轻量级虚机：CGroup、LXC、Warden

三者的关系

严格的说，Container技术并非虚拟化，更准确的说它是一种资源隔离机制。VMM或者叫Hypervisor是标准的虚拟化技术，这种技术通过虚拟层（也就是VMM或叫Hypervisor）把上层虚拟机的指令转换成底层Host操作系统所认识的指令。所以，虚拟化技术可以在主机上虚拟出各种类型的操作系统，而Container技术只能“虚拟”出与其主机操作系统相同或很类似的“虚拟机”。

LXC和Warden以及最近火热的Docker都是基于CGroup在其上封装了一层。所以，我们还是一起学习CGroup吧:)

一、CGroup

（1）CGroup简介及用法

http://linuxaria.com/article/introduction-to-cgroups-the-linux-conrol-group?lang=en

控制资源的三种方法：

First method it’s to use the meta-filesystem of cgroups.

$ echo 2048 >>  /sys/fs/cgroup/cpu/Multimedia/cpu.shares

Second method it’s to use a set of commands

cgset -r cpu.shares=1024 Browsers

 Notice, the value of memory.memsw.limit_in_bytes must not less than that of memory.limit_in_bytes. See the following validation:

root@app-node-v-o:/home/test/memleak# echo 1G >>  /sys/fs/cgroup/memory/zhxue/memory.limit_in_bytes 

root@app-node-v-o:/home/test/memleak# echo 200M >>  /sys/fs/cgroup/memory/zhxue/memory.memsw.limit_in_bytes 
bash: echo: write error: Invalid argument
root@app-node-v-o:/home/test/memleak# echo 100M >>  /sys/fs/cgroup/memory/zhxue/memory.memsw.limit_in_bytes 
bash: echo: write error: Invalid argument
root@app-node-v-o:/home/test/memleak# echo 10G >>  /sys/fs/cgroup/memory/zhxue/memory.memsw.limit_in_bytes  

The cgred Daemon

Cgred is a daemon that moves tasks into cgroups according to parameters set in the /etc/cgrules.conf file. Entries in the /etc/cgrules.conf file can take one of the two forms:

• user hierarchies control_group
• user:command hierarchies control_group

For example:

mariadevices/usergroup/staff

This entry specifies that any processes that belong to the user named maria access the devices subsystem according to the parameters specified in the /usergroup/staff cgroup. To associate particular commands with particular cgroups, add the command parameter, as follows:

maria:ftpdevices/usergroup/staff/ftp

The entry now specifies that when the user named maria uses the ftp command, the process is automatically moved to the /usergroup/staff/ftp cgroup in the hierarchy that contains the devices subsystem.

/etc/cgrules.conf 文​​​件​​​中​​​的​​​条​​​目​​​可​​​包​​​括​​​以​​​下​​​额​​​外​​​符​​​号​​​：

• @ - 当​​​在​​​ user 使​​​用​​​前​​​缀​​​时​​​，代​​​表​​​是​​​一​​​个​​​组​​​群​​​而​​​不​​​是​​​单​​​独​​​用​​​户​​​。​​​例​​​如​​​：@admins 是​​​ admins 组​​​群​​​中​​​的​​​所​​​有​​​用​​​户​​​。​​​

• * - 代​​​表​​​“​​​所​​​有​​​”​​​。​​​例​​​如​​​：subsystem 字​​​段​​​中​​​的​​​ * 代​​​表​​​所​​​有​​​子​​​系​​​统​​​。​​​

• % - 代​​​表​​​与​​​以​​​上​​​行​​​中​​​项​​​目​​​相​​​同​​​的​​​项​​​目​​​。​​​例​​​如​​​：

问题：

1）在ubuntu高版本（13.04）上无法更改memsw值：

a. 直接该文件不行

root@ubuntudev:/sys/fs/cgroup/memory# echo 100M >> zhxue/memory.limit_in_bytes root@ubuntudev:/sys/fs/cgroup/memory# echo 100M >> zhxue/memory.memsw.limit_in_bytes 
bash: echo: write error: Operation not supported
root@ubuntudev:/sys/fs/cgroup/memory# cat zhxue/memory.limit_in_bytes 
104857600
root@ubuntudev:/sys/fs/cgroup/memory# cat zhxue/memory.memsw.limit_in_bytes 
cat: zhxue/memory.memsw.limit_in_bytes: Operation not supported

b. 命令更改也无效：

root@ubuntudev:/sys/fs/cgroup/memory# cgset -r memory.memsw.limit_in_bytes=10MB zhxue
cgset: the group can't be modified

注意到memory.memsw.limit_in_bytes和memory.limit_in_bytes文件属性一模一样，为什么不能改？很奇怪。

(2) CGroup原理——很全面的文章

从底层数据结构到上层文件系统，非常有价值。

Linux Cgroups详解  by 王喆锋

http://files.cnblogs.com/lisperl/cgroups%E4%BB%8B%E7%BB%8D.pdf

(3) CGroup文件及参数详解

https://www.kernel.org/doc/Documentation/cgroups/

在内存这块，CGroup默认分配的内存为8PB，请看：

root@ubuntudev:/sys/fs/cgroup/memory# cgcreate -g memory:zhxue 

root@ubuntudev:/sys/fs/cgroup/memory# ll zhxue/
cgroup.clone_children            memory.memsw.usage_in_bytes
cgroup.event_control             memory.move_charge_at_immigrate
cgroup.procs                     memory.oom_control
memory.failcnt                   memory.soft_limit_in_bytes
memory.force_empty               memory.stat
memory.limit_in_bytes            memory.swappiness
memory.max_usage_in_bytes        memory.usage_in_bytes
memory.memsw.failcnt             memory.use_hierarchy
memory.memsw.limit_in_bytes      notify_on_release
memory.memsw.max_usage_in_bytes  tasks

root@ubuntudev:/sys/fs/cgroup/memory# cat  zhxue/memory.limit_in_bytes 
9223372036854775807

root@ubuntudev:/sys/fs/cgroup/memory# cgset -r memory.limit_in_bytes=10M zhxue

root@ubuntudev:/sys/fs/cgroup/memory# cat  zhxue/memory.limit_in_bytes 
10485760

二、LXC

LXC(Linux containers)配置文件简介

http://www.cnblogs.com/lisperl/archive/2012/04/16/2451215.html

LXC：Linux 容器工具

http://www.ibm.com/developerworks/cn/linux/l-lxc-containers/

Linux 内存不足的解决办法 – 增加虚拟内存 Swap Space

http://www.cpanelcn.info/linux-%E5%86%85%E5%AD%98%E4%B8%8D%E8%B6%B3%E7%9A%84%E8%A7%A3%E5%86%B3%E5%8A%9E%E6%B3%95-%E5%A2%9E%E5%8A%A0%E8%99%9A%E6%8B%9F%E5%86%85%E5%AD%98-swap-space.html