stopped.
865 <parameter name="vserver-dir">
866 <description>The configuration directory of the current vserver.</description>
868 <parameter name="vserver-name">
869 <description>The name of the current vserver.</description>
871 <parameter name="action">
873 The fixed value of the current action (e.g. 'prepre-start', 'post-stop'...).
878 <collection name="pre-stop.d">
880 Repository of pre-stop like scripts
882 <program name="script" type="symbolic">
883 <description>See pre-stop.</description>
885 <parameter name="vserver-dir">
886 <description>The configuration directory of the current vserver.</description>
888 <parameter name="vserver-name">
889 <description>The name of the current vserver.</description>
891 <parameter name="action">
893 The fixed value of the current action (e.g. 'prepre-start', 'post-stop'...).
900 <program name="post-stop">
902 The scriptlet which will be executed after the vserver has been
903 stopped, but before the directories will be umounted and the the
907 <parameter name="vserver-dir">
908 <description>The configuration directory of the current vserver.</description>
910 <parameter name="vserver-name">
911 <description>The name of the current vserver.</description>
913 <parameter name="action">
915 The fixed value of the current action (e.g. 'prepre-start', 'post-stop'...).
920 <collection name="post-stop.d">
921 <description>Repository of post-stop like scripts</description>
922 <program name="script" type="symbolic">
923 <description>See post-stop.</description>
925 <parameter name="vserver-dir">
926 <description>The configuration directory of the current vserver.</description>
928 <parameter name="vserver-name">
929 <description>The name of the current vserver.</description>
931 <parameter name="action">
933 The fixed value of the current action (e.g. 'prepre-start', 'post-stop'...).
940 <program name="postpost-stop">
942 The scriptlet which will be executed after the vserver has been stopped
946 <parameter name="vserver-dir">
947 <description>The configuration directory of the current vserver.</description>
949 <parameter name="vserver-name">
950 <description>The name of the current vserver.</description>
952 <parameter name="action">
954 The fixed value of the current action (e.g. 'prepre-start', 'post-stop'...).
959 <collection name="postpost-stop.d">
960 <description>Repository of postpost-stop like scripts</description>
961 <program name="script" type="symbolic">
962 <description>See postpost-stop.</description>
964 <parameter name="vserver-dir">
965 <description>The configuration directory of the current vserver.</description>
967 <parameter name="vserver-name">
968 <description>The name of the current vserver.</description>
970 <parameter name="action">
972 The fixed value of the current action (e.g. 'prepre-start', 'post-stop'...).
980 <collection name="interfaces">
981 <scalar name="bcast">
982 <description>The default broadcast address.</description>
985 <description>The default network device.</description>
987 <scalar name="prefix">
988 <description>The default network prefix-length.</description>
991 <description>The default network mask.</description>
993 <scalar name="scope">
994 <description>The default scope of the network interfaces.</description>
997 <collection name="iface" type="symbolic">
999 'iface' is an arbitrary name for the interface; the value itself is
1000 not important but may be interesting regarding interface-creation and
1001 usage with <tool>chbind</tool>. Both happens in alphabetical order and
1002 numbers like '00' are good names for these directories.
1005 <boolean name="disabled">
1006 <description>When this file exists, this interface will be ignored.</description>
1010 <description>The ip which will be assigned to this interface.</description>
1012 <scalar name="bcast">
1013 <description>The broadcast address.</description>
1016 <description>The network device.</description>
1018 <scalar name="prefix">
1019 <description>The network prefix-length.</description>
1021 <scalar name="mask">
1022 <description>The network mask.</description>
1024 <scalar name="scope">
1025 <description>The scope of the network interface.</description>
1027 <scalar name="name">
1029 When this file exists, the interface will be named with the text in
1030 this file. Without such an entry, the IP will not be shown by
1031 <tool>ifconfig</tool> but by <command>ip addr ls</command> only. Such
1032 a labeled interface is known as an "alias" also (e.g. 'eth0:foo').
1035 <boolean name="nodev">
1037 When this file exists, the interface will be assumed to exist
1038 already. This can be used to assign primary interfaces which are
1039 created by the host or another vserver.
1045 <collection name="ulimits">
1047 A directory with ulimits. Possible resources are cpu, data, fsize,
1048 locks, memlock, nofile, nproc, rss and/or stack. This configuration
1049 will be honored for kernel 2.4 only.
1051 <scalar name="resource" type="symbolic">
1053 A file which contains the hard- and soft-limit of the given resource
1054 in the first line. The special keyword 'inf' is recognized.
1057 <scalar name="resource.hard" type="symbolic">
1059 A file which contains the hard- of the given resource in the first
1060 line. The special keyword 'inf' is recognized.
1063 <scalar name="resource.soft" type="symbolic">
1065 A file which contains the soft- of the given resource in the first
1066 line. The special keyword 'inf' is recognized.
1071 <collection name="rlimits">
1073 A directory with resource limits. Possible resources are cpu, fsize,
1074 data, stack, core, rss, nproc, nofile, memlock, as and locks. This
1075 configuration will be honored for kernel 2.6 only.
1077 <scalar name="resource" type="symbolic">
1079 A file which contains the hard- and soft-limit of the given resource
1080 in the first line. The special keyword 'inf' is recognized.
1083 <scalar name="resource.hard" type="symbolic">
1085 A file which contains the hard- of the given resource in the first
1086 line. The special keyword 'inf' is recognized.
1089 <scalar name="resource.soft" type="symbolic">
1091 A file which contains the soft- of the given resource in the first
1092 line. The special keyword 'inf' is recognized.
1095 <scalar name="resource.min" type="symbolic">
1097 A file which contains the guaranted minimum of the given resource in
1098 the first line. The special keyword 'inf' is recognized.
1103 <collection name="uts">
1104 <scalar name="context">
1106 The context-name of the vserver. This file is listed for completeness
1107 only; the 'context' name is used and set internally by the util-vserver
1108 tools and can *not* be modified.
1111 <scalar name="sysname">
1112 <description>The sysname of the vserver</description>
1114 <scalar name="nodename">
1115 <description>The node-/hostname of the vserver</description>
1117 <scalar name="release">
1118 <description>The OS-release of the vserver</description>
1120 <scalar name="version">
1121 <description>The OS-version of the vserver</description>
1123 <scalar name="machine">
1124 <description>The machine-type of the vserver</description>
1126 <scalar name="domainname">
1127 <description>The NIS domainname of the vserver</description>