Second episode on OpenVZ, tips and tricks for administrators. This time, I’m going to show you how to solve a strange behaviour with the BASH history file of your VE (container) not being read/written when accessed through the “vzctl enter” command, as shown below:

# vzctl enter <ctid>

OpenVZ documentation:

vzctl enter is similar to vzctl exec /bin/bash. The difference between the two is that vzctl enter makes the shell interpreter believe that it is connected to a terminal. As such, you receive a shell prompt and are able to execute multiple commands as if you were logged in to the Container.

However, be aware that vzctl enter is a potentially dangerous command if you have un-trusted users inside the Container. Your shell will have its file descriptors accessible for the Container root in the /proc filesystem and a malicious user could run ioctl calls on it. Never use vzctl enter for Containers you do not trust. That is why, vzctl enter is only supposed to be an off-duty way of connecting to Containers, not a complete replacement of ssh. Therefore, it has certain limitations, for example, you cannot establish ssh connections while being connected to a Container through vzctl enter.

So, what’s the problem?

The ‘HISTFILE’ environment variable is exported by vzctl to ‘/dev/null‘ instead of ‘~/.bash_history‘. But I wanted the history file logged EVERY time, whether you use SSH for connecting or the ‘vzctl’ command!

Here we go, just add the following line to your /root/.bashrc file:

HISTFILE=~/.bash_history

It will correctly export the env. variable every time you access the VE container.

This is the first episode of my ongoing series on OpenVZ: tips and tricks for administrators.

1. OpenVZ VE and ntpdate: Operation not permitted!

Scenario

Your isolated container (also known as VE) is not able to execute the ‘ntpdate‘ command (it sets the local date and time by polling the Network Time Protocol (NTP) server(s) given as the server arguments to determine the correct time) due to the following error message

# ntpdate time.example.com
ntpdate[$pid]: step-systime: Operation not permitted

Suggested Fix

# vzctl set <ctid> --capability sys_time:on --save

• <ctid> needs to be replaced by your container’s ID

After executing the command above, your container’s configuration file needs to be reloaded. Thus, use ‘vzctl‘ to restart it.

# vzctl restart <ctid>

Several of us have reported, since the F11 GA release date, that the display sometimes suddenly go blank for a brief period – a second or two – before coming back. Listed under the “Common F11 bugs” wiki page (bugzilla id #501601), the root cause has been identified in the X server and fixed (git commit) by Peter Hutterer. As Richard Hughes said: “XIDLETIME now works as expected, and gnome-session and gnome-power-manager do the right thing. This means no more random blanking when typing.”

There’s a pending Fedora 11 update here: please test it and add your feedback at the bottom of that page!