|
| 1 | +--- |
| 2 | +title: 1 Install and Configuration |
| 3 | +author: Steven Spencer |
| 4 | +contributors: Ezequiel Bruni, Ganna Zhyrnova |
| 5 | +tested_with: 9.4 |
| 6 | +tags: |
| 7 | + - incus |
| 8 | + - enterprise |
| 9 | + - incus install |
| 10 | +--- |
| 11 | + |
| 12 | +Throughout this chapter, you must be the root user or be able to _sudo_ to root. |
| 13 | + |
| 14 | +## Instalar EPEL y OpenZFS Repositorios |
| 15 | + |
| 16 | +Incus requiere el repositorio de EPEL (Extra Packages for Enterprise Linux) el cual se instala con el siguiente comando: |
| 17 | + |
| 18 | +```bash |
| 19 | +dnf install epel-release -y |
| 20 | +``` |
| 21 | + |
| 22 | +Cuando se termine de instalar se tiene que verificar si hay actualizaciones: |
| 23 | + |
| 24 | +```bash |
| 25 | +dnf upgrade |
| 26 | +``` |
| 27 | + |
| 28 | +Si es que hubo, se tiene que reiniciar el servidor. |
| 29 | + |
| 30 | +### OpenZFS repository |
| 31 | + |
| 32 | +Install the OpenZFS repository with: |
| 33 | + |
| 34 | +```bash |
| 35 | +dnf install https://zfsonlinux.org/epel/zfs-release-2-2$(rpm --eval "%{dist}").noarch.rpm |
| 36 | +``` |
| 37 | + |
| 38 | +## Install `dkms`, `vim`, and `kernel-devel` |
| 39 | + |
| 40 | +Install some needed packages: |
| 41 | + |
| 42 | +```bash |
| 43 | +dnf install dkms vim kernel-devel bash-completion |
| 44 | +``` |
| 45 | + |
| 46 | +## Instalar Incus |
| 47 | + |
| 48 | +You will need the CRB repository available for some special packages and Neil Hanlon's COPR (Cool Other Package Repo): |
| 49 | + |
| 50 | +```bash |
| 51 | +dnf config-manager --enable crb |
| 52 | +dnf copr enable neil/incus |
| 53 | +dnf install incus incus-tools |
| 54 | +``` |
| 55 | + |
| 56 | +Enable and start the service: |
| 57 | + |
| 58 | +```bash |
| 59 | +systemctl enable incus --now |
| 60 | +``` |
| 61 | + |
| 62 | +Reboot the server before continuing here. |
| 63 | + |
| 64 | +## Instalar OpenZFS |
| 65 | + |
| 66 | +```bash |
| 67 | +dnf install zfs |
| 68 | +``` |
| 69 | + |
| 70 | +## Environment set up |
| 71 | + |
| 72 | +More than most server kernel settings is required to run many containers. If you assume from the beginning that you will use your server in production, you need to make these changes up front to avoid errors such as "Too many open files" from occurring. |
| 73 | + |
| 74 | +Luckily, tweaking the settings for Incus is not hard with a few file modifications and a reboot. |
| 75 | + |
| 76 | +### Modifying `limits.conf` |
| 77 | + |
| 78 | +The first file you must change is the `limits.conf` file. This file is self-documented. Examine the explanations in the comment in the file to understand what this file does. To make your modifications, enter: |
| 79 | + |
| 80 | +```bash |
| 81 | +vi /etc/security/limits.conf |
| 82 | +``` |
| 83 | + |
| 84 | +This entire file consists of comments and, at the bottom, shows the current default settings. You need to add our custom settings in the blank space above the end of the file marker (#End of file). The end of the file will look like this when completed: |
| 85 | + |
| 86 | +```text |
| 87 | +# Modifications made for LXD |
| 88 | +
|
| 89 | +* soft nofile 1048576 |
| 90 | +* hard nofile 1048576 |
| 91 | +root soft nofile 1048576 |
| 92 | +root hard nofile 1048576 |
| 93 | +* soft memlock unlimited |
| 94 | +* hard memlock unlimited |
| 95 | +``` |
| 96 | + |
| 97 | +Save your changes and exit (++shift+colon+"w"+"q"+exclam++ for _vi_). |
| 98 | + |
| 99 | +### Modifying `sysctl.conf` with `90-incus-override.conf` |
| 100 | + |
| 101 | +With _systemd_, you can change your system's overall configuration and kernel options _without_ modifying the main configuration file. Instead, put your settings in a separate file that will override the particular settings you need. |
| 102 | + |
| 103 | +To make these kernel changes, you will create a file called `90-incus-override.conf` in `/etc/sysctl.d`. To do this, type the following: |
| 104 | + |
| 105 | +```bash |
| 106 | +vi /etc/sysctl.d/90-incus-override.conf |
| 107 | +``` |
| 108 | + |
| 109 | +Place the following content in that file. Note that if you are wondering what you are doing here, the file content is self-documenting: |
| 110 | + |
| 111 | +```bash |
| 112 | +## The following changes have been made for LXD ## |
| 113 | + |
| 114 | +# fs.inotify.max_queued_events specifies an upper limit on the number of events that can be queued to the corresponding inotify instance |
| 115 | + - (default is 16384) |
| 116 | + |
| 117 | +fs.inotify.max_queued_events = 1048576 |
| 118 | + |
| 119 | +# fs.inotify.max_user_instances This specifies an upper limit on the number of inotify instances that can be created per real user ID - |
| 120 | +(default value is 128) |
| 121 | + |
| 122 | +fs.inotify.max_user_instances = 1048576 |
| 123 | + |
| 124 | +# fs.inotify.max_user_watches specifies an upper limit on the number of watches that can be created per real user ID - (default is 8192) |
| 125 | + |
| 126 | +fs.inotify.max_user_watches = 1048576 |
| 127 | + |
| 128 | +# vm.max_map_count contains the maximum number of memory map areas a process may have. Memory map areas are used as a side-effect of cal |
| 129 | +ling malloc, directly by mmap and mprotect, and also when loading shared libraries - (default is 65530) |
| 130 | + |
| 131 | +vm.max_map_count = 262144 |
| 132 | + |
| 133 | +# kernel.dmesg_restrict denies container access to the messages in the kernel ring buffer. Please note that this also will deny access t |
| 134 | +o non-root users on the host system - (default is 0) |
| 135 | + |
| 136 | +kernel.dmesg_restrict = 1 |
| 137 | + |
| 138 | +# This is the maximum number of entries in ARP table (IPv4). You should increase this if you create over 1024 containers. |
| 139 | + |
| 140 | +net.ipv4.neigh.default.gc_thresh3 = 8192 |
| 141 | + |
| 142 | +# This is the maximum number of entries in ARP table (IPv6). You should increase this if you plan to create over 1024 containers.Not nee |
| 143 | +ded if not using IPv6, but... |
| 144 | + |
| 145 | +net.ipv6.neigh.default.gc_thresh3 = 8192 |
| 146 | + |
| 147 | +# This is a limit on the size of eBPF JIT allocations which is usually set to PAGE_SIZE * 40000. Set this to 1000000000 if you are running Rocky Linux 9.x |
| 148 | + |
| 149 | +net.core.bpf_jit_limit = 1000000000 |
| 150 | + |
| 151 | +# This is the maximum number of keys a non-root user can use, should be higher than the number of containers |
| 152 | + |
| 153 | +kernel.keys.maxkeys = 2000 |
| 154 | + |
| 155 | +# This is the maximum size of the keyring non-root users can use |
| 156 | + |
| 157 | +kernel.keys.maxbytes = 2000000 |
| 158 | + |
| 159 | +# This is the maximum number of concurrent async I/O operations. You might need to increase it further if you have a lot of workloads th |
| 160 | +at use the AIO subsystem (e.g. MySQL) |
| 161 | + |
| 162 | +fs.aio-max-nr = 524288 |
| 163 | +``` |
| 164 | +
|
| 165 | +Save your changes and exit. |
| 166 | +
|
| 167 | +At this point, reboot the server. |
| 168 | +
|
| 169 | +### Checking `sysctl.conf` values |
| 170 | +
|
| 171 | +After the reboot, log back in as the root user to the server. You need to check that our override file has actually completed the job. |
| 172 | +
|
| 173 | +This is not hard to do. There's no need to verify every setting unless you want to, but checking a few will verify that the settings have changed. Do this with the `sysctl` command: |
| 174 | +
|
| 175 | +```bash |
| 176 | +sysctl net.core.bpf_jit_limit |
| 177 | +``` |
| 178 | +
|
| 179 | +Which will show you: |
| 180 | +
|
| 181 | +```bash |
| 182 | +net.core.bpf_jit_limit = 1000000000 |
| 183 | +``` |
| 184 | +
|
| 185 | +Do the same with a few other settings in the override file to verify the changes. |
0 commit comments