X-Git-Url: https://git.stderr.nl/gitweb?a=blobdiff_plain;f=var%2Flib%2Flxc%2Ftemplate%2Fconfig;h=e7aca33bf2eca41c077208d7455fe770edc11961;hb=6b0278f32376f57a5ef33853d4f8f4547ddcc4c3;hp=176643ade1920ccfb1f2cb87171871b372dca13b;hpb=254e878c407b37a7f65c201440fc35b10d73cdea;p=matthijs%2Fservers%2Ftika.git

diff --git a/var/lib/lxc/template/config b/var/lib/lxc/template/config
index 176643a..e7aca33 100644
--- a/var/lib/lxc/template/config
+++ b/var/lib/lxc/template/config
@@ -1,12 +1,29 @@
-lxc.tty = 4
-lxc.pts = 256
-lxc.rootfs = /var/lib/lxc/template/rootfs
+# Hostname
+lxc.utsname = template.local
+
+# Use this root filesystem
+lxc.rootfs = /containers/template
 
 # Log console output
 lxc.console = /var/log/lxc/template.lxc
 
-# Hostname
-lxc.utsname = template
+# The container gets a single virtual eth0 interface with a statically assigned
+# address (assigned by lxc-start, no need for the container to assign any
+# address itself).
+lxc.network.type = veth
+lxc.network.flags = up
+lxc.network.veth.pair = lxc-template
+lxc.network.name = eth0
+lxc.network.link = br-lxc
+lxc.network.ipv4 = 10.42.0.10/24
+lxc.network.ipv4.gateway = auto
+
+# The number of ttys available (shouldn't be less than the getty's
+# configured in the inittab).
+lxc.tty = 4
+
+# Use private pts for the container
+lxc.pts = 256
 
 # Deny all devices, except the following
 lxc.cgroup.devices.deny = a
@@ -32,6 +49,22 @@ lxc.cgroup.devices.allow = c 5:2 rwm
 # rtc
 lxc.cgroup.devices.allow = c 254:0 rwm
 
-# mounts point
-lxc.mount.entry=proc /var/lib/lxc/template/rootfs/proc proc nodev,noexec,nosuid 0 0
-lxc.mount.entry=sysfs /var/lib/lxc/template/rootfs/sys sysfs defaults  0 0
+# mounts (note that the second item in each list is the mount point, relative
+# to the rootfs)
+lxc.mount.entry=proc proc proc nodev,noexec,nosuid 0 0
+lxc.mount.entry=sysfs sys sysfs defaults  0 0
+lxc.mount.entry=/data/users data/users none defaults,bind 0 0
+
+# Disallow module (un)loading
+lxc.cap.drop = sys_module
+# Disallow doing raw io
+lxc.cap.drop = sys_rawio
+# Disallow changing the clock
+lxc.cap.drop = sys_time
+# Disallow changing network settings
+lxc.cap.drop = net_admin
+# Disallow changing auditing settings
+lxc.cap.drop = audit_control
+# Disallow various admin tasks (probably has side-effects)
+lxc.cap.drop = sys_admin
+# sys_boot is always dropped by lxc-start